Trojan.Siggen18.52205

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'nod32kui' = '"%ProgramFiles(x86)%\Eset\nod32kui.exe" /WAITSERVICE'
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\NOD32krn] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\NOD32krn] 'ImagePath' = '"%ProgramFiles(x86)%\Eset\nod32krn.exe"'
[<HKLM>\System\CurrentControlSet\Services\AMON] 'ImagePath' = '<DRIVERS>\amon.sys'
[<HKLM>\System\CurrentControlSet\Services\AMON] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\ws2ifsl] 'Start' = '00000001'

Создает следующие сервисы

'NOD32krn' "%ProgramFiles(x86)%\Eset\nod32krn.exe"
'NOD32krn' %ProgramFiles(x86)%\Eset\nod32krn.exe
'AMON' <DRIVERS>\amon.sys
'WS2IFSL' <DRIVERS>\ws2ifsl.sys

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7zs3e37.tmp\setup.bat
%ProgramFiles(x86)%\eset\eset.chm
%ProgramFiles(x86)%\eset\setup\main.dll
%ProgramFiles(x86)%\eset\setup\setup.exe
%ProgramFiles(x86)%\eset\readme.txt
%ProgramFiles(x86)%\eset\pu_upd.chm
%ProgramFiles(x86)%\eset\ps_upd.dll
%ProgramFiles(x86)%\eset\pu_upd.dll
%ProgramFiles(x86)%\eset\nod32kui.exe
%ProgramFiles(x86)%\eset\nod32kui.chm
%ProgramFiles(x86)%\eset\nod32krn.exe
%TEMP%\nodtmpc\setupc.xml
%TEMP%\nodtmpc\pu_imon.chm
%ProgramFiles(x86)%\eset\nod32aui.dll
%ProgramFiles(x86)%\eset\nod32api.dll
%TEMP%\nodtmpc\pu_imon.dll
%TEMP%\nodtmpc\pu_emon.dll
%TEMP%\nodtmpc\ps_emon.dll
%TEMP%\nodtmpc\imon64.dll
%TEMP%\nodtmpc\imon.dll
%TEMP%\nodtmpc\emon.dll
%TEMP%\nodtmpb\setupc.xml
%TEMP%\nodtmpb\pu_dmon.chm
%TEMP%\nodtmpb\pu_amon.chm
%TEMP%\nodtmpb\nod32.chm
%TEMP%\nodtmpb\pu_nod32.dll
%TEMP%\nodtmpb\pu_dmon.dll
%TEMP%\nodtmpc\pu_emon.chm
%TEMP%\nsf5727.tmp
%ProgramFiles(x86)%\eset\nod32.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\eset\help.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\eset\read me.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\eset\uninstall.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\eset\nod32 control center.lnk
%ProgramFiles(x86)%\eset\sporder.dll
%ProgramFiles(x86)%\eset\pu_emon.chm
%ProgramFiles(x86)%\eset\ps_emon.dll
%ProgramFiles(x86)%\eset\pu_emon.dll
%ProgramFiles(x86)%\eset\emon.dll
%ProgramFiles(x86)%\eset\pu_imon.chm
%ProgramFiles(x86)%\eset\pu_imon.dll
<SYSTEM32>\imon.dll
%WINDIR%\syswow64\imon.dll
%ProgramFiles(x86)%\eset\dmon.dll
%ProgramFiles(x86)%\eset\pu_dmon.chm
%ProgramFiles(x86)%\eset\pu_dmon.dll
%ProgramFiles(x86)%\eset\ps_dmon.dll
%ProgramFiles(x86)%\eset\pu_amon.chm
%ProgramFiles(x86)%\eset\pu_amon.dll
%ProgramFiles(x86)%\eset\ps_amon64.dll
%ProgramFiles(x86)%\eset\ps_amon.dll
<DRIVERS>\amon.sys
%ProgramFiles(x86)%\eset\pu_nod32.dll
%ProgramFiles(x86)%\eset\ps_nod32.dll
%ProgramFiles(x86)%\eset\nod.ovl
%ProgramFiles(x86)%\eset\nodshex64.dll
%ProgramFiles(x86)%\eset\nodshex.dll
%TEMP%\nodtmpb\pu_amon.dll
%TEMP%\nodtmpc\sporder.dll
%TEMP%\nodtmpb\ps_nod32.dll
%TEMP%\nodtmpb\ps_dmon.dll
%TEMP%\nodtmpb\ps_amon64.dll
%TEMP%\7zs3e37.tmp\main.dll
%TEMP%\nsf56a8.tmp
%TEMP%\nsetup\advheur.nup
%TEMP%\nsetup\engine.tmp
%TEMP%\nsf55bd.tmp
%TEMP%\nsetup\engine.nup
%TEMP%\global.xml
%TEMP%\7zs3e37.tmp\setup.exe
%TEMP%\7zs3e37.tmp\rc.exe
%TEMP%\7zs3e37.tmp\nodfix.exe
%TEMP%\7zs3e37.tmp\msvcrt.dll
%TEMP%\7zs3e37.tmp\mfc42u.dll
%TEMP%\7zs3e37.tmp\mfc42.dll
%TEMP%\7zs3e37.tmp\setup.xml
%TEMP%\nsf56d8.tmp
%TEMP%\7zs3e37.tmp\kur.xml
%TEMP%\7zs3e37.tmp\readme.txt
%TEMP%\7zs3e37.tmp\nod32fix.reg
%TEMP%\7zs3e37.tmp\utilmod.nup
%TEMP%\7zs3e37.tmp\pwscan.nup
%TEMP%\7zs3e37.tmp\ntstden.nup
%TEMP%\7zs3e37.tmp\ntineten.nup
%TEMP%\7zs3e37.tmp\ntbaseen.nup
%TEMP%\7zs3e37.tmp\engine.nup
%TEMP%\7zs3e37.tmp\charon.nup
%TEMP%\7zs3e37.tmp\archs.nup
%TEMP%\7zs3e37.tmp\advheur.nup
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\eset\nod32.lnk
%ProgramFiles(x86)%\eset\nod32.chm
%TEMP%\nsetup\pwscan.nup
%TEMP%\nsf5757.tmp
%TEMP%\nsetup\archs.nup
%TEMP%\nodtmpb\ps_amon.dll
%TEMP%\nodtmpb\nodshex64.dll
%TEMP%\nodtmpb\nodshex.dll
%TEMP%\nodtmpb\nod32.exe
%TEMP%\nodtmpb\nod.ovl
%TEMP%\nodtmpb\dmon.dll
%TEMP%\nodtmpb\amon64.sys
%TEMP%\nodtmpb\amon.sys
%TEMP%\nodtmpa\setupc.xml
%TEMP%\nodtmpa\readme.txt
%TEMP%\nodtmpa\pu_upd.chm
%TEMP%\nodtmpa\nod32kui.chm
%TEMP%\nodtmpa\eset.chm
%TEMP%\nodtmpa\setup.exe
%TEMP%\nodtmpa\pu_upd.dll
%TEMP%\nodtmpa\ps_upd.dll
%TEMP%\nodtmpa\nod32kui.exe
%TEMP%\nodtmpa\nod32krn.exe
%TEMP%\nodtmpa\nod32drv.sys
%TEMP%\nodtmpa\nod32aui.dll
%TEMP%\nodtmpa\nod32api.dll
%TEMP%\nodtmpa\main.dll
%TEMP%\nodtmpa\krnvis.dll
%TEMP%\nodtmpa\krnstp.dll
%TEMP%\nsf57b5.tmp
%TEMP%\nsetup\charon.nup
%TEMP%\nsetup\utilmod.nup
%WINDIR%\temp\udd690e.tmp

Удаляет следующие файлы

%TEMP%\nsf55bd.tmp
%TEMP%\nsf56a8.tmp
%TEMP%\nsf56d8.tmp
%TEMP%\nsf5727.tmp
%TEMP%\nsf5757.tmp
%TEMP%\nsf57b5.tmp
%WINDIR%\temp\udd690e.tmp

Перемещает следующие файлы

%TEMP%\nsetup\engine.tmp в %TEMP%\nsetup\nod32.000
%TEMP%\nsetup\engine.tmp в %TEMP%\nsetup\nod32.003
%TEMP%\nsetup\engine.tmp в %TEMP%\nsetup\nod32.002
%TEMP%\nsetup\engine.tmp в %TEMP%\nsetup\nod32.004
%TEMP%\nsetup\engine.tmp в %TEMP%\nsetup\nod32.005
%TEMP%\nsetup\engine.tmp в %TEMP%\nsetup\nod32.006

Подменяет следующие файлы

%TEMP%\nsetup\engine.tmp

Другое

Создает и запускает на исполнение

'%TEMP%\7zs3e37.tmp\rc.exe' /w setup.bat
'%TEMP%\7zs3e37.tmp\setup.exe' /silentmode /cfg=kur.xml
'%WINDIR%\syswow64\cmd.exe' /c setup.bat' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c setup.bat
'<SYSTEM32>\rundll32.exe' %TEMP%\nodtmpc\imon64.dll,RegisterLsp register

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней