Trojan.Siggen12.35046

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\G2ARemoteSupport_L45R4Bar0t] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\G2ARemoteSupport_L45R4Bar0t] 'ImagePath' = '"%ProgramFiles(x86)%\GoToAssist Remote Support Unattended\GoToAssistProcessChecker.exe" -Service -WorkFolde...

Создает следующие сервисы

'G2ARemoteSupport_L45R4Bar0t' "%ProgramFiles(x86)%\GoToAssist Remote Support Unattended\GoToAssistProcessChecker.exe" -Service -WorkFolder "%ProgramFiles(x86)%\GoToAssist Remote Support Unattended" -ApplicationType "4"

Изменения в файловой системе

Создает следующие файлы

%ProgramFiles(x86)%\gotoassist remote support unattended\appdata\unattendedupdater.log
%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistprocesschecker.exe
%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistui.exe
%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistloggerprocess.exe
%ProgramFiles(x86)%\gotoassist remote support unattended\libgotoassist.dll
%ProgramFiles(x86)%\gotoassist remote support unattended\libcrypto-1_1.dll
%ProgramFiles(x86)%\gotoassist remote support unattended\libssl-1_1.dll
<Полный путь к файлу>.cmd
nul
%ProgramFiles(x86)%\gotoassist remote support unattended\unattended.json
%ProgramFiles(x86)%\gotoassist remote support unattended\mandatory.json
%ProgramFiles(x86)%\gotoassist remote support unattended\appdata\gotoassistunattended.log
%ProgramFiles(x86)%\gotoassist remote support unattended\pc.json
%ProgramFiles(x86)%\gotoassist remote support unattended\appdata\gotoassistprocesschecker.log
%ProgramFiles(x86)%\gotoassist remote support unattended\appdata\gotoassistprocesschecker.srv.log
%ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\l45r4bar0t_processchecker
%ProgramFiles(x86)%\gotoassist remote support unattended\appdata\gotoassistunattended.srv.log
%ProgramFiles(x86)%\gotoassist remote support unattended\appdata\gotoassistloggerprocess_20210311__15_34_41_847.log
%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistcrashhandler.exe
%ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\l45r4bar0t_unattended
%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassisttools64.exe
%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistunlock64.dll
%ProgramFiles(x86)%\gotoassist remote support unattended\appdata\unattendedupdater.csv
%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistunattended.exe
%ProgramFiles(x86)%\gotoassist remote support unattended\lmifilterhook32.dll
%ProgramFiles(x86)%\gotoassist remote support unattended\lmifilterhook64.dll
%ProgramFiles(x86)%\gotoassist remote support unattended\lmiinputhook32.dll
%ProgramFiles(x86)%\gotoassist remote support unattended\lmiinputhook64.dll
%ProgramFiles(x86)%\gotoassist remote support unattended\lmiscrhook32.dll
%ProgramFiles(x86)%\gotoassist remote support unattended\lmiscrhook64.dll
%ProgramFiles(x86)%\gotoassist remote support unattended\lmisupport7x32.dll
%ProgramFiles(x86)%\gotoassist remote support unattended\lmisupport7x64.dll
%ProgramFiles(x86)%\gotoassist remote support unattended\lmisupportm32.exe
%ProgramFiles(x86)%\gotoassist remote support unattended\lmisupportm64.exe
%ProgramFiles(x86)%\gotoassist remote support unattended\mediaclientlib.dll
%ProgramFiles(x86)%\gotoassist remote support unattended\passwordprivacydll.dll
%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistunattendedui.exe
%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistunattendedremover.exe
%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistunlock32.dll
%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassisttools32.exe
<SYSTEM32>\gotoassistunlock64.dll

Удаляет следующие файлы

<Полный путь к файлу>.cmd
%ProgramFiles(x86)%\gotoassist remote support unattended\appdata\unattendedupdatercopy.csv

Перемещает следующие файлы

%ProgramFiles(x86)%\gotoassist remote support unattended\appdata\unattendedupdater.csv в %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\unattendedupdatercopy.csv

Самоудаляется.

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistunattended.exe' -regsvc
'%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistprocesschecker.exe' -regsvc -starterpid 2900 -WorkFolder "%ProgramFiles(x86)%\GoToAssist Remote Support Unattended" -ApplicationType 4
'%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistprocesschecker.exe' -Service -WorkFolder "%ProgramFiles(x86)%\GoToAssist Remote Support Unattended" -ApplicationType "4"
'%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistunattended.exe' "-RegisteredProcess" "1" "-ParentProcessId" "1280" "-WtsStartingUsername" "qzlwxyeml\user" "-ServiceName" "G2ARemoteSupport_L45R4Bar0t" "-Service"
'%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistloggerprocess.exe' -HostId 57dd23619da4ad6e7d0220327be0d25d -SessionType "" -InstallationId L45R4Bar0t -DeviceId "" -LogLevel 2
'%WINDIR%\syswow64\cmd.exe' /S /C ""<Полный путь к файлу>.cmd" "<Полный путь к файлу>""' (со скрытым окном)
'%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistunattended.exe' "-RegisteredProcess" "1" "-ParentProcessId" "1280" "-WtsStartingUsername" "qzlwxyeml\user" "-ServiceName" "G2ARemoteSupport_L45R4Bar0t" "-Service"' (со скрытым окном)

Запускает на исполнение