Trojan.Siggen13.8352

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\firefox default browser agent 9a21433ff57dad0a

Вредоносные функции

Внедряет код в

следующие системные процессы:

%WINDIR%\syswow64\explorer.exe
%WINDIR%\explorer.exe

следующие пользовательские процессы:

iexplore.exe

Перехватывает функции

в браузерах

Процесс iexplore.exe, модуль wininet.dll
Процесс firefox.exe, модуль nss3.dll

Ищет ветки реестра, отвечающие за хранение паролей сторонними программами

[<HKCU>\Software\Martin Prikryl]
[<HKLM>\Software\Wow6432Node\Martin Prikryl]

Читает файлы, отвечающие за хранение паролей сторонними программами

%APPDATA%\mozilla\firefox\profiles.ini
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%APPDATA%\opera software\opera stable\login data
%APPDATA%\thunderbird\profiles.ini
%LOCALAPPDATA%\google\chrome\user data\default\web data
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx

Изменения в файловой системе

Создает следующие файлы

%TEMP%\ae30.tmp
%TEMP%\tmpf324.tmp
%TEMP%\tmpf323.tmp
%TEMP%\tmpf322.tmp
%TEMP%\tmpf321.tmp
%TEMP%\tmpf320.tmp
%TEMP%\tmpf310.tmp
%TEMP%\tmpf30f.tmp
%TEMP%\tmpf30d.tmp
%TEMP%\tmpf336.tmp
%TEMP%\tmpf2fc.tmp
%TEMP%\tmpf2fb.tmp
%TEMP%\tmpf2fa.tmp
%TEMP%\tmpf2f9.tmp
%TEMP%\tmpf2f8.tmp
%TEMP%\tmpf2f7.tmp
%TEMP%\tmpf30e.tmp
%TEMP%\tmpf2ac.tmp
%TEMP%\tmpf337.tmp
%TEMP%\tmpf451.tmp
%TEMP%\tmpf402.tmp
%TEMP%\tmpf3f2.tmp
%TEMP%\tmpf3f1.tmp
%TEMP%\tmpf3e0.tmp
%TEMP%\tmpf3df.tmp
%TEMP%\tmpf3de.tmp
%TEMP%\tmpf2e7.tmp
%TEMP%\tmpf335.tmp
%TEMP%\tmpf38d.tmp
%TEMP%\tmpf37c.tmp
%TEMP%\tmpf36c.tmp
%TEMP%\tmpf34c.tmp
%TEMP%\tmpf34b.tmp
%TEMP%\tmpf34a.tmp
%TEMP%\tmpf339.tmp
%TEMP%\tmpf38e.tmp
%TEMP%\tmpf338.tmp
%TEMP%\tmpf2e6.tmp
%TEMP%\tmpf2e5.tmp
%TEMP%\tmpf2d4.tmp
%TEMP%\tmpf22b.tmp
%TEMP%\tmpf251.tmp
%TEMP%\tmpf250.tmp
%TEMP%\tmpf24f.tmp
%TEMP%\tmpf23e.tmp
%TEMP%\tmpf23d.tmp
%TEMP%\tmpf23c.tmp
%TEMP%\tmpf452.tmp
%TEMP%\tmpf262.tmp
%TEMP%\tmpf0b8.tmp
%TEMP%\tmpf0a7.tmp
%TEMP%\tmpf0a6.tmp
%TEMP%\tmpf0a5.tmp
%TEMP%\tmpf095.tmp
%TEMP%\tmpf094.tmp
%TEMP%\tmpf093.tmp
%TEMP%\tmpf23b.tmp
%TEMP%\tmpf39f.tmp
%TEMP%\tmpf273.tmp
%TEMP%\tmpf286.tmp
%TEMP%\tmpf274.tmp
%TEMP%\tmpf2d3.tmp
%TEMP%\tmpf2d2.tmp
%TEMP%\tmpf2d1.tmp
%TEMP%\tmpf2c0.tmp
%TEMP%\tmpf2bf.tmp
%TEMP%\tmpf2be.tmp
%TEMP%\tmpf285.tmp
%TEMP%\tmpf2bd.tmp
%TEMP%\tmpf261.tmp
%TEMP%\tmpf2ab.tmp
%TEMP%\tmpf29a.tmp
%TEMP%\tmpf299.tmp
%TEMP%\tmpf298.tmp
%TEMP%\tmpf297.tmp
%TEMP%\tmpf287.tmp
%TEMP%\tmpf2ad.tmp
%TEMP%\tmpfb9b.tmp
%LOCALAPPDATA%low\machineinfo.txt
%TEMP%\tmpfac4.tmp
%TEMP%\tmpfc62.tmp
%TEMP%\tmpfc51.tmp
%TEMP%\tmpfc31.tmp
%TEMP%\tmpfc30.tmp
%TEMP%\tmpfc10.tmp
%TEMP%\tmpfc0f.tmp
%TEMP%\tmpfc0e.tmp
%TEMP%\tmpfbfc.tmp
%TEMP%\tmpfca2.tmp
%TEMP%\tmpfbfb.tmp
%TEMP%\tmpfbfa.tmp
%TEMP%\tmpfbea.tmp
%TEMP%\tmpfbe9.tmp
%TEMP%\tmpfbe8.tmp
%TEMP%\tmpfbd7.tmp
%TEMP%\tmpfbfd.tmp
%TEMP%\tmpfab3.tmp
%TEMP%\tmpfcb3.tmp
%LOCALAPPDATA%low\cjvlpuxoy-shm
%LOCALAPPDATA%low\cjvlpuxoy
%LOCALAPPDATA%low\8hle4qgmq-shm
%LOCALAPPDATA%low\8hle4qgmq
%LOCALAPPDATA%low\firefox_urls.txt
%LOCALAPPDATA%low\dliwg2dwi-shm
%LOCALAPPDATA%low\dliwg2dwi
%TEMP%\tmpfbd6.tmp
%TEMP%\tmpfc82.tmp
%TEMP%\tmpfd95.tmp
%TEMP%\tmpfd85.tmp
%TEMP%\tmpfd36.tmp
%TEMP%\tmpfd16.tmp
%TEMP%\tmpfd05.tmp
%TEMP%\tmpfcf4.tmp
%TEMP%\tmpfcf3.tmp
%LOCALAPPDATA%low\fraqbc8ws
%TEMP%\tmpfce3.tmp
%TEMP%\tmpfbd5.tmp
%TEMP%\tmpfbd4.tmp
%TEMP%\tmpfbc4.tmp
%TEMP%\tmpfb0b.tmp
%TEMP%\tmpfb31.tmp
%TEMP%\tmpfb30.tmp
%TEMP%\tmpfb1f.tmp
%TEMP%\tmpfb1e.tmp
%TEMP%\tmpfb1d.tmp
%TEMP%\tmpfb0d.tmp
%TEMP%\tmpfab4.tmp
%TEMP%\tmpfb42.tmp
%TEMP%\tmpfaea.tmp
%TEMP%\tmpfae9.tmp
%TEMP%\tmpfad9.tmp
%TEMP%\tmpfac8.tmp
%TEMP%\tmpfac7.tmp
%TEMP%\tmpfac6.tmp
%TEMP%\tmpfac5.tmp
%TEMP%\tmpfb0c.tmp
%TEMP%\tmpf072.tmp
%TEMP%\tmpfb43.tmp
%TEMP%\tmpfb56.tmp
%TEMP%\tmpfb44.tmp
%TEMP%\tmpfbc3.tmp
%TEMP%\tmpfbc2.tmp
%TEMP%\tmpfbc1.tmp
%TEMP%\tmpfbb0.tmp
%TEMP%\tmpfbaf.tmp
%TEMP%\tmpfbae.tmp
%TEMP%\tmpfb55.tmp
%TEMP%\tmpfbad.tmp
%TEMP%\tmpfb32.tmp
%TEMP%\tmpfb9a.tmp
%TEMP%\tmpfb99.tmp
%TEMP%\tmpfb6a.tmp
%TEMP%\tmpfb69.tmp
%TEMP%\tmpfb68.tmp
%TEMP%\tmpfb57.tmp
%TEMP%\tmpfbac.tmp
%LOCALAPPDATA%low\fraqbc8ws-shm
%TEMP%\tmpf071.tmp
%TEMP%\tmpf00a.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\libegl.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\lgpllibs.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ldif60.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ldap60.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ia2marshal.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\freebl3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\breakpadinjector.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\accessiblehandler.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mapiproxy_inuse.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\vcruntime140.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ucrtbase.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\softokn3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\qipcap.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\prldap60.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nssdbm3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\accessiblemarshal.dll
%TEMP%\bc99.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozglue.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-util-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-sysinfo-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-synch-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-string-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-rtlsupport-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ws7zn1lk8tw5ce9s.zip
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mapiproxy.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processthreads-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processenvironment-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-namedpipe-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nssckbi.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nss3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\msvcp140.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozmapi32_inuse.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozmapi32.dll
%LOCALAPPDATA%low\bbsqwy6yhk
%LOCALAPPDATA%low\gxix4a2dre
%LOCALAPPDATA%low\exuieaoeii
%TEMP%\9df8.exe
%TEMP%\b165.tmp
%TEMP%\b135.tmp-shm
%TEMP%\b135.tmp
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\b7dc.tmp
%TEMP%\9937.exe
%TEMP%\55df.exe
%TEMP%\4876.exe
%TEMP%\3469.exe
%TEMP%\318b.exe
%APPDATA%\jrcbedd
%APPDATA%\raeassc
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\b83b.tmp
%TEMP%\ba41.tmp
%TEMP%\b84c.tmp
%LOCALAPPDATA%low\3solbph71y
%LOCALAPPDATA%low\x3cf3ednhm
%LOCALAPPDATA%low\rqf69azbla
%LOCALAPPDATA%low\rywtiizs2t
%LOCALAPPDATA%low\1xvpfvjcrg
%LOCALAPPDATA%low\fraqbc8wsa
%TEMP%\b965.tmp
%LOCALAPPDATA%low\sqlite3.dll
%TEMP%\b7cc.tmp
%TEMP%\bc3a.tmp
%TEMP%\bc29.tmp
%TEMP%\bc19.tmp
%TEMP%\bc18.tmp
%TEMP%\bbc9.tmp
%TEMP%\bbb8.tmp
%TEMP%\bc99.tmp-shm
%TEMP%\tmpeee8.tmp
%TEMP%\tmpf050.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\tmpefbe.tmp
%TEMP%\tmpefbd.tmp
%TEMP%\tmpefbc.tmp
%TEMP%\tmpefac.tmp
%TEMP%\tmpefab.tmp
%TEMP%\tmpefaa.tmp
%TEMP%\tmpef99.tmp
%TEMP%\tmpef97.tmp
%TEMP%\tmpefc0.tmp
%TEMP%\tmpef87.tmp
%TEMP%\tmpef86.tmp
%TEMP%\tmpef75.tmp
%TEMP%\tmpef74.tmp
%TEMP%\tmpef73.tmp
%TEMP%\tmpef62.tmp
%TEMP%\tmpef98.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\tmpefc1.tmp
%TEMP%\tmpf030.tmp
%TEMP%\tmpf02f.tmp
%TEMP%\tmpf01e.tmp
%TEMP%\tmpf01d.tmp
%TEMP%\tmpf01c.tmp
%TEMP%\tmpf01b.tmp
%TEMP%\tmpf00b.tmp
%TEMP%\tmpef61.tmp
%TEMP%\tmpefbf.tmp
%TEMP%\tmpeff8.tmp
%TEMP%\tmpeff7.tmp
%TEMP%\tmpeff6.tmp
%TEMP%\tmpeff5.tmp
%TEMP%\tmpefe5.tmp
%TEMP%\tmpefe4.tmp
%TEMP%\tmpefe3.tmp
%TEMP%\tmpf009.tmp
%TEMP%\tmpefe2.tmp
%TEMP%\tmpef51.tmp
%TEMP%\tmpef50.tmp
%TEMP%\tmpef30.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-heap-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-handle-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-libraryloader-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-process-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-private-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\tmpf051.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\tmpeca0.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\tmpef2f.tmp
%TEMP%\tmpef2e.tmp
%TEMP%\tmpef1d.tmp
%TEMP%\tmpef1c.tmp
%TEMP%\tmpef1b.tmp
%TEMP%\tmpef0a.tmp
%TEMP%\tmpec80.tmp
%TEMP%\tmpef09.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\tmpecf4.tmp
%TEMP%\tmpecf3.tmp
%TEMP%\tmpece2.tmp
%TEMP%\tmpecd2.tmp
%TEMP%\tmpeca2.tmp
%TEMP%\tmpeca1.tmp
%TEMP%\tmpeee9.tmp
%LOCALAPPDATA%low\cqwyow6p67x.zip

