Trojan.Siggen19.15734

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\ad-mymacro9.xml
C:\n2\cs7_3.bmp
C:\n2\hk6_1.bmp
C:\n2\hk6_2.bmp
C:\n2\hk6_3.bmp
C:\n2\jkyz.bmp
C:\n2\cs3_1.bmp
C:\n2\cs3_2.bmp
C:\n2\cs3_3.bmp
C:\n2\cs3_4.bmp
C:\n2\cs6_4.bmp
C:\n2\cs3_5.bmp
C:\n2\pw_wkf.bmp
C:\n2\wglogin_0.bmp
C:\n2\dmreg.dll
C:\n2\zhfh.bmp
C:\n2\regdll.dll
C:\n2\dhzk.txt
C:\n2\wglogin_err2.bmp
C:\n2\wglogin_err1.bmp
C:\n2\wglogin_err3.bmp
C:\n2\cs7_1.bmp
C:\n2\cs7_2.bmp
C:\n2\cs6_5.bmp
C:\n2\cs6_3.bmp
C:\n2\bs_lts.bmp
C:\n2\cs1_3.bmp
C:\n2\cs1_4.bmp
C:\n2\cs1_5.bmp
C:\n2\cs2_1.bmp
C:\n2\cs2_2.bmp
C:\n2\cs2_3.bmp
C:\n2\cs2_4.bmp
C:\n2\cs2_5.bmp
C:\n2\bs_djs.bmp
C:\n2\cs1_1.bmp
C:\n2\pwlv5.bmp
C:\n2\cs4_1.bmp
C:\n2\cs4_5.bmp
C:\n2\cs5_1.bmp
C:\n2\cs5_2.bmp
C:\n2\cs5_3.bmp
C:\n2\cs5_4.bmp
C:\n2\cs5_5.bmp
C:\n2\cs6_1.bmp
C:\n2\cs6_2.bmp
C:\n2\cs4_2.bmp
C:\n2\cs4_3.bmp
C:\n2\cs4_4.bmp
C:\n2\ГЄГ¶В¶ВЇГ—ВўВІГЎ.bat
C:\n2\bs_ltswq.bmp
C:\n2\wglogin_3.bmp
C:\n2\dl_xz1.bmp
C:\n2\dl_xz2.bmp
C:\n2\dl_xz4.bmp
C:\n2\dl_xz3.bmp
C:\n2\dl_close_1.bmp
C:\n2\n2gold.txt
C:\n2\time_20.bmp
C:\n2\dl_yz1.bmp
C:\n2\dl_yz3.bmp
C:\n2\wglogin_2.bmp
C:\n2\login_error1.bmp
C:\n2\bs_ing1.bmp
C:\n2\hyjb.txt
C:\n2\time.bat
C:\n2\time_.bat
C:\n2\bs_ing2.bmp
C:\n2\yztp_2.bmp
C:\n2\yztp_1.bmp
C:\n2\dm_w10.dll
C:\n2\tsyz_1.bmp
%APPDATA%\mymacro\plugin\file.ini
C:\n2\dl_yz7.bmp
C:\n2\dl_yz4.bmp
C:\n2\cs1_2.bmp
C:\n2\login_errorx.bmp
C:\n2\bs_wasde_2.bmp
C:\n2\login_tgyy2.bmp
C:\n2\wglogin_err4.bmp
C:\n2\hkyz.bmp
C:\n2\card_2.bmp
C:\n2\card_3.bmp
C:\n2\card_4.bmp
C:\n2\card_5.bmp
C:\n2\card_1.bmp
C:\n2\card_7.bmp
C:\n2\bs_ing.bmp
C:\n2\login_tg.bmp
C:\n2\login_tgyy1.bmp
C:\n2\bs_wasde_3.bmp
C:\n2\bs_wasde_4.bmp
C:\n2\bs_wasde_5.bmp
C:\n2\bs_24s.bmp
C:\n2\wglogin_tg.bmp
C:\n2\ВёГјВ»В»Г—ВўВІГЎГўГ«Г«ВµГЈГ·.txt
C:\n2\ВіГ¶ВіВЎГµГіГЁГЅ.bmp
C:\n2\card_htf.bmp
C:\n2\ВЅГёВїВЁГ®Г¤ВµВµГ«ВµГЈГ·.txt
C:\n2\bs_wasde_1.bmp
C:\n2\card_6.bmp
C:\n2\cjjs6.bmp
C:\n2\cjjs5.bmp
C:\n2\cjjs4.bmp
C:\n2\bt_00.bmp
C:\n2\bt_01.bmp
C:\n2\bt_02.bmp
C:\n2\bt_03.bmp
C:\n2\bt_04.bmp
C:\n2\bt_05.bmp
C:\n2\bt_06.bmp
C:\n2\bt_07.bmp
%ALLUSERSPROFILE%\boost_interprocess_qm\nco5yc_beu2a
%TEMP%\background.bmp
%TEMP%\539c966.tmp
C:\n2\bt_08.bmp
C:\n2\cjjs.bmp
C:\n2\cjjs1.bmp
C:\n2\dl_1.bmp
C:\n2\dl_2.bmp
C:\n2\dl_3.bmp
C:\n2\dl_yzk.bmp
C:\n2\hk_cgl.bmp
C:\n2\hk_cgl1.bmp
C:\n2\bt_09.bmp
C:\n2\btn_1.bmp
C:\n2\btn_2.bmp
%APPDATA%\mymacro\ВЅГёВїВЁГЁГ®Г®Г±ГЎГ°В±Г.ini
C:\n2\hk_cgl2.bmp
%APPDATA%\mymacro\qdisp.dll
%TEMP%\maca025.tmp
%TEMP%\plugin.zip
%APPDATA%\mymacro\plugin\sys.dll
%APPDATA%\mymacro\plugin\regdll.dll
%APPDATA%\mymacro\plugin\media.dll
%APPDATA%\mymacro\plugin\msg.dll
%APPDATA%\mymacro\plugin\qsgj11c.dll
%APPDATA%\mymacro\plugin\file.dll
%APPDATA%\mymacro\plugin\yzm.dll
%ALLUSERSPROFILE%\boost_interprocess_qm\1w4oo6zl5nog
%ALLUSERSPROFILE%\boost_interprocess_qm\1w4oo6zl5no
%TEMP%\mymacro.zip
%APPDATA%\mymacro\rkey.dat
%TEMP%\runner.zip
%TEMP%\ad-mymacro9.xml.tmp
%APPDATA%\mymacro\runner.exe
%TEMP%\mt.zip
%APPDATA%\mymacro\mt.exe
%APPDATA%\mymacro\binding.exe
%TEMP%\qmlog\20221130.log
%APPDATA%\mymacro\cfgdll.dll
%TEMP%\adcon\mm\tmpad.xml
%TEMP%\rkey.zip
C:\n2\dl_yz6.bmp
C:\n2\home_1.bmp
C:\n2\jl_zs2.bmp
C:\n2\hk6_4.bmp
C:\n2\hk6_5.bmp
C:\n2\hk3_1.bmp
C:\n2\hk3_2.bmp
C:\n2\hk3_3.bmp
C:\n2\hk3_4.bmp
C:\n2\hk3_5.bmp
C:\n2\hk4_1.bmp
C:\n2\hk4_2.bmp
C:\n2\jgpx.bmp
C:\n2\cs7_5.bmp
C:\n2\cs7_4.bmp
C:\n2\hk5_1.bmp
C:\n2\hk5_2.bmp
C:\n2\hk5_3.bmp
C:\n2\hk5_4.bmp
C:\n2\hk5_5.bmp
C:\n2\card7.bmp
C:\n2\card6.bmp
C:\n2\cjjs2.bmp
C:\n2\cjjs3.bmp
C:\n2\hk4_3.bmp
C:\n2\hk4_5.bmp
C:\n2\jl_zs1.bmp
C:\n2\hk4_4.bmp
%ALLUSERSPROFILE%\boost_interprocess_qm\uve4tvfidmqy
C:\n2\jl_zs3.bmp
C:\n2\jl_zs4.bmp
C:\n2\mhy.bmp
C:\n2\pwtg.bmp
C:\n2\tppx.bmp
C:\n2\wcxsrw.bmp
C:\n2\wglogin.bmp
C:\n2\wglogin_1.bmp
C:\n2\zh.txt
C:\n2\hk2_3.bmp
C:\n2\hk2_5.bmp
C:\n2\hk2_4.bmp
C:\n2\620.wav
C:\n2\bg.bmp
C:\n2\hk1_1.bmp
C:\n2\hk1_2.bmp
C:\n2\hk1_3.bmp
C:\n2\hk1_4.bmp
C:\n2\hk1_5.bmp
C:\n2\hk2_1.bmp
C:\n2\hk2_2.bmp
C:\n2\ВЅГёВїВЁГЁГ®Г®Г±ГЎГ°В±Г.ini
C:\n2\2k2logo.bmp
C:\n2\zh\zh.txt

Удаляет следующие файлы

%TEMP%\adcon\mm\tmpad.xml
%TEMP%\plugin.zip
%TEMP%\mymacro.zip
%TEMP%\rkey.zip
%TEMP%\runner.zip
%TEMP%\mt.zip
%ALLUSERSPROFILE%\boost_interprocess_qm\uve4tvfidmqy

Перемещает следующие файлы

%TEMP%\ad-mymacro9.xml.tmp в %TEMP%\ad-mymacro9.xml
%TEMP%\background.bmp в %TEMP%\6ecbackground.bmp

Сетевая активность

Подключается к

'do##.#rbrothers.com':80
'hm.##idu.com':80
'hm.##idu.com':443
'microsoft.com':80

TCP

Запросы HTTP GET

http://so##.anjian.com/V2014V2/Config/ad-mymacro.xml
http://do##.#rbrothers.com/qmacro/up_mymacro/liveupdate8.dat
http://so##.anjian.com/Include/BuildPage/AnJianBindingInstallPC.html
http://hm.##idu.com/h.js?82##############################
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://lo#.##.baidu.com/hm.gif?cc#############################################################################################################################################
http://lo#.##.baidu.com/hm.gif?cc#########################################################################################################################################################

Запросы HTTP POST

http://so##.anjian.com/Include/BuildPage/ExitAdXJL.shtml
http://so##.anjian.com/Interface/GetIP.aspx
http://so##.anjian.com/Interface/BindingPC/BindingUpdate.aspx

Другие

'hm.##idu.com':443

UDP

DNS ASK so##.anjian.com
DNS ASK do##.#rbrothers.com
DNS ASK ba##u.com
DNS ASK hm.##idu.com
DNS ASK hi.###rothers.com
DNS ASK microsoft.com
DNS ASK lo#.##.baidu.com

Другое

Ищет следующие окна

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Создает и запускает на исполнение

'%APPDATA%\mymacro\binding.exe'
'%APPDATA%\mymacro\runner.exe' --host_id 3 --verify_key uXD9z3bCGgWs --product "<Полный путь к файлу>" --runner_md5 Rjg4N0Q0MjY2MkI0RUM3RTU3N0VBOTI0RUVDOEM3ODcA --version 2014.06.19549
'%WINDIR%\syswow64\ping.exe' www.ba##u.com -n 2' (со скрытым окном)

Запускает на исполнение