Trojan.PWS.Siggen2.61709

Техническая информация

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%APPDATA%\opera software\opera stable\login data

Изменения в файловой системе

Создает следующие файлы

%TEMP%\_mei28202\pil\_imaging.cp37-win_amd64.pyd
%TEMP%\_mei28202\psutil\_psutil_windows.cp37-win_amd64.pyd
%TEMP%\_mei28202\pyexpat.pyd
%TEMP%\_mei28202\python37.dll
%TEMP%\_mei28202\pythoncom37.dll
%TEMP%\_mei28202\pywintypes37.dll
%TEMP%\_mei28202\select.pyd
%TEMP%\_mei28202\unicodedata.pyd
%TEMP%\_mei28202\win32api.pyd
%TEMP%\_mei28202\win32com\shell\shell.pyd
%TEMP%\_mei28202\win32pdh.pyd
%TEMP%\_mei28202\win32trace.pyd
%TEMP%\_mei28202\win32ui.pyd
%TEMP%\_mei28202\win32wnet.pyd
%TEMP%\_mei28202\_ssl.pyd
%TEMP%\_mei28202\include\pyconfig.h
%TEMP%\_mei28202\certifi\cacert.pem
%TEMP%\_mei28202\lib2to3\grammar.txt
%TEMP%\_mei28202\lib2to3\grammar3.7.0.final.0.pickle
%TEMP%\_mei28202\lib2to3\patterngrammar.txt
%TEMP%\_mei28202\lib2to3\patterngrammar3.7.0.final.0.pickle
%TEMP%\_mei28202\lib2to3\tests\data\readme
%TEMP%\w57ygi03
%HOMEPATH%\appdata\files\results\chrome\google chrome cookie
%HOMEPATH%\appdata\files\results\chrome\google chrome passwords
%HOMEPATH%\appdata\files\results\opera\opera cookie
%HOMEPATH%\appdata\files\results\opera\opera passwords
%APPDATA%\user-sreenshot.jpg
%HOMEPATH%\appdata\files\results\screen\user-sreenshot.jpg
%TEMP%\_mei28202\numpy\random\_sfc64.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\random\mtrand.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\random\_philox.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\random\_pcg64.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\random\_mt19937.cp37-win_amd64.pyd
%TEMP%\_mei28202\pil\_webp.cp37-win_amd64.pyd
%TEMP%\_mei28202\stealer.exe.manifest
%TEMP%\_mei28202\vcruntime140.dll
%TEMP%\_mei28202\_bz2.pyd
%TEMP%\_mei28202\_contextvars.pyd
%TEMP%\_mei28202\_ctypes.pyd
%TEMP%\_mei28202\_decimal.pyd
%TEMP%\_mei28202\_distutils_findvs.pyd
%TEMP%\_mei28202\_elementtree.pyd
%TEMP%\_mei28202\_hashlib.pyd
%TEMP%\_mei28202\_lzma.pyd
%TEMP%\_mei28202\_multiprocessing.pyd
%TEMP%\_mei28202\_queue.pyd
%HOMEPATH%\appdata\files\results\info\user-info.txt
%TEMP%\_mei28202\base_library.zip
%TEMP%\_mei28202\_socket.pyd
%TEMP%\_mei28202\libcrypto-1_1-x64.dll
%TEMP%\_mei28202\libopenblas.pyqhxlvvq7vesdpuvuadxevjobghjpay.gfortran-win_amd64.dll
%TEMP%\_mei28202\libssl-1_1-x64.dll
%TEMP%\_mei28202\mfc140u.dll
%TEMP%\_mei28202\numpy\core\_multiarray_tests.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\core\_multiarray_umath.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\fft\_pocketfft_internal.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\linalg\_umath_linalg.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\linalg\lapack_lite.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\random\_bit_generator.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\random\_bounded_integers.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\random\_common.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\random\_generator.cp37-win_amd64.pyd
%TEMP%\_mei28202\pil\_imagingtk.cp37-win_amd64.pyd
%TEMP%\_mei28202\_win32sysloader.pyd
%HOMEPATH%\appdata\files\user-st.zip

Удаляет следующие файлы

%TEMP%\w57ygi03
%TEMP%\_mei28202\pil\_imaging.cp37-win_amd64.pyd
%TEMP%\_mei28202\pil\_imagingtk.cp37-win_amd64.pyd
%TEMP%\_mei28202\pil\_webp.cp37-win_amd64.pyd
%TEMP%\_mei28202\psutil\_psutil_windows.cp37-win_amd64.pyd
%TEMP%\_mei28202\pyexpat.pyd
%TEMP%\_mei28202\python37.dll
%TEMP%\_mei28202\pythoncom37.dll
%TEMP%\_mei28202\pywintypes37.dll
%TEMP%\_mei28202\select.pyd
%TEMP%\_mei28202\stealer.exe.manifest
%TEMP%\_mei28202\unicodedata.pyd
%TEMP%\_mei28202\vcruntime140.dll
%TEMP%\_mei28202\win32api.pyd
%TEMP%\_mei28202\win32com\shell\shell.pyd
%TEMP%\_mei28202\win32pdh.pyd
%TEMP%\_mei28202\win32trace.pyd
%TEMP%\_mei28202\win32ui.pyd
%TEMP%\_mei28202\win32wnet.pyd
%TEMP%\_mei28202\_bz2.pyd
%TEMP%\_mei28202\_contextvars.pyd
%TEMP%\_mei28202\_ctypes.pyd
%TEMP%\_mei28202\_decimal.pyd
%TEMP%\_mei28202\_distutils_findvs.pyd
%TEMP%\_mei28202\_elementtree.pyd
%TEMP%\_mei28202\_hashlib.pyd
%TEMP%\_mei28202\_lzma.pyd
%TEMP%\_mei28202\_multiprocessing.pyd
%TEMP%\_mei28202\_queue.pyd
%TEMP%\_mei28202\_socket.pyd
%TEMP%\_mei28202\numpy\random\_sfc64.cp37-win_amd64.pyd
%TEMP%\_mei28202\_ssl.pyd
%TEMP%\_mei28202\numpy\random\_philox.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\random\_mt19937.cp37-win_amd64.pyd
%HOMEPATH%\appdata\files\results\chrome\google chrome cookie
%HOMEPATH%\appdata\files\results\chrome\google chrome passwords
%HOMEPATH%\appdata\files\results\info\user-info.txt
%HOMEPATH%\appdata\files\results\opera\opera cookie
%HOMEPATH%\appdata\files\results\opera\opera passwords
%HOMEPATH%\appdata\files\results\screen\user-sreenshot.jpg
%HOMEPATH%\appdata\files\user-st.zip
%TEMP%\_mei28202\base_library.zip
%TEMP%\_mei28202\certifi\cacert.pem
%TEMP%\_mei28202\include\pyconfig.h
%TEMP%\_mei28202\lib2to3\grammar.txt
%TEMP%\_mei28202\lib2to3\grammar3.7.0.final.0.pickle
%TEMP%\_mei28202\lib2to3\patterngrammar.txt
%TEMP%\_mei28202\lib2to3\patterngrammar3.7.0.final.0.pickle
%TEMP%\_mei28202\lib2to3\tests\data\readme
%TEMP%\_mei28202\libcrypto-1_1-x64.dll
%TEMP%\_mei28202\libopenblas.pyqhxlvvq7vesdpuvuadxevjobghjpay.gfortran-win_amd64.dll
%TEMP%\_mei28202\libssl-1_1-x64.dll
%TEMP%\_mei28202\mfc140u.dll
%TEMP%\_mei28202\numpy\core\_multiarray_tests.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\core\_multiarray_umath.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\fft\_pocketfft_internal.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\linalg\lapack_lite.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\linalg\_umath_linalg.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\random\mtrand.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\random\_bit_generator.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\random\_bounded_integers.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\random\_common.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\random\_generator.cp37-win_amd64.pyd
%TEMP%\_mei28202\numpy\random\_pcg64.cp37-win_amd64.pyd
%TEMP%\_mei28202\_win32sysloader.pyd