Trojan.Siggen22.27139

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\firefox default browser agent e0d777ad61246564

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\PHelperService] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\PHelperService] 'ImagePath' = '%ALLUSERSPROFILE%\PHelperService\PHelperService.exe'

Создает следующие сервисы

'PHelperService' %ALLUSERSPROFILE%\PHelperService\PHelperService.exe

Вредоносные функции

Внедряет код в

следующие системные процессы:

%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe

Ищет следующие окна с целью

обнаружения утилит для анализа:

ClassName: 'OLLYDBG', WindowName: ''
ClassName: 'GBDYLLO', WindowName: ''
ClassName: 'pediy06', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'RegmonClass', WindowName: ''

Изменения в файловой системе

Создает следующие файлы

%APPDATA%\uieseve
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-vu5ku.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-30rkr.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-1labm.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-49vm3.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-ej611.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-870vs.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-uc3gs.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-baikl.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-drmau.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-rhafb.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-0ve6v.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-4636b.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-f1ua9.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-hn2sh.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-tju67.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-u68jj.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-jnpjd.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-d267u.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-8t1gj.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-f02u0.tmp
%TEMP%\a976.exe
%TEMP%\a215.exe
%ALLUSERSPROFILE%\phelperservice\phelperservice.exe
%TEMP%\is-t1uf5.tmp\saxsupport\saxsupport.exe
%TEMP%\is-t1uf5.tmp\saxsupport\install\unins000.dat
%TEMP%\is-t1uf5.tmp\saxsupport\is-l496p.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-0tjvh.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\lessmsi\is-ck391.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-8o634.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-e2hat.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\plugins\internal\is-j1iqh.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\plugins\internal\is-ejvah.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-5hab5.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-vmf6u.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-048n5.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-qlskr.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-2p03n.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-o60ar.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-5d7hu.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-2c9ij.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\stuff\is-lsqsh.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\stuff\is-2o3pt.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\install\is-78ah8.tmp
%TEMP%\is-t1uf5.tmp\_isetup\_iscrypt.dll
%TEMP%\is-t1uf5.tmp\_isetup\_isdecmp.dll
%TEMP%\is-t1uf5.tmp\_isetup\_shfoldr.dll
%TEMP%\is-t1uf5.tmp\saxsupport\stuff\is-gbv9e.tmp
%TEMP%\is-t1uf5.tmp\_isetup\_setup64.tmp
%TEMP%\is-algad.tmp\259d.tmp
%TEMP%\259d.exe
%TEMP%\e4b6.exe
%TEMP%\dda3.exe
%TEMP%\d3e2.dll
%TEMP%\c4f3.exe
%APPDATA%\vauhhhr
%TEMP%\is-t1uf5.tmp\_isetup\_regdll.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-cectt.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\stuff\is-a0htq.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-fbf7f.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-uk9ov.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-mqgf8.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-c8sl3.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-bvpkj.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-cgokh.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-fb9up.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-nuo99.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-srb2q.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-4ndrv.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-9pnfi.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-3sp7j.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-cfkns.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-pavr6.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-7307m.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-qlvk8.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-otm30.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-a5j8d.tmp
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-rbbpb.tmp
%TEMP%\c0a0.tmp-shm
%TEMP%\cd90.tmp-shm

Присваивает атрибут 'скрытый' для следующих файлов

%APPDATA%\uieseve
%APPDATA%\vauhhhr

Удаляет следующие файлы

%TEMP%\is-t1uf5.tmp\saxsupport\stuff\date.txt
%TEMP%\is-t1uf5.tmp\saxsupport\stuff\tagsreplace.txt
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\tak_deco_lib.dll
%TEMP%\c0a0.tmp-shm
%TEMP%\cd90.tmp-shm

Перемещает следующие файлы

%TEMP%\is-t1uf5.tmp\saxsupport\install\is-78ah8.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\install\unins000.exe
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-hn2sh.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\rg_ebur128.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-f1ua9.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\wavpackdll.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-4636b.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\libsoxr.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-0ve6v.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\libsox-3.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-rhafb.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\uchardet.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-jnpjd.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\utils.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-drmau.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\libdtsdec.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-uc3gs.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\dsd2.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-870vs.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\libvorbis.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-ej611.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\sqlite3.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-49vm3.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\lame_enc.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-1labm.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\da.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-30rkr.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\daiso.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-vu5ku.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\dstt.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-8t1gj.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\dsd2pcmt.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-8o634.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\pcm2dsd.exe
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\lessmsi\is-ck391.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\lessmsi\lessmsi-v1.6.91.zip
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-qlskr.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\d_writer.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-048n5.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\libwebp.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-vmf6u.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\libwinpthread-1.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-5hab5.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\sd.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\plugins\internal\is-ejvah.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\plugins\internal\peak_scanner_plugin_c.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\plugins\internal\is-j1iqh.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\plugins\internal\raw_decode_plugin_c.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-e2hat.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\copying
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-f02u0.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\7z.exe
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-tju67.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\mp3gain.exe
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-2p03n.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\takdec.exe
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-u68jj.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\optimfrog.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-baikl.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\opusenc.exe
%TEMP%\is-t1uf5.tmp\saxsupport\stuff\is-2o3pt.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\stuff\date.txt
%TEMP%\is-t1uf5.tmp\saxsupport\stuff\is-lsqsh.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\stuff\tagsreplace.txt
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-cectt.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\tak_deco_lib.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-fbf7f.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\avutil-58.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-3sp7j.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\avfilter-9.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-rbbpb.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\swresample-4.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-a5j8d.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bass.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-otm30.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bass_aac.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-qlvk8.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bassalac.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-7307m.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bassape.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-pavr6.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bassdsd.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-cfkns.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\basscd.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-9pnfi.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bassflac.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-mqgf8.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bassmix.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-4ndrv.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bassopus.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-srb2q.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\basswma.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-nuo99.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\basswv.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-fb9up.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bass_fx.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-cgokh.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bassmidi.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-bvpkj.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bass_tta.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-c8sl3.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\copying.lgplv2.1
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-uk9ov.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\ff_helper.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-2c9ij.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\gain_analysis.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-5d7hu.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\libflac_dynamic.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-o60ar.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\libmp4v2.dll
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\is-d267u.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\bass_ofr.dll
%TEMP%\is-t1uf5.tmp\saxsupport\is-l496p.tmp в %TEMP%\is-t1uf5.tmp\saxsupport\saxsupport.exe

Подменяет следующие файлы

%TEMP%\is-t1uf5.tmp\saxsupport\stuff\date.txt
%TEMP%\is-t1uf5.tmp\saxsupport\stuff\tagsreplace.txt
%TEMP%\is-t1uf5.tmp\saxsupport\bin\x86\tak_deco_lib.dll

Самоудаляется.

Сетевая активность

Подключается к

'su####lituyo.org':80
'sn####ukeutit.org':80
'li#####insteniki.org':80
'li####oumumy.org':80
'st#####luyastrelia.net':80
'ft###yager.cc':80
'sl.###anfast.com':80
'mo####eyclub.org':443
'38.##.221.193':34368
'pk#.goog':80
'al###smail.com':80

TCP

Запросы HTTP GET

http://ft###yager.cc/ftp/index.php
http://sl.###anfast.com/order/tuc5.exe
http://pk#.goog/gsr1/gsr1.crt
http://al###smail.com/l1mb0/modules/legacy_l1.png
http://al###smail.com/l1mb0/modules/cleanhelper.png
http://al###smail.com/l1mb0/modules/runsysclean.png

Запросы HTTP POST

http://su####lituyo.org/
http://sn####ukeutit.org/
http://li#####insteniki.org/
http://li####oumumy.org/
http://st#####luyastrelia.net/

Другие

'mo####eyclub.org':443
'38.##.221.193':34368

UDP

DNS ASK on###ituyrs.org
DNS ASK su####lituyo.org
DNS ASK sn####ukeutit.org
DNS ASK li#####insteniki.org
DNS ASK li####oumumy.org
DNS ASK st#####luyastrelia.net
DNS ASK ft###yager.cc
DNS ASK sl.###anfast.com
DNS ASK mo####eyclub.org
DNS ASK pk#.goog
DNS ASK al###smail.com

Другое

Ищет следующие окна

ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: '18467-41' WindowName: ''
ClassName: '' WindowName: 'X339f1_SAXS12062FlashFixClass_X339f1'

Создает и запускает на исполнение

'%TEMP%\c4f3.exe'
'%TEMP%\dda3.exe'
'%TEMP%\e4b6.exe'
'%TEMP%\259d.exe'
'%TEMP%\is-algad.tmp\259d.tmp' /SL5="$10296,7675283,54272,%TEMP%\259D.exe"
'%TEMP%\is-t1uf5.tmp\saxsupport\saxsupport.exe' -i
'%TEMP%\is-t1uf5.tmp\saxsupport\saxsupport.exe' -s
'%TEMP%\a215.exe'
'%TEMP%\a976.exe'
'%APPDATA%\uieseve'
'<SYSTEM32>\cleanmgr.exe' ' (со скрытым окном)
'<SYSTEM32>\rundll32.exe' %APPDATA%\..\Local\Microsoft\WindowsApps\runsysclean.dll,Main' (со скрытым окном)
'%APPDATA%\uieseve' ' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\regsvr32.exe' /s %TEMP%\D3E2.dll
'%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe'
'%WINDIR%\syswow64\schtasks.exe' /Query
'%WINDIR%\syswow64\net.exe' helpmsg 6
'%WINDIR%\syswow64\net1.exe' helpmsg 6
'<SYSTEM32>\cleanmgr.exe'
'%WINDIR%\syswow64\explorer.exe'
'<SYSTEM32>\rundll32.exe' %APPDATA%\..\Local\Microsoft\WindowsApps\runsysclean.dll,Main
'%WINDIR%\explorer.exe'
'<SYSTEM32>\taskeng.exe' {E5DFDBC4-ED2E-448F-9B0C-00E75193AA13} S-1-5-21-3150914307-1777937420-491476919-1000:xqkvmjyvesri\user:Interactive:[1]

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней