Exploit.Siggen2.27644

Техническая информация

Вредоносные функции

Создает и запускает на исполнение (эксплоит)

'%TEMP%\test_make_ptt.exe'

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\nwfieldnotes1966.docx

Изменения в файловой системе

Создает следующие файлы

%TEMP%\test_make_ptt.exe
%APPDATA%\microsoft\windows\cookies\(encrypted)user@adnxs[1].txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@adobe[1].txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@adobe[3].txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@bing[1].txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@bing[2].txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@c.bing[1].txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@c.bing[2].txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@c.msn[1].txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@c.msn[2].txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@demdex[2].txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@mozilla[2].txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@msn[2].txt(kgt)
C:\templist.txt
%APPDATA%\microsoft\windows\cookies\(encrypted)user@onlinestores.metaservices.microsoft[1].txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@scorecardresearch[2].txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@scorecardresearch[3].txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@www.bing[1].txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@www.msn[2].txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@www.msn[3].txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@yandex[1].txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@yandex[2].txt(kgt)
%APPDATA%\mail.ru\agent\mra\smiles\(encrypted)skin.txt(kgt)
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\(encrypted)revocations.txt(kgt)
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\(encrypted)sitesecurityservicestate.txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@246059135.log.optimizely[1].txt(kgt)
%APPDATA%\microsoft\windows\cookies\(encrypted)user@msn[1].txt(kgt)
%APPDATA%\icqm\icq\smiles\(encrypted)skin.txt(kgt)
C:\far2\documentation\rus\(encrypted)plugins_review.txt(kgt)
C:\enfilelist.txt
C:\far2\documentation\eng\(encrypted)arc_support.txt(kgt)
C:\far2\documentation\eng\(encrypted)bug_report.txt(kgt)
C:\far2\documentation\eng\(encrypted)far_faq.txt(kgt)
C:\far2\documentation\eng\(encrypted)plugins_install.txt(kgt)
C:\far2\documentation\eng\(encrypted)plugins_review.txt(kgt)
C:\far2\documentation\eng\(encrypted)techinfo.txt(kgt)
C:\far2\documentation\rus\(encrypted)arc_support.txt(kgt)
C:\far2\documentation\rus\(encrypted)bug_report.txt(kgt)
C:\far2\documentation\rus\(encrypted)far_faq.txt(kgt)
C:\far2\documentation\rus\(encrypted)plugins_install.txt(kgt)
C:\far2\documentation\rus\(encrypted)techinfo.txt(kgt)
%APPDATA%\opera software\opera stable\(encrypted)opera_shutdown_ms.txt(kgt)
C:\far2\plugins\ftp\(encrypted)ftpcmds.txt(kgt)
C:\far2\plugins\ftp\(encrypted)ftpcmds_rus.txt(kgt)
C:\far2\plugins\ftp\(encrypted)notes.txt(kgt)
C:\far2\plugins\ftp\(encrypted)notes_rus.txt(kgt)
%HOMEPATH%\desktop\(encrypted)adhd_and_obesity.docx(kgt)
%HOMEPATH%\desktop\(encrypted)glidescope_review_rev_010.docx(kgt)
%HOMEPATH%\desktop\(encrypted)hadac_newsletter_july_2010_final.docx(kgt)
%HOMEPATH%\desktop\(encrypted)nwfieldnotes1966.docx(kgt)
%APPDATA%\telegram desktop\(encrypted)log.txt(kgt)
%APPDATA%\icq-profile\update\(encrypted)ver.txt(kgt)
%APPDATA%\mra\update\(encrypted)ver.txt(kgt)
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\(encrypted)wer5c82.tmp.appcompat.txt(kgt)
C:\tip_readme.txt