Trojan.Siggen10.16100

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'CentraStage' = '%ProgramFiles(x86)%\CentraStage\Gui.exe'
[<HKLM>\SOFTWARE\CLASSES\cag\shell\open\command] '' = '"%ProgramFiles(x86)%\CentraStage\Gui.exe" %1'

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\CagService] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\CagService] 'ImagePath' = '"%ProgramFiles(x86)%\CentraStage\CagService.exe"'
[<HKLM>\System\CurrentControlSet\Services\uvnc_service] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\uvnc_service] 'ImagePath' = '"%ProgramFiles(x86)%\CentraStage\UltraVNC\winvnc.exe" -service'

Создает следующие сервисы

'CagService' "%ProgramFiles(x86)%\CentraStage\CagService.exe"
'CagService' %ProgramFiles(x86)%\CentraStage\CagService.exe
'uvnc_service' "%ProgramFiles(x86)%\CentraStage\UltraVNC\winvnc.exe" -service

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\taskkill.exe' /f /im winvnc.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\nsg958b.tmp\system.dll
%ALLUSERSPROFILE%\centrastage\brand\windows_alertmodeonline.ico
%ALLUSERSPROFILE%\centrastage\brand\windows_alertmodeoffline.ico
%ALLUSERSPROFILE%\centrastage\brand\windows_agentrto.ico
%ALLUSERSPROFILE%\centrastage\brand\stopped.ico
%ALLUSERSPROFILE%\centrastage\brand\privacymode.ico
%ALLUSERSPROFILE%\centrastage\brand\primarylogo.png
%ALLUSERSPROFILE%\centrastage\brand\patchrebootwindow.png
%ALLUSERSPROFILE%\centrastage\brand\online.ico
%ALLUSERSPROFILE%\centrastage\brand\ondemandmode.ico
%ALLUSERSPROFILE%\centrastage\brand\offline.ico
%ALLUSERSPROFILE%\centrastage\brand\mac_light_stopped.ico
%ALLUSERSPROFILE%\centrastage\brand\mac_light_privacymode.ico
%ALLUSERSPROFILE%\centrastage\brand\mac_light_online.ico
%ALLUSERSPROFILE%\centrastage\brand\mac_light_ondemandmode.ico
%ALLUSERSPROFILE%\centrastage\brand\mac_light_offline.ico
%ALLUSERSPROFILE%\centrastage\brand\mac_light_alertmodeonline.ico
%ALLUSERSPROFILE%\centrastage\brand\mac_light_alertmodeoffline.ico
%ALLUSERSPROFILE%\centrastage\brand\mac_light_agentrto.ico
%ALLUSERSPROFILE%\centrastage\brand\mac_dark_stopped.ico
%ALLUSERSPROFILE%\centrastage\brand\mac_dark_privacymode.ico
%ALLUSERSPROFILE%\centrastage\brand\mac_dark_online.ico
%ALLUSERSPROFILE%\centrastage\brand\mac_dark_ondemandmode.ico
%ALLUSERSPROFILE%\centrastage\brand\mac_dark_offline.ico
%ALLUSERSPROFILE%\centrastage\brand\mac_dark_alertmodeonline.ico
%ALLUSERSPROFILE%\centrastage\brand\mac_dark_alertmodeoffline.ico
%ALLUSERSPROFILE%\centrastage\brand\mac_dark_agentrto.ico
%ALLUSERSPROFILE%\centrastage\brand\keys.xml
%ALLUSERSPROFILE%\centrastage\brand\desktopshortcut.ico
%ALLUSERSPROFILE%\centrastage\brand\alertmodeonline.ico
%ALLUSERSPROFILE%\centrastage\brand\agentrto.ico
%ALLUSERSPROFILE%\centrastage\brand\alertmodeoffline.ico
%ALLUSERSPROFILE%\centrastage\brand\windows_offline.ico
%ALLUSERSPROFILE%\centrastage\brand\windows_ondemandmode.ico
<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\ui0r030m.newcfg
%ALLUSERSPROFILE%\centrastage\packages\e392188c-4e73-195f-329b-e8066babf736.resume
<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\i2ym1lay.newcfg
<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\t3bkrbxe.newcfg
%WINDIR%\temp\tmpbe97\build\resources3
%WINDIR%\temp\tmpbe97\build\resources1
%WINDIR%\temp\tmpbe97\build\nlog.config
%WINDIR%\temp\tmpbe97\build\aemagent.exe.config
%WINDIR%\temp\tmpbe97\build\aria2c.exe
%WINDIR%\temp\tmpbe97\build\aemagent.exe
%WINDIR%\temp\tmpbe97\aemagentwindeploy.2.zip
%WINDIR%\temp\tmpbe97.tmp.resume
%WINDIR%\temp\tarbbf8.tmp
%WINDIR%\temp\cabbbf7.tmp
%WINDIR%\temp\tara5f6.tmp
%ProgramFiles(x86)%\centrastage\sv\gui.resources.dll
%WINDIR%\temp\caba5f5.tmp
%LOCALAPPDATA%\centrastage\gui.exe_url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.2109.2109\nvtarfnl.newcfg
%WINDIR%\temp\tar8e5f.tmp
%WINDIR%\temp\cab8e5e.tmp
%WINDIR%\temp\tar7763.tmp
%WINDIR%\temp\cab7762.tmp
%WINDIR%\temp\tar7733.tmp
%WINDIR%\temp\cab7732.tmp
<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\gxgn5b5r.newcfg
%ALLUSERSPROFILE%\centrastage\aemagent\settings.json
<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\err3ai0b.newcfg
%ALLUSERSPROFILE%\centrastage\brand\windows_stopped.ico
%ALLUSERSPROFILE%\centrastage\brand\windows_privacymode.ico
%ALLUSERSPROFILE%\centrastage\brand\windows_online.ico
%ALLUSERSPROFILE%\centrastage\packages\e392188c-4e73-195f-329b-e8066babf736
%ALLUSERSPROFILE%\centrastage\monitoring\deviceuptimeperformancemonitorv2.xml
%ProgramFiles(x86)%\centrastage\uninst.exe
%ProgramFiles(x86)%\centrastage\weifenluo.winformsui.docking.dll
%ProgramFiles(x86)%\centrastage\transitions.dll
%ProgramFiles(x86)%\centrastage\system.threading.tasks.dll
%ProgramFiles(x86)%\centrastage\system.runtime.dll
%ProgramFiles(x86)%\centrastage\system.io.dll
%ProgramFiles(x86)%\centrastage\snmpsharpnet.dll
%ProgramFiles(x86)%\centrastage\snmp.dll
%ProgramFiles(x86)%\centrastage\nlog.dll
%ProgramFiles(x86)%\centrastage\smartthreadpool.dll
%ProgramFiles(x86)%\centrastage\nlog.config
%ProgramFiles(x86)%\centrastage\newtonsoft.json.dll
%ProgramFiles(x86)%\centrastage\microsoft.threading.tasks.extensions.dll
%ProgramFiles(x86)%\centrastage\microsoft.threading.tasks.extensions.desktop.dll
%ProgramFiles(x86)%\centrastage\microsoft.threading.tasks.dll
%ProgramFiles(x86)%\centrastage\icsharpcode.sharpziplib.dll
%ProgramFiles(x86)%\centrastage\gui.exe.config
%ProgramFiles(x86)%\centrastage\gui.exe
%ProgramFiles(x86)%\centrastage\fslexyacc.runtime.dll
%ProgramFiles(x86)%\centrastage\fsharp.core.dll
%ProgramFiles(x86)%\centrastage\core.xmlserializers.dll
%ProgramFiles(x86)%\centrastage\core.dll
%ProgramFiles(x86)%\centrastage\common.dll
%ProgramFiles(x86)%\centrastage\cagservice.exe.config
%ProgramFiles(x86)%\centrastage\cagservice.exe
%ProgramFiles(x86)%\centrastage\axinterop.viewerx.dll
%ProgramFiles(x86)%\centrastage\axinterop.mstsclib.dll
%ProgramFiles(x86)%\centrastage\defaultbrand.zip
%ProgramFiles(x86)%\centrastage\csicon.ico
%ProgramFiles(x86)%\centrastage\interop.viewerx.dll
%ProgramFiles(x86)%\centrastage\scvncctrl.dll
%ProgramFiles(x86)%\centrastage\interop.mstsclib.dll
%ProgramFiles(x86)%\centrastage\windowsagent.dll
<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\brimnobj.newcfg
%ProgramFiles(x86)%\centrastage\microsoft.web.services3.dll
<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\2o4zhvpx.newcfg
<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\qd5uvkxk.newcfg
%ProgramFiles(x86)%\centrastage\log.txt
%TEMP%\nsg958b.tmp\nsexec.dll
%TEMP%\nsg958b.tmp\simplesc.dll
%TEMP%\nsg958b.tmp\nsscm.dll
%TEMP%\nsg958b.tmp\nsprocess.dll
%TEMP%\nsg958b.tmp\simplefc.dll
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\centrastage\uninstall agent.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\centrastage\agent browser.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\centrastage\agent monitor.lnk
%TEMP%\nsg958b.tmp\nsisxml.dll
%ProgramFiles(x86)%\centrastage\nl\gui.resources.dll
%LOCALAPPDATA%\centrastage\gui.exe_url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.2109.2109\ommzuju2.newcfg
<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\t4aotxp2.newcfg
%ProgramFiles(x86)%\centrastage\pt\gui.resources.dll
%ProgramFiles(x86)%\centrastage\it\gui.resources.dll
%ProgramFiles(x86)%\centrastage\fr\gui.resources.dll
%ProgramFiles(x86)%\centrastage\de\gui.resources.dll
%ProgramFiles(x86)%\centrastage\es\gui.resources.dll
%ProgramFiles(x86)%\centrastage\ultravnc\gnu.txt
%ProgramFiles(x86)%\centrastage\ultravnc\ultravnc.ini
%ProgramFiles(x86)%\centrastage\ultravnc\winvnc.exe
%ProgramFiles(x86)%\centrastage\ultravnc\schook.dll
%ProgramFiles(x86)%\centrastage\ultravnc\cad.exe
%ProgramFiles(x86)%\centrastage\vim25service.xmlserializers.dll
%ProgramFiles(x86)%\centrastage\vim25service.dll
%ProgramFiles(x86)%\centrastage\putty.exe
%ProgramFiles(x86)%\centrastage\csexec.service.exe
%ProgramFiles(x86)%\centrastage\hu\gui.resources.dll
<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\nzjms5p1.newcfg

Удаляет следующие файлы

%TEMP%\nsg958b.tmp\nsexec.dll
%WINDIR%\temp\tmpbe97.2.tmp
%WINDIR%\temp\tarbbf8.tmp
%WINDIR%\temp\cabbbf7.tmp
%WINDIR%\temp\tara5f6.tmp
%WINDIR%\temp\caba5f5.tmp
%WINDIR%\temp\tar8e5f.tmp
%WINDIR%\temp\cab8e5e.tmp
%WINDIR%\temp\tar7763.tmp
%WINDIR%\temp\cab7762.tmp
%WINDIR%\temp\tar7733.tmp
%WINDIR%\temp\cab7732.tmp
%TEMP%\nsg958b.tmp\system.dll
%TEMP%\nsg958b.tmp\simplesc.dll
%TEMP%\nsg958b.tmp\simplefc.dll
%TEMP%\nsg958b.tmp\nsscm.dll
%TEMP%\nsg958b.tmp\nsprocess.dll
%TEMP%\nsg958b.tmp\nsisxml.dll
%WINDIR%\temp\tmpbe97\aemagentwindeploy.2.zip
%ALLUSERSPROFILE%\centrastage\packages\e392188c-4e73-195f-329b-e8066babf736

Перемещает следующие файлы

<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\qd5uvkxk.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\user.config
<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\ui0r030m.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\user.config
<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\i2ym1lay.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\user.config
<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\t3bkrbxe.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\user.config
%WINDIR%\temp\tmpbe97.tmp в %WINDIR%\temp\tmpbe97.2.tmp
%WINDIR%\temp\tmpbe97\build\resources3 в %ALLUSERSPROFILE%\centrastage\aemagent\resources3
%WINDIR%\temp\tmpbe97\build\resources1 в %ALLUSERSPROFILE%\centrastage\aemagent\resources1
%WINDIR%\temp\tmpbe97\build\nlog.config в %ALLUSERSPROFILE%\centrastage\aemagent\nlog.config
%WINDIR%\temp\tmpbe97\build\aria2c.exe в %ALLUSERSPROFILE%\centrastage\aemagent\aria2c.exe
%WINDIR%\temp\tmpbe97\build\aemagent.exe.config в %ALLUSERSPROFILE%\centrastage\aemagent\aemagent.exe.config
%WINDIR%\temp\tmpbe97\build\aemagent.exe в %ALLUSERSPROFILE%\centrastage\aemagent\aemagent.exe
%WINDIR%\temp\tmpbe97.tmp.resume в %WINDIR%\temp\tmpbe97.tmp
%LOCALAPPDATA%\centrastage\gui.exe_url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.2109.2109\ommzuju2.newcfg в %LOCALAPPDATA%\centrastage\gui.exe_url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.2109.2109\user.config
%LOCALAPPDATA%\centrastage\gui.exe_url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.2109.2109\nvtarfnl.newcfg в %LOCALAPPDATA%\centrastage\gui.exe_url_skipuxqngzysnqnke2ck4pjjmof5uw4s\4.4.2109.2109\user.config
<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\gxgn5b5r.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\user.config
<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\err3ai0b.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\user.config
<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\brimnobj.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\user.config
<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\2o4zhvpx.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\user.config
<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\t4aotxp2.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\user.config
<SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\nzjms5p1.newcfg в <SYSTEM32>\config\systemprofile\appdata\local\centrastage\cagservice.exe_url_nin2uaxj2lsg1o0rsz2amvmcciusvum4\4.4.2109.2109\user.config

Подменяет следующие файлы

%ALLUSERSPROFILE%\centrastage\packages\e392188c-4e73-195f-329b-e8066babf736

Сетевая активность

TCP

Запросы HTTP GET

http://x.##2.us/x.cer
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

'02##.##ntrastage.net':443

'me#######ent.centrastage.net':443

'up#######rlot.centrastage.net':443

UDP

DNS ASK 02##.##ntrastage.net
DNS ASK me#######ent.centrastage.net
DNS ASK up#######rlot.centrastage.net
DNS ASK x.##2.us
DNS ASK microsoft.com

Другое

Ищет следующие окна

ClassName: '' WindowName: ''

Создает и запускает на исполнение

'%ProgramFiles(x86)%\centrastage\cagservice.exe'
'%ProgramFiles(x86)%\centrastage\ultravnc\winvnc.exe' -service
'%ProgramFiles(x86)%\centrastage\gui.exe'
'%ALLUSERSPROFILE%\centrastage\aemagent\aemagent.exe'
'%ALLUSERSPROFILE%\centrastage\aemagent\aria2c.exe' --show-console-readout=false --max-download-result=0 --log=aria.log --enable-rpc=true --summary-interval=10 --dir=%ALLUSERSPROFILE%\CentraStage\AEMAgent\Downloads --file-allocation=none --log-l...
'%WINDIR%\syswow64\taskkill.exe' /f /im winvnc.exe' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\CentraStage\scvncctrl.dll"
'<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="RMM RTC Proxy"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней