Trojan.Siggen13.569

Техническая информация

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%LOCALAPPDATA%\google\chrome\user data\default\login data
%APPDATA%\opera software\opera stable\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\cookies

Ищет следующие окна с целью

обнаружения утилит для анализа:

ClassName: 'OLLYDBG', WindowName: ''
ClassName: 'GBDYLLO', WindowName: ''
ClassName: 'pediy06', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'RegmonClass', WindowName: ''
ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'

Изменения в файловой системе

Создает следующие файлы

%APPDATA%\zdzyzfj178bf1bf000406f1cfaf6a0841\41178bf1bf000406f1cfaf6a08zdzyzfj\emailclients\outlook\outlook.txt
%APPDATA%\zdzyzfj178bf1bf000406f1cfaf6a0841\41178bf1bf000406f1cfaf6a08zdzyzfj\infohere.html
%APPDATA%\zdzyzfj178bf1bf000406f1cfaf6a0841\41178bf1bf000406f1cfaf6a08zdzyzfj\browsers\domaindetect.txt
%APPDATA%\zdzyzfj178bf1bf000406f1cfaf6a0841\41178bf1bf000406f1cfaf6a08zdzyzfj\browsers\history\history_opera.txt
%TEMP%\ls178bf1bf000406f1cfaf6a08.tmp
%TEMP%\bd178bf1bf000406f1cfaf6a08.tmp
%TEMP%\tempdatabase2021-04-02t00_59_58.7812000-07_002020
%TEMP%\tempdatabase2021-04-02t00_59_58.6252000-07_002020
%TEMP%\tempdatabase2021-04-02t00_59_58.4380000-07_002020
%APPDATA%\zdzyzfj178bf1bf000406f1cfaf6a0841\41178bf1bf000406f1cfaf6a08zdzyzfj\browsers\cookies\cookies_mozilla.txt
%TEMP%\tempdatabase2021-04-02t00_59_58.4068000-07_002020
%APPDATA%\zdzyzfj178bf1bf000406f1cfaf6a0841\41178bf1bf000406f1cfaf6a08zdzyzfj\system_information.txt
%APPDATA%\zdzyzfj178bf1bf000406f1cfaf6a0841\41178bf1bf000406f1cfaf6a08zdzyzfj\processes.txt
%APPDATA%\zdzyzfj178bf1bf000406f1cfaf6a0841\41178bf1bf000406f1cfaf6a08zdzyzfj\programs.txt
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%APPDATA%\zdzyzfj178bf1bf000406f1cfaf6a0841\dotnetzip-bmqvzlnf.tmp
%LOCALAPPDATA%\178bf1bf000406f1cfaf6a08

Присваивает атрибут 'скрытый' для следующих файлов

%LOCALAPPDATA%\178bf1bf000406f1cfaf6a08

Удаляет следующие файлы

%TEMP%\bd178bf1bf000406f1cfaf6a08.tmp
%TEMP%\ls178bf1bf000406f1cfaf6a08.tmp
%APPDATA%\zdzyzfj178bf1bf000406f1cfaf6a0841\41178bf1bf000406f1cfaf6a08zdzyzfj\browsers\cookies\cookies_mozilla.txt
%APPDATA%\zdzyzfj178bf1bf000406f1cfaf6a0841\41178bf1bf000406f1cfaf6a08zdzyzfj\browsers\domaindetect.txt
%APPDATA%\zdzyzfj178bf1bf000406f1cfaf6a0841\41178bf1bf000406f1cfaf6a08zdzyzfj\browsers\history\history_opera.txt
%APPDATA%\zdzyzfj178bf1bf000406f1cfaf6a0841\41178bf1bf000406f1cfaf6a08zdzyzfj\emailclients\outlook\outlook.txt
%APPDATA%\zdzyzfj178bf1bf000406f1cfaf6a0841\41178bf1bf000406f1cfaf6a08zdzyzfj\infohere.html
%APPDATA%\zdzyzfj178bf1bf000406f1cfaf6a0841\41178bf1bf000406f1cfaf6a08zdzyzfj\processes.txt
%APPDATA%\zdzyzfj178bf1bf000406f1cfaf6a0841\41178bf1bf000406f1cfaf6a08zdzyzfj\programs.txt
%APPDATA%\zdzyzfj178bf1bf000406f1cfaf6a0841\41178bf1bf000406f1cfaf6a08zdzyzfj\system_information.txt
%APPDATA%\zdzyzfj178bf1bf000406f1cfaf6a0841\user_qrlavzojqs[nl].zip