Присваивает атрибут 'скрытый' для следующих файлов

%APPDATA%\raeassc
%APPDATA%\jrcbedd

Удаляет следующие файлы

%TEMP%\b135.tmp-shm
%TEMP%\tmpfbd4.tmp
%TEMP%\tmpfbd5.tmp
%TEMP%\tmpfbc3.tmp
%TEMP%\tmpfbc4.tmp
%TEMP%\tmpfbc1.tmp
%TEMP%\tmpfbc2.tmp
%TEMP%\tmpfbd6.tmp
%TEMP%\tmpfbd7.tmp
%TEMP%\tmpfbad.tmp
%TEMP%\tmpfbae.tmp
%TEMP%\tmpfb9b.tmp
%TEMP%\tmpfbac.tmp
%TEMP%\tmpfb99.tmp
%TEMP%\tmpfb9a.tmp
%TEMP%\tmpfbaf.tmp
%TEMP%\tmpfb57.tmp
%TEMP%\tmpfbe9.tmp
%TEMP%\tmpfcb3.tmp
%TEMP%\tmpfc82.tmp
%TEMP%\tmpfca2.tmp
%TEMP%\tmpfc51.tmp
%TEMP%\tmpfc62.tmp
%TEMP%\tmpfc30.tmp
%TEMP%\tmpfc31.tmp
%TEMP%\tmpfc0f.tmp
%TEMP%\tmpfc10.tmp
%TEMP%\tmpfbfd.tmp
%TEMP%\tmpfc0e.tmp
%TEMP%\tmpfbfb.tmp
%TEMP%\tmpfbfc.tmp
%TEMP%\tmpfbea.tmp
%TEMP%\tmpfbfa.tmp
%TEMP%\tmpfb69.tmp
%TEMP%\tmpfbb0.tmp
%TEMP%\tmpfb6a.tmp
%TEMP%\tmpfb68.tmp
%TEMP%\tmpfcf3.tmp
%TEMP%\tmpfce3.tmp
%TEMP%\tmpfac5.tmp
%TEMP%\tmpfac4.tmp
%TEMP%\tmpfab4.tmp
%TEMP%\tmpfab3.tmp
%TEMP%\tmpf452.tmp
%TEMP%\tmpf451.tmp
%TEMP%\tmpf402.tmp
%TEMP%\tmpf3f2.tmp
%TEMP%\tmpf3f1.tmp
%TEMP%\tmpf3e0.tmp
%TEMP%\tmpf3df.tmp
%TEMP%\tmpf3de.tmp
%TEMP%\tmpf39f.tmp
%TEMP%\tmpf38d.tmp
%TEMP%\tmpfac6.tmp
%TEMP%\tmpfbe8.tmp
%TEMP%\tmpfac8.tmp
%TEMP%\tmpfad9.tmp
%TEMP%\tmpfaea.tmp
%TEMP%\tmpfb56.tmp
%TEMP%\tmpfb43.tmp
%TEMP%\tmpfb44.tmp
%TEMP%\tmpfb32.tmp
%TEMP%\tmpfb42.tmp
%TEMP%\tmpfb30.tmp
%TEMP%\tmpfb31.tmp
%TEMP%\tmpfb1e.tmp
%TEMP%\tmpfb1f.tmp
%TEMP%\tmpfb0d.tmp
%TEMP%\tmpfb1d.tmp
%TEMP%\tmpfb0b.tmp
%TEMP%\tmpfb0c.tmp
%TEMP%\tmpfae9.tmp
%TEMP%\tmpfb55.tmp
%TEMP%\tmpf22b.tmp
%TEMP%\tmpfcf4.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\breakpadinjector.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-process-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-private-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-filesystem-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-convert-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\freebl3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\tmpf38e.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-util-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ucrtbase.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\softokn3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\qipcap.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\prldap60.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nssdbm3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nssckbi.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nss3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\msvcp140.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozmapi32_inuse.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozmapi32.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozglue.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mapiproxy_inuse.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mapiproxy.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\libegl.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\lgpllibs.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ldap60.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ia2marshal.dll
%TEMP%\tmpfac7.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-sysinfo-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%low\machineinfo.txt
%LOCALAPPDATA%low\firefox_urls.txt
%LOCALAPPDATA%low\cjvlpuxoy
%LOCALAPPDATA%low\cjvlpuxoy-shm
%LOCALAPPDATA%low\8hle4qgmq
%LOCALAPPDATA%low\8hle4qgmq-shm
%LOCALAPPDATA%low\dliwg2dwi
%LOCALAPPDATA%low\dliwg2dwi-shm
%LOCALAPPDATA%low\fraqbc8ws
%LOCALAPPDATA%low\fraqbc8ws-shm
%TEMP%\tmpfd95.tmp
%TEMP%\tmpfd85.tmp
%TEMP%\tmpfd36.tmp
%TEMP%\tmpfd16.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\accessiblehandler.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\tmpfd05.tmp
%LOCALAPPDATA%low\cqwyow6p67x.zip
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-synch-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-string-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-rtlsupport-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-profile-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processthreads-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processenvironment-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-namedpipe-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-memory-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-localization-l1-2-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-libraryloader-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-interlocked-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-heap-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-handle-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\accessiblemarshal.dll
%TEMP%\tmpf36c.tmp
%TEMP%\tmpf37c.tmp
%TEMP%\tmpf34b.tmp
%TEMP%\tmpef09.tmp
%TEMP%\tmpef75.tmp
%TEMP%\tmpef86.tmp
%TEMP%\tmpef73.tmp
%TEMP%\tmpef74.tmp
%TEMP%\tmpef61.tmp
%TEMP%\tmpef62.tmp
%TEMP%\tmpef50.tmp
%TEMP%\tmpef51.tmp
%TEMP%\tmpef2f.tmp
%TEMP%\tmpef30.tmp
%TEMP%\tmpef1d.tmp
%TEMP%\tmpef2e.tmp
%TEMP%\tmpef1b.tmp
%TEMP%\tmpef1c.tmp
%LOCALAPPDATA%low\1xvpfvjcrg
%TEMP%\tmpef87.tmp
%TEMP%\tmpef99.tmp
%TEMP%\tmpef98.tmp
%TEMP%\tmpefab.tmp
%TEMP%\tmpeff7.tmp
%TEMP%\tmpefe5.tmp
%TEMP%\tmpeff5.tmp
%TEMP%\tmpefe3.tmp
%TEMP%\tmpefe4.tmp
%TEMP%\tmpefc1.tmp
%TEMP%\tmpefe2.tmp
%TEMP%\tmpefbf.tmp
%TEMP%\tmpefc0.tmp
%TEMP%\tmpefbd.tmp
%TEMP%\tmpefbe.tmp
%TEMP%\tmpefac.tmp
%TEMP%\tmpefbc.tmp
%TEMP%\tmpefaa.tmp
%TEMP%\tmpeff6.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\vcruntime140.dll
%TEMP%\tmpf009.tmp
%TEMP%\tmpeee9.tmp
%TEMP%\ba41.tmp
%TEMP%\bc3a.tmp
%TEMP%\bc29.tmp
%TEMP%\bc19.tmp
%TEMP%\bc18.tmp
%TEMP%\bbc9.tmp
%TEMP%\bbb8.tmp
%TEMP%\b965.tmp
%TEMP%\bc99.tmp
%TEMP%\b84c.tmp
%TEMP%\b83b.tmp
%TEMP%\b7dc.tmp
%TEMP%\b7cc.tmp
%TEMP%\b165.tmp
%TEMP%\b135.tmp
%TEMP%\tmpeee8.tmp
%TEMP%\tmpef0a.tmp
%LOCALAPPDATA%low\fraqbc8wsa
%LOCALAPPDATA%low\rqf69azbla
%TEMP%\bc99.tmp-shm
%TEMP%\tmpecf4.tmp
%TEMP%\tmpecf3.tmp
%TEMP%\tmpece2.tmp
%TEMP%\tmpecd2.tmp
%TEMP%\tmpeca2.tmp
%TEMP%\tmpeca1.tmp
%TEMP%\tmpeca0.tmp
%TEMP%\tmpec80.tmp
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ws7zn1lk8tw5ce9s.zip
%LOCALAPPDATA%low\bbsqwy6yhk
%LOCALAPPDATA%low\gxix4a2dre
%LOCALAPPDATA%low\exuieaoeii
%LOCALAPPDATA%low\3solbph71y
%LOCALAPPDATA%low\x3cf3ednhm
%LOCALAPPDATA%low\rywtiizs2t
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ldif60.dll
%TEMP%\tmpeff8.tmp
%TEMP%\tmpf01c.tmp
%TEMP%\tmpf2fb.tmp
%TEMP%\tmpf2f8.tmp
%TEMP%\tmpf2f9.tmp
%TEMP%\tmpf2e7.tmp
%TEMP%\tmpf2f7.tmp
%TEMP%\tmpf2e5.tmp
%TEMP%\tmpf2e6.tmp
%TEMP%\tmpf2d3.tmp
%TEMP%\tmpf2d4.tmp
%TEMP%\tmpf2d1.tmp
%TEMP%\tmpf2d2.tmp
%TEMP%\tmpf2bf.tmp
%TEMP%\tmpf2c0.tmp
%TEMP%\tmpf2bd.tmp
%TEMP%\tmpf2be.tmp
%TEMP%\tmpf00b.tmp
%TEMP%\tmpf2ac.tmp
%TEMP%\tmpf2ad.tmp
%TEMP%\tmpf30f.tmp
%TEMP%\tmpf2fa.tmp
%TEMP%\tmpf34c.tmp
%TEMP%\tmpf339.tmp
%TEMP%\tmpf34a.tmp
%TEMP%\tmpf337.tmp
%TEMP%\tmpf338.tmp
%TEMP%\tmpf335.tmp
%TEMP%\tmpf336.tmp
%TEMP%\tmpf323.tmp
%TEMP%\tmpf324.tmp
%TEMP%\tmpf321.tmp
%TEMP%\tmpf322.tmp
%TEMP%\tmpf310.tmp
%TEMP%\tmpf320.tmp
%TEMP%\tmpf30e.tmp
%TEMP%\tmpf2fc.tmp
%TEMP%\tmpf00a.tmp
%TEMP%\tmpf30d.tmp
%TEMP%\tmpef97.tmp
%TEMP%\tmpf0a7.tmp
%TEMP%\tmpf0a6.tmp
%TEMP%\tmpf0a5.tmp
%TEMP%\tmpf095.tmp
%TEMP%\tmpf094.tmp
%TEMP%\tmpf093.tmp
%TEMP%\tmpf071.tmp
%TEMP%\tmpf072.tmp
%TEMP%\tmpf050.tmp
%TEMP%\tmpf051.tmp
%TEMP%\tmpf02f.tmp
%TEMP%\tmpf030.tmp
%TEMP%\tmpf01d.tmp
%TEMP%\tmpf01e.tmp
%TEMP%\tmpf01b.tmp
%TEMP%\tmpf298.tmp
%TEMP%\tmpf29a.tmp
%TEMP%\tmpf2ab.tmp
%TEMP%\tmpf23c.tmp
%TEMP%\tmpf0b8.tmp
%TEMP%\tmpf299.tmp
%TEMP%\tmpf287.tmp
%TEMP%\tmpf297.tmp
%TEMP%\tmpf285.tmp
%TEMP%\tmpf286.tmp
%TEMP%\tmpf273.tmp
%TEMP%\tmpf274.tmp
%TEMP%\tmpf261.tmp
%TEMP%\tmpf262.tmp
%TEMP%\tmpf251.tmp
%TEMP%\tmpf250.tmp
%TEMP%\tmpf24f.tmp
%TEMP%\tmpf23e.tmp
%TEMP%\tmpf23d.tmp
%TEMP%\tmpf23b.tmp
%LOCALAPPDATA%low\sqlite3.dll

Самоудаляется.

Сетевая активность

Подключается к

'17#.#0.40.83':7710
'10#.#34.38.124':35200
'10#.#34.35.14':27615
'my#####sjamesbrown.top':443
'99###########51-service10020125999080321.xyz':80
'ap#.ip.sb':443

TCP

Запросы HTTP GET

http://99###########51-service10020125999080321.xyz/raccon.exe
http://99###########51-service10020125999080321.xyz/reestr.exe

Запросы HTTP POST

http://99###########51-service10020125999080321.xyz/
http://10#.###.38.124:35200// via 10#.#34.38.124
http://10#.##4.35.14:27615// via 10#.#34.35.14
http://17#.##.40.83:7710// via 17#.#0.40.83

'te##te.in':443

'my#####sjamesbrown.top':443

'ap#.ip.sb':443

UDP

DNS ASK 99###########older1002002131-service1002.space
DNS ASK te##te.in
DNS ASK 99###########51-service10020125999080321.xyz
DNS ASK 99############1-service10020125999080321.website
DNS ASK 99###########71-service100201dom25999080321.ru
DNS ASK 99###########t1341-service10020125999080321.ru
DNS ASK 99############2671-service10020125999080321.online
DNS ASK 99############5671-service10020125999080321.tech
DNS ASK 99###########13461-service10020125999080321.net
DNS ASK 99############4781-service10020125999080321.info
DNS ASK 99###########13561-service10020125999080321.su
DNS ASK my#####sjamesbrown.top
DNS ASK 99###########t3481-service10020125999080321.ru
DNS ASK 99############34831-service10020125999080321.space
DNS ASK 99############46831-service10020125999080321.space
DNS ASK 99############47831-service10020125999080321.space
DNS ASK 99############36831-service10020125999080321.space
DNS ASK 99############25831-service10020125999080321.space
DNS ASK 99###########older33417-012425999080321.space
DNS ASK 99###########older1002002531-service1002.space
DNS ASK 99###########older1002002431-service1002.space
DNS ASK 99##########folder3100231-service1002.space
DNS ASK 99###########older1002002231-service1002.space
DNS ASK 99############3531-service1002012425999080321.ru
DNS ASK ap#.ip.sb

Другое

Создает и запускает на исполнение

'%TEMP%\318b.exe'
'%TEMP%\3469.exe'
'%TEMP%\4876.exe'
'%TEMP%\55df.exe'
'%TEMP%\9937.exe'
'%TEMP%\9df8.exe'

Запускает на исполнение

'%WINDIR%\syswow64\explorer.exe'
'%WINDIR%\explorer.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней