Trojan.Siggen18.57562

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\rarsfx0\cybermania.url
%ProgramFiles%\process lasso\is-fp61t.tmp
%ProgramFiles%\process lasso\is-c7cn8.tmp
%ProgramFiles%\process lasso\is-8q416.tmp
%ProgramFiles%\process lasso\is-8pef2.tmp
%ProgramFiles%\process lasso\is-k2o1n.tmp
%ProgramFiles%\process lasso\is-s5r17.tmp
%ProgramFiles%\process lasso\is-c6h9v.tmp
%ProgramFiles%\process lasso\is-8jde2.tmp
%ProgramFiles%\process lasso\is-t31rm.tmp
%ProgramFiles%\process lasso\is-oumu6.tmp
%ProgramFiles%\process lasso\is-0ij1r.tmp
%ProgramFiles%\process lasso\is-i558e.tmp
%ProgramFiles%\process lasso\is-1a4el.tmp
%ProgramFiles%\process lasso\is-uot7u.tmp
%ProgramFiles%\process lasso\is-5ih9i.tmp
%ProgramFiles%\process lasso\is-ocm1v.tmp
%ProgramFiles%\process lasso\is-v9oda.tmp
%ProgramFiles%\process lasso\is-to0s6.tmp
%ProgramFiles%\process lasso\is-oe2lr.tmp
%ProgramFiles%\process lasso\is-4t92d.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\process lasso.lnk
%ProgramFiles%\process lasso\is-b5jbm.tmp
C:\users\public\desktop\process lasso.lnk
%ProgramFiles%\process lasso\is-04bqm.tmp
%ProgramFiles%\process lasso\is-l8chi.tmp
%TEMP%\rarsfx0\processlasso64.exe
%TEMP%\is-pc9b8.tmp\processlasso64.tmp
%TEMP%\is-3gdq8.tmp\_isetup\_setup64.tmp
%TEMP%\is-3gdq8.tmp\cybermania.dll
%TEMP%\is-3gdq8.tmp\cybermania.vsf
%ProgramFiles%\process lasso\is-fihfo.tmp
%ALLUSERSPROFILE%\cybermania\is-5r9le.tmp
%ALLUSERSPROFILE%\cybermania\is-r07l3.tmp
%ProgramFiles%\process lasso\is-u1v3l.tmp
%ProgramFiles%\process lasso\is-1g3tp.tmp
%ProgramFiles%\process lasso\is-cbhmi.tmp
%ProgramFiles%\process lasso\is-iqb1o.tmp
%ProgramFiles%\process lasso\is-rno5v.tmp
%ProgramFiles%\process lasso\is-i09o8.tmp
%ProgramFiles%\process lasso\is-irp5v.tmp
%ProgramFiles%\process lasso\is-sj45o.tmp
%ProgramFiles%\process lasso\is-lgoct.tmp
%ProgramFiles%\process lasso\is-51npu.tmp
%ProgramFiles%\process lasso\is-8o09c.tmp
%ProgramFiles%\process lasso\is-74btq.tmp
%ProgramFiles%\process lasso\is-n2k87.tmp
%ProgramFiles%\process lasso\is-canai.tmp
%ProgramFiles%\process lasso\unins000.dat

Удаляет следующие файлы

%ProgramFiles%\process lasso\bitsumms.exe
%TEMP%\is-3gdq8.tmp\cybermania.dll
%TEMP%\is-3gdq8.tmp\cybermania.vsf
%TEMP%\is-3gdq8.tmp\_isetup\_setup64.tmp
%TEMP%\is-pc9b8.tmp\processlasso64.tmp
%TEMP%\rarsfx0\cybermania.url
%TEMP%\rarsfx0\processlasso64.exe

Перемещает следующие файлы

%ProgramFiles%\process lasso\is-fihfo.tmp в %ProgramFiles%\process lasso\unins000.exe
%ProgramFiles%\process lasso\is-8q416.tmp в %ProgramFiles%\process lasso\pl_rsrc_japanese.dll
%ProgramFiles%\process lasso\is-8pef2.tmp в %ProgramFiles%\process lasso\pl_rsrc_korean.dll
%ProgramFiles%\process lasso\is-k2o1n.tmp в %ProgramFiles%\process lasso\pl_rsrc_polish.dll
%ProgramFiles%\process lasso\is-s5r17.tmp в %ProgramFiles%\process lasso\pl_rsrc_ptbr.dll
%ProgramFiles%\process lasso\is-c6h9v.tmp в %ProgramFiles%\process lasso\pl_rsrc_russian.dll
%ProgramFiles%\process lasso\is-8jde2.tmp в %ProgramFiles%\process lasso\pl_rsrc_slovenian.dll
%ProgramFiles%\process lasso\is-t31rm.tmp в %ProgramFiles%\process lasso\pl_rsrc_spanish.dll
%ProgramFiles%\process lasso\is-0ij1r.tmp в %ProgramFiles%\process lasso\processlasso.exe
%ProgramFiles%\process lasso\is-oe2lr.tmp в %ProgramFiles%\process lasso\tweakscheduler.exe
%ProgramFiles%\process lasso\is-i558e.tmp в %ProgramFiles%\process lasso\processlassolauncher.exe
%ProgramFiles%\process lasso\is-1a4el.tmp в %ProgramFiles%\process lasso\quickupgrade.exe
%ProgramFiles%\process lasso\is-uot7u.tmp в %ProgramFiles%\process lasso\srvstub.exe
%ProgramFiles%\process lasso\is-5ih9i.tmp в %ProgramFiles%\process lasso\start-governor.bat
%ProgramFiles%\process lasso\is-ocm1v.tmp в %ProgramFiles%\process lasso\stop-governor.bat
%ProgramFiles%\process lasso\is-v9oda.tmp в %ProgramFiles%\process lasso\testlasso.exe
%ProgramFiles%\process lasso\is-to0s6.tmp в %ProgramFiles%\process lasso\threadracer.exe
%ProgramFiles%\process lasso\is-c7cn8.tmp в %ProgramFiles%\process lasso\pl_rsrc_italian.dll
%ProgramFiles%\process lasso\is-oumu6.tmp в %ProgramFiles%\process lasso\processgovernor.exe
%ProgramFiles%\process lasso\is-fp61t.tmp в %ProgramFiles%\process lasso\pl_rsrc_german.dll
%ProgramFiles%\process lasso\is-irp5v.tmp в %ProgramFiles%\process lasso\licenses
%ALLUSERSPROFILE%\cybermania\is-5r9le.tmp в %ALLUSERSPROFILE%\cybermania\cybermania.dll
%ALLUSERSPROFILE%\cybermania\is-r07l3.tmp в %ALLUSERSPROFILE%\cybermania\cybermania.vsf
%ProgramFiles%\process lasso\is-u1v3l.tmp в %ProgramFiles%\process lasso\bitsumms.exe
%ProgramFiles%\process lasso\is-cbhmi.tmp в %ProgramFiles%\process lasso\bitsumsessionagent.exe
%ProgramFiles%\process lasso\is-iqb1o.tmp в %ProgramFiles%\process lasso\cpueater.exe
%ProgramFiles%\process lasso\is-rno5v.tmp в %ProgramFiles%\process lasso\insights.exe
%ProgramFiles%\process lasso\is-i09o8.tmp в %ProgramFiles%\process lasso\installhelper.exe
%ProgramFiles%\process lasso\is-sj45o.tmp в %ProgramFiles%\process lasso\logviewer.exe
%ProgramFiles%\process lasso\is-04bqm.tmp в %ProgramFiles%\process lasso\pl_rsrc_finnish.dll
%ProgramFiles%\process lasso\is-lgoct.tmp в %ProgramFiles%\process lasso\pl-update.cmd
%ProgramFiles%\process lasso\is-51npu.tmp в %ProgramFiles%\process lasso\pl.cmd
%ProgramFiles%\process lasso\is-8o09c.tmp в %ProgramFiles%\process lasso\plactivate.exe
%ProgramFiles%\process lasso\is-74btq.tmp в %ProgramFiles%\process lasso\pl_rsrc_bulgarian.dll
%ProgramFiles%\process lasso\is-n2k87.tmp в %ProgramFiles%\process lasso\pl_rsrc_chinese.dll
%ProgramFiles%\process lasso\is-l8chi.tmp в %ProgramFiles%\process lasso\pl_rsrc_chinese_traditional.dll
%ProgramFiles%\process lasso\is-canai.tmp в %ProgramFiles%\process lasso\pl_rsrc_english.dll
%ProgramFiles%\process lasso\is-b5jbm.tmp в %ProgramFiles%\process lasso\pl_rsrc_french.dll
%ProgramFiles%\process lasso\is-4t92d.tmp в %ProgramFiles%\process lasso\vistammsc.exe

Подменяет следующие файлы

%ProgramFiles%\process lasso\bitsumms.exe

Сетевая активность

Подключается к

'cy###mania.ws':80
'cy###mania.ws':443

TCP

Запросы HTTP GET

http://www.cy###mania.ws/

Другие

'cy###mania.ws':443

UDP

DNS ASK cy###mania.ws
DNS ASK microsoft.com

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''
ClassName: 'Static' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\rarsfx0\processlasso64.exe' /silent
'%TEMP%\is-pc9b8.tmp\processlasso64.tmp' /SL5="$1023E,8272690,1005568,%TEMP%\RarSFX0\ProcessLasso64.exe" /silent