Trojan.Siggen21.50718

Техническая информация

Вредоносные функции

Запускает на исполнение

'<SYSTEM32>\taskkill.exe' /f /im FortniteClient-Win64-Shipping_EAC.exe
'<SYSTEM32>\taskkill.exe' /f /im FortniteClient-Win64-Shipping_BE.exe
'<SYSTEM32>\taskkill.exe' /f /im FortniteClient-Win64-Shipping.exe
'<SYSTEM32>\taskkill.exe' /f /im EpicGamesLauncher.exe
'<SYSTEM32>\taskkill.exe' /f /im FortniteLauncher.exe

Ищет следующие окна с целью

обнаружения утилит для анализа:

ClassName: 'OLLYDBG', WindowName: 'OllYDbg'
ClassName: '', WindowName: 'The Wireshark Network Analyzer'

Изменения в файловой системе

Создает следующие файлы

<DRIVERS>\ee.sys
nul

Удаляет следующие файлы

<DRIVERS>\ee.sys

Сетевая активность

Подключается к

'localhost':49186
'localhost':49188
'ab###panel.xyz':443
'localhost':49191
'localhost':49193

TCP

Другие

'localhost':49186
'localhost':49188
'localhost':49189
'ab###panel.xyz':443
'localhost':49191
'localhost':49193
'localhost':49194

UDP

DNS ASK ab###panel.xyz

Другое

Ищет следующие окна

ClassName: '' WindowName: 'cheatengine-x86_64-SSE4-AVX2.exe'
ClassName: '甀湪牮' WindowName: ''
ClassName: '瀀潲硥' WindowName: ''
ClassName: '燎' WindowName: ''
ClassName: '切' WindowName: ''
ClassName: '砀牰o' WindowName: ''
ClassName: 'ਊ†††††††††††††††††††††††††䌠湯敮瑣湩⹧⸮' WindowName: ''
ClassName: '縷' WindowName: ''
ClassName: '蘒' WindowName: ''
ClassName: '渀睸湤' WindowName: ''
ClassName: '懲' WindowName: ''
ClassName: '殺' WindowName: ''
ClassName: '婢' WindowName: ''
ClassName: '猪' WindowName: ''
ClassName: '變' WindowName: ''
ClassName: '' WindowName: 'OllyDbg - [CPU]'
ClassName: 'ﬀ' WindowName: ''
ClassName: 'ﬠ' WindowName: ''
ClassName: 'נּ' WindowName: ''
ClassName: '眀牥慣d' WindowName: ''
ClassName: 'ﮀ' WindowName: ''
ClassName: '礀煸' WindowName: ''
ClassName: 'ﮠ' WindowName: ''
ClassName: '﯀' WindowName: ''
ClassName: 'ࢆ㼸' WindowName: ''
ClassName: '厁㼸' WindowName: ''
ClassName: '眀煥x' WindowName: ''
ClassName: '扶煲硷x' WindowName: ''
ClassName: '汬扩' WindowName: ''
ClassName: '攀晬汩慥' WindowName: ''
ClassName: '焀敷穱d' WindowName: ''
ClassName: '' WindowName: ''
ClassName: '' WindowName: 'HTTP Debugger (32bits)'
ClassName: '' WindowName: 'MugenJinFuu-i386.exe'
ClassName: '' WindowName: 'Mugen JinFuu.exe'
ClassName: '' WindowName: 'MugenJinFuu-x86_64-SSE4-AVX2.exe'
ClassName: '' WindowName: 'MugenJinFuu-x86_64.exe'
ClassName: '' WindowName: 'Progress Telerik Fiddler Web Debugger'
ClassName: '' WindowName: 'x64dbg'
ClassName: '' WindowName: 'KsDumper'
ClassName: '' WindowName: 'dnSpy'
ClassName: '' WindowName: 'idaq64'
ClassName: '' WindowName: 'Fiddler Everywhere'
ClassName: '' WindowName: 'Wireshark'
ClassName: '' WindowName: 'Dumpcap'
ClassName: '' WindowName: 'Fiddler.WebUi'
ClassName: '' WindowName: 'HTTP Debugger'
ClassName: '睶牥慣d' WindowName: ''
ClassName: '' WindowName: 'ida64'
ClassName: '' WindowName: 'IDA v7.0.170914'
ClassName: '捳搠汥瑥⁥呅' WindowName: ''
ClassName: '喠睴' WindowName: ''
ClassName: '縨｜߾' WindowName: ''
ClassName: '' WindowName: ''
ClassName: '斀睰' WindowName: ''
ClassName: '灶潲硥' WindowName: ''
ClassName: '䅃坔剁⁅低䅖簠栠瑴獰⼺搯獩潣摲朮⽧慣睴牡e' WindowName: ''
ClassName: '짠4' WindowName: ''
ClassName: 'ﴠ' WindowName: ''
ClassName: '獹' WindowName: ''
ClassName: '湦睸湤' WindowName: ''
ClassName: '睱煥x' WindowName: ''
ClassName: '' WindowName: 'Immunity Debugger - [CPU]'

Создает и запускает на исполнение

'<SYSTEM32>\cmd.exe' /C sc create ET binPath=<DRIVERS>\ee.sys type= kernel' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /C sc start ET' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /C sc delete ET' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /C sc create ET binPath=<DRIVERS>\ee.sys type= kernel
'<SYSTEM32>\cmd.exe' /c sc stop EasyAntiCheatSys >nul 2>&1
'<SYSTEM32>\sc.exe' stop EasyAntiCheat
'<SYSTEM32>\cmd.exe' /c sc stop EasyAntiCheat >nul 2>&1
'<SYSTEM32>\sc.exe' stop BEDaisy
'<SYSTEM32>\cmd.exe' /c sc stop BEDaisy >nul 2>&1
'<SYSTEM32>\sc.exe' stop BEService
'<SYSTEM32>\cmd.exe' /c sc stop BEService >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im FortniteLauncher.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im FortniteClient-Win64-Shipping_BE.exe >nul 2>&1
'<SYSTEM32>\sc.exe' delete ET
'<SYSTEM32>\cmd.exe' /c taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /C sc delete ET
'<SYSTEM32>\sc.exe' start ET
'<SYSTEM32>\sc.exe' create ET binPath=<DRIVERS>\ee.sys type= kernel
'<SYSTEM32>\cmd.exe' /C sc start ET
'<SYSTEM32>\sc.exe' stop EasyAntiCheatSys
'<SYSTEM32>\cmd.exe' /c cls