Trojan.Siggen10.37625

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\Software\Classes\PROTOCOLS\Handler\vnd.ms.radio] 'CLSID' = '{3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020}'
[<HKLM>\Software\Classes\vnd.ms.radio\shell\open\command] '' = '"%ProgramFiles%\Windows Media Player\mplayer2.exe" "%L"'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-4r326.tmp\<Имя файла>.tmp
%ProgramFiles(x86)%\aurora media workshop\is-07ub0.tmp
%ProgramFiles(x86)%\aurora media workshop\is-ne2m7.tmp
%ProgramFiles(x86)%\aurora media workshop\is-3dgji.tmp
%ProgramFiles(x86)%\aurora media workshop\is-8rn0f.tmp
%ProgramFiles(x86)%\aurora media workshop\is-iq347.tmp
%ProgramFiles(x86)%\aurora media workshop\is-hi478.tmp
%ProgramFiles(x86)%\aurora media workshop\is-5387n.tmp
%ProgramFiles(x86)%\aurora media workshop\is-bet07.tmp
%ProgramFiles(x86)%\aurora media workshop\is-tlga0.tmp
%ProgramFiles(x86)%\aurora media workshop\is-3bi76.tmp
%ProgramFiles(x86)%\aurora media workshop\is-6nama.tmp
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\win9x\is-qank8.tmp
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\win9x\is-j0t54.tmp
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\win9x\is-jsp1o.tmp
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\win9x\is-vpdq4.tmp
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\win9x\is-7gc29.tmp
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winnt\is-jvria.tmp
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winnt\is-3ca6m.tmp
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winnt\is-ei11s.tmp
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winnt\is-kgvk2.tmp
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winnt\is-j9u2a.tmp
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winntdump\is-uoq9p.tmp
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winntdump\is-o63gb.tmp
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winntdump\is-905nd.tmp
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winntdump\is-k6tpt.tmp
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winntdump\is-05v2o.tmp
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\is-8nps8.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\aurora media workshop\aurora media workshop.lnk
%ProgramFiles(x86)%\aurora media workshop\nscompat.tlb
%ProgramFiles(x86)%\aurora media workshop\is-5eij7.tmp
%ProgramFiles(x86)%\aurora media workshop\amcompat.tlb
%ProgramFiles(x86)%\aurora media workshop\is-j8hj3.tmp
%ProgramFiles(x86)%\aurora media workshop\is-2iv9k.tmp
%TEMP%\is-cevk5.tmp\_isetup\_setup64.tmp
%TEMP%\is-cevk5.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\aurora media workshop\is-hjmc1.tmp
%WINDIR%\syswow64\is-ctl8l.tmp
%ProgramFiles(x86)%\aurora media workshop\is-3ophv.tmp
%ProgramFiles(x86)%\aurora media workshop\is-5h83o.tmp
%ProgramFiles(x86)%\aurora media workshop\skin\is-camcu.tmp
%ProgramFiles(x86)%\aurora media workshop\is-tu1c6.tmp
%ProgramFiles(x86)%\aurora media workshop\is-cshuj.tmp
%ProgramFiles(x86)%\aurora media workshop\is-u8d9t.tmp
%ProgramFiles(x86)%\aurora media workshop\is-1r8eo.tmp
%WINDIR%\syswow64\is-m3k45.tmp
%WINDIR%\syswow64\is-s5a1g.tmp
%ProgramFiles(x86)%\aurora media workshop\is-fv9fd.tmp
%ProgramFiles(x86)%\aurora media workshop\is-vs7t6.tmp
%ProgramFiles(x86)%\aurora media workshop\is-t4ebb.tmp
%ProgramFiles(x86)%\aurora media workshop\is-vju0d.tmp
%ProgramFiles(x86)%\aurora media workshop\is-uo1gv.tmp
%ProgramFiles(x86)%\aurora media workshop\is-8d580.tmp
%ProgramFiles(x86)%\aurora media workshop\is-p5qgf.tmp
%ProgramFiles(x86)%\aurora media workshop\is-r9q53.tmp
%ProgramFiles(x86)%\aurora media workshop\is-gravb.tmp
%ProgramFiles(x86)%\aurora media workshop\is-d242v.tmp
%ProgramFiles(x86)%\aurora media workshop\is-lo2ma.tmp
%ProgramFiles(x86)%\aurora media workshop\is-1j8t9.tmp
%ProgramFiles(x86)%\aurora media workshop\is-mchvb.tmp
%ProgramFiles(x86)%\aurora media workshop\is-r8p5r.tmp
%ProgramFiles(x86)%\aurora media workshop\is-uf6jk.tmp
%ProgramFiles(x86)%\aurora media workshop\is-f30qo.tmp
%ProgramFiles(x86)%\aurora media workshop\is-0m8cb.tmp
%ProgramFiles(x86)%\aurora media workshop\unins000.dat

Перемещает следующие файлы

%ProgramFiles(x86)%\aurora media workshop\is-hjmc1.tmp в %ProgramFiles(x86)%\aurora media workshop\unins000.exe
%ProgramFiles(x86)%\aurora media workshop\is-ne2m7.tmp в %ProgramFiles(x86)%\aurora media workshop\cdrip.dll
%ProgramFiles(x86)%\aurora media workshop\is-3dgji.tmp в %ProgramFiles(x86)%\aurora media workshop\vcdimager.dll
%ProgramFiles(x86)%\aurora media workshop\is-8rn0f.tmp в %ProgramFiles(x86)%\aurora media workshop\wmaudsdk.dll
%ProgramFiles(x86)%\aurora media workshop\is-iq347.tmp в %ProgramFiles(x86)%\aurora media workshop\libsnd.dll
%ProgramFiles(x86)%\aurora media workshop\is-hi478.tmp в %ProgramFiles(x86)%\aurora media workshop\mp3lib.dll
%ProgramFiles(x86)%\aurora media workshop\is-5387n.tmp в %ProgramFiles(x86)%\aurora media workshop\msvcrt.dll
%ProgramFiles(x86)%\aurora media workshop\is-bet07.tmp в %ProgramFiles(x86)%\aurora media workshop\msvcr70.dll
%ProgramFiles(x86)%\aurora media workshop\is-tlga0.tmp в %ProgramFiles(x86)%\aurora media workshop\msvcr71.dll
%ProgramFiles(x86)%\aurora media workshop\is-3bi76.tmp в %ProgramFiles(x86)%\aurora media workshop\wmvprofileeditor.ocx
%ProgramFiles(x86)%\aurora media workshop\is-6nama.tmp в %ProgramFiles(x86)%\aurora media workshop\aspisetup.exe
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\win9x\is-qank8.tmp в %ProgramFiles(x86)%\aurora media workshop\forceaspi17\win9x\apix.vxd
%ProgramFiles(x86)%\aurora media workshop\is-vju0d.tmp в %ProgramFiles(x86)%\aurora media workshop\support.ini
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\win9x\is-j0t54.tmp в %ProgramFiles(x86)%\aurora media workshop\forceaspi17\win9x\aspienum.vxd
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\win9x\is-vpdq4.tmp в %ProgramFiles(x86)%\aurora media workshop\forceaspi17\win9x\winaspi.dll
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\win9x\is-7gc29.tmp в %ProgramFiles(x86)%\aurora media workshop\forceaspi17\win9x\wnaspi32.dll
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winnt\is-jvria.tmp в %ProgramFiles(x86)%\aurora media workshop\forceaspi17\winnt\aspi32.sys
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winnt\is-3ca6m.tmp в %ProgramFiles(x86)%\aurora media workshop\forceaspi17\winnt\winaspi.dll
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winnt\is-ei11s.tmp в %ProgramFiles(x86)%\aurora media workshop\forceaspi17\winnt\winnt.reg
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winnt\is-kgvk2.tmp в %ProgramFiles(x86)%\aurora media workshop\forceaspi17\winnt\wnaspi32.dll
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winnt\is-j9u2a.tmp в %ProgramFiles(x86)%\aurora media workshop\forceaspi17\winnt\wowpost.exe
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winntdump\is-uoq9p.tmp в %ProgramFiles(x86)%\aurora media workshop\forceaspi17\winntdump\aspi32.sys
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winntdump\is-o63gb.tmp в %ProgramFiles(x86)%\aurora media workshop\forceaspi17\winntdump\frcaspi.txt
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winntdump\is-905nd.tmp в %ProgramFiles(x86)%\aurora media workshop\forceaspi17\winntdump\winaspi.dll
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winntdump\is-k6tpt.tmp в %ProgramFiles(x86)%\aurora media workshop\forceaspi17\winntdump\wnaspi32.dll
%ProgramFiles(x86)%\aurora media workshop\is-5eij7.tmp в %ProgramFiles(x86)%\aurora media workshop\viscomimage.dll
%ProgramFiles(x86)%\aurora media workshop\is-07ub0.tmp в %ProgramFiles(x86)%\aurora media workshop\vorbis.dll
%ProgramFiles(x86)%\aurora media workshop\is-j8hj3.tmp в %ProgramFiles(x86)%\aurora media workshop\nctaudiovisualization2.dll
%ProgramFiles(x86)%\aurora media workshop\is-0m8cb.tmp в %ProgramFiles(x86)%\aurora media workshop\nctaudiorecord2.dll
%ProgramFiles(x86)%\aurora media workshop\is-2iv9k.tmp в %ProgramFiles(x86)%\aurora media workshop\nctaudioplayer2.dll
%ProgramFiles(x86)%\aurora media workshop\is-3ophv.tmp в %ProgramFiles(x86)%\aurora media workshop\wmfdist.exe
%ProgramFiles(x86)%\aurora media workshop\is-5h83o.tmp в %ProgramFiles(x86)%\aurora media workshop\aurora media workshop.exe
%ProgramFiles(x86)%\aurora media workshop\skin\is-camcu.tmp в %ProgramFiles(x86)%\aurora media workshop\skin\winaqua.smf
%ProgramFiles(x86)%\aurora media workshop\is-tu1c6.tmp в %ProgramFiles(x86)%\aurora media workshop\videoedit.ocx
%ProgramFiles(x86)%\aurora media workshop\is-cshuj.tmp в %ProgramFiles(x86)%\aurora media workshop\mpeg2dmx.ax
%ProgramFiles(x86)%\aurora media workshop\is-u8d9t.tmp в %ProgramFiles(x86)%\aurora media workshop\mpgdec.ax
%ProgramFiles(x86)%\aurora media workshop\is-1r8eo.tmp в %ProgramFiles(x86)%\aurora media workshop\skinmagic.dll
%WINDIR%\syswow64\is-m3k45.tmp в %WINDIR%\syswow64\gdiplus.dll
%WINDIR%\syswow64\is-s5a1g.tmp в %WINDIR%\syswow64\smd.dll
%ProgramFiles(x86)%\aurora media workshop\is-fv9fd.tmp в %ProgramFiles(x86)%\aurora media workshop\libmpg-1.0.2.dll
%ProgramFiles(x86)%\aurora media workshop\is-vs7t6.tmp в %ProgramFiles(x86)%\aurora media workshop\libmcl-4.5.0.dll
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\winntdump\is-05v2o.tmp в %ProgramFiles(x86)%\aurora media workshop\forceaspi17\winntdump\wowpost.exe
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\win9x\is-jsp1o.tmp в %ProgramFiles(x86)%\aurora media workshop\forceaspi17\win9x\win9x.reg
%ProgramFiles(x86)%\aurora media workshop\is-t4ebb.tmp в %ProgramFiles(x86)%\aurora media workshop\foxburner.dll
%ProgramFiles(x86)%\aurora media workshop\is-8d580.tmp в %ProgramFiles(x86)%\aurora media workshop\msdxm.ocx
%ProgramFiles(x86)%\aurora media workshop\is-p5qgf.tmp в %ProgramFiles(x86)%\aurora media workshop\directencode.dll
%ProgramFiles(x86)%\aurora media workshop\is-r9q53.tmp в %ProgramFiles(x86)%\aurora media workshop\viscomwave.dll
%ProgramFiles(x86)%\aurora media workshop\is-gravb.tmp в %ProgramFiles(x86)%\aurora media workshop\lame_enc.dll
%ProgramFiles(x86)%\aurora media workshop\is-d242v.tmp в %ProgramFiles(x86)%\aurora media workshop\help.chm
%ProgramFiles(x86)%\aurora media workshop\is-lo2ma.tmp в %ProgramFiles(x86)%\aurora media workshop\tips.txt
%ProgramFiles(x86)%\aurora media workshop\is-1j8t9.tmp в %ProgramFiles(x86)%\aurora media workshop\license.txt
%ProgramFiles(x86)%\aurora media workshop\is-mchvb.tmp в %ProgramFiles(x86)%\aurora media workshop\readme.txt
%ProgramFiles(x86)%\aurora media workshop\is-r8p5r.tmp в %ProgramFiles(x86)%\aurora media workshop\homepage.url
%ProgramFiles(x86)%\aurora media workshop\is-uf6jk.tmp в %ProgramFiles(x86)%\aurora media workshop\buynow.url
%ProgramFiles(x86)%\aurora media workshop\is-f30qo.tmp в %ProgramFiles(x86)%\aurora media workshop\nctaudiofile2.dll
%WINDIR%\syswow64\is-ctl8l.tmp в %WINDIR%\syswow64\atl.exe
%ProgramFiles(x86)%\aurora media workshop\is-uo1gv.tmp в %ProgramFiles(x86)%\aurora media workshop\setup.ini
%ProgramFiles(x86)%\aurora media workshop\forceaspi17\is-8nps8.tmp в %ProgramFiles(x86)%\aurora media workshop\forceaspi17\installaspi.bat

Сетевая активность

Подключается к

'op###olad.com':80

TCP

Запросы HTTP POST

http://op###olad.com/v2/events

UDP

DNS ASK op###olad.com

Другое

Ищет следующие окна

ClassName: 'nuewduwbfbeuibewbf' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-4r326.tmp\<Имя файла>.tmp' /SL5="$A0220,13758077,215040,<Полный путь к файлу>"
'%ProgramFiles(x86)%\aurora media workshop\wmfdist.exe' /Q:A /R:N
'%ProgramFiles(x86)%\aurora media workshop\aurora media workshop.exe' <Имя файла>.exe

Запускает на исполнение

'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Aurora Media Workshop\VideoEdit.ocx"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Aurora Media Workshop\mpeg2dmx.ax"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Aurora Media Workshop\mpgdec.ax"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Aurora Media Workshop\msdxm.ocx"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Aurora Media Workshop\DirectEncode.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Aurora Media Workshop\viscomwave.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Aurora Media Workshop\NCTAudioFile2.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Aurora Media Workshop\NCTAudioPlayer2.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Aurora Media Workshop\NCTAudioRecord2.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Aurora Media Workshop\NCTAudioVisualization2.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Aurora Media Workshop\WMVProfileEditor.ocx"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней