Trojan.Siggen15.19089

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%LOCALAPPDATA%\microsoft\internet explorer\domstore\w37zlxnl\www.520cxzm[1].xml
%LOCALAPPDATA%\microsoft\internet explorer\domstore\1ilya49m\my.4399[1].xml
%LOCALAPPDATA%\microsoft\internet explorer\domstore\p4p79gg0\news.4399[1].xml

Изменяет следующие файлы

Сетевая активность

Подключается к

'dh####.liuxue789.cn':80
'cn##.mmstat.com':443
'c.##zz.com':443
'hq###.cnzz.com':443
'st#####.##gitalcertvalidation.com':80
'tj.##g4399.com':443
'w.##zz.com':443
'pt####n.4399.com':443
'my####.5054399.com':443
'gp##.#399api.net':443
'fs.##g4399.com':443
'43#####t.5054399.com':443
'oc##.#igicert.cn':80
'pt####n.3304399.net':443
'oc##.#ectigo.com':80
'r3.#.lencr.org':80
'x1.#.lencr.org':80
'oc##.dcocsp.cn':80
's1.##g4399.com':443
'vi###.5054399.com':443
'cd#.###ment.4399pk.com':443
'90##52.com':443
'ne####g.5054399.com':443
'pu##.###nzhang.baidu.com':80
'hm.##idu.com':443
'ch###diary.com':80
'ne##.4399.com':443
'52##xzm.com':80
'ne##.4399.com':80
'52##yfz.com':80
'oc##.#tartssl.com':80
'oc##.thawte.com':80

TCP

Запросы HTTP GET

http://dh####.liuxue789.cn/dh.jb
http://st#####.##gitalcertvalidation.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJrF0xYA49jC3D83fgDGesaUkzIQQUf9OZ86BHDjEAVlYijrfMnt3KAYoCEAW3g1Aeia3ZB%2BUfPETlbyY%3D
http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRc9osyRBU0ybHlZFuU293oOS1mlwQUBr2mm2B5UDG%2B1akCSqDQlVOLLzQCEALTRbSmAuqHYB5ltnll2bM%3D
http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRc9osyRBU0ybHlZFuU293oOS1mlwQUBr2mm2B5UDG%2B1akCSqDQlVOLLzQCEAntsE7kLb212uBnRZAJxcA%3D
http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAL34fmCutAJr%2FR9yVdBsvY%3D
http://oc##.#ectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEEFfmo%2FgsBzBYqTEQp%2FJiA8%3D
http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgOjaJAwpZuvKiLwmWL6vgEWIg%3D%3D
http://oc##.#tartssl.com/sub/class2/code/ca/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBQSOgrhRCSnWfKxoWTjWxhk8hga9AQU0E4PQJlsuEsZbzsouODjiAc0qrcCAhAV
http://x1.#.lencr.org/
http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAtQ%2FmlMg8lc4iQVxglc%2FkA%3D
http://www.52##xzm.com/tj/pc.js
http://www.ch###diary.com/home-50961.htm
http://www.52##xzm.com/wmpy.html
http://www.52##yfz.com/1.html
http://ne##.4399.com/wmpy/
http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSbdW2YlHyqbqMQSJMoyQlqUDWjrQQU70ULeBWRpbbRc6SSb2NaWdNfPp0CEAq7zous9bKvBMdxhEqbXiw%3D
http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D