Trojan.Siggen21.12999

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\Software\Classes\BurnAwareOpen\shell\open\command] '' = '"%ProgramFiles(x86)%\BurnAware Premium\burnaware.exe"'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7zipsfx.000\burnaware_premium.exe
%ProgramFiles(x86)%\burnaware premium\is-da49h.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\burnaware premium\burnaware premium.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\burnaware premium\help.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\burnaware premium\burnaware home on the web.url
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\burnaware premium\uninstall burnaware home.lnk
C:\users\public\desktop\burnaware premium.lnk
%ProgramFiles(x86)%\burnaware premium\unins000.dat
%TEMP%\etilqs_p0r19dhouvakhmy
%ProgramFiles(x86)%\burnaware premium\is-u17ln.tmp
%ProgramFiles(x86)%\burnaware premium\is-sjnvv.tmp
%TEMP%\etilqs_ul6uq4rghjbsem5
%TEMP%\etilqs_2mktldsvzcmrdo0
%TEMP%\etilqs_6sw2hljpqatqzez
%TEMP%\etilqs_jowkcys5nd5fyjj
%TEMP%\etilqs_p6btscsfsuwgt66
%TEMP%\etilqs_qbqpu6ysedadvnl
%TEMP%\etilqs_igbyu8s4z0sgtob
%TEMP%\etilqs_6aqi8rnojsiiqne
%TEMP%\etilqs_p9etohgkvwtbba5
%TEMP%\etilqs_xkjtisysbocntc3
%TEMP%\etilqs_efpk4555quej4w4
%ProgramFiles(x86)%\burnaware premium\is-k57n3.tmp
%ProgramFiles(x86)%\burnaware premium\is-eoh11.tmp
%ProgramFiles(x86)%\burnaware premium\is-53fa2.tmp
%TEMP%\is-nuj17.tmp\_isetup\_setup64.tmp
%TEMP%\is-nuj17.tmp\_isetup\_shfoldr.dll
%ProgramFiles(x86)%\burnaware premium\is-rgl53.tmp
%ProgramFiles(x86)%\burnaware premium\is-28rsn.tmp
%ProgramFiles(x86)%\burnaware premium\is-h3i80.tmp
%ProgramFiles(x86)%\burnaware premium\is-qehal.tmp
%ProgramFiles(x86)%\burnaware premium\is-2j1b8.tmp
%ProgramFiles(x86)%\burnaware premium\is-690ee.tmp
%ProgramFiles(x86)%\burnaware premium\is-isevj.tmp
%TEMP%\is-cjogn.tmp\burnaware_premium.tmp
%ProgramFiles(x86)%\burnaware premium\is-t2urj.tmp
%ProgramFiles(x86)%\burnaware premium\is-k96s1.tmp
%ProgramFiles(x86)%\burnaware premium\is-2m1ik.tmp
%ProgramFiles(x86)%\burnaware premium\is-eco5q.tmp
%ProgramFiles(x86)%\burnaware premium\is-ip6h1.tmp
%ProgramFiles(x86)%\burnaware premium\is-mh919.tmp
%ProgramFiles(x86)%\burnaware premium\is-5b3bs.tmp
%ProgramFiles(x86)%\burnaware premium\is-mkjv1.tmp
%ProgramFiles(x86)%\burnaware premium\is-0kfm5.tmp
%ProgramFiles(x86)%\burnaware premium\is-84dtu.tmp
%ProgramFiles(x86)%\burnaware premium\is-pbq6v.tmp
%TEMP%\6b72.tmp
%TEMP%\6b73.tmp

Удаляет следующие файлы

%TEMP%\is-nuj17.tmp\_isetup\_setup64.tmp
%TEMP%\is-nuj17.tmp\_isetup\_shfoldr.dll
%TEMP%\is-cjogn.tmp\burnaware_premium.tmp
%TEMP%\7zipsfx.000\burnaware_premium.exe
%TEMP%\6b72.tmp
%TEMP%\6b73.tmp

Перемещает следующие файлы

%ProgramFiles(x86)%\burnaware premium\is-rgl53.tmp в %ProgramFiles(x86)%\burnaware premium\unins000.exe
%ProgramFiles(x86)%\burnaware premium\is-u17ln.tmp в %ProgramFiles(x86)%\burnaware premium\tags.dll
%ProgramFiles(x86)%\burnaware premium\is-k57n3.tmp в %ProgramFiles(x86)%\burnaware premium\basswma.dll
%ProgramFiles(x86)%\burnaware premium\is-eoh11.tmp в %ProgramFiles(x86)%\burnaware premium\bassflac.dll
%ProgramFiles(x86)%\burnaware premium\is-53fa2.tmp в %ProgramFiles(x86)%\burnaware premium\bass.dll
%ProgramFiles(x86)%\burnaware premium\is-84dtu.tmp в %ProgramFiles(x86)%\burnaware premium\tvqdec.dll
%ProgramFiles(x86)%\burnaware premium\is-0kfm5.tmp в %ProgramFiles(x86)%\burnaware premium\foxwmapluginu32.dll
%ProgramFiles(x86)%\burnaware premium\is-mkjv1.tmp в %ProgramFiles(x86)%\burnaware premium\foxplayeru32.dll
%ProgramFiles(x86)%\burnaware premium\is-5b3bs.tmp в %ProgramFiles(x86)%\burnaware premium\burnaware.chm
%ProgramFiles(x86)%\burnaware premium\is-mh919.tmp в %ProgramFiles(x86)%\burnaware premium\burnaware.exe
%ProgramFiles(x86)%\burnaware premium\is-ip6h1.tmp в %ProgramFiles(x86)%\burnaware premium\verifydisc.exe
%ProgramFiles(x86)%\burnaware premium\is-eco5q.tmp в %ProgramFiles(x86)%\burnaware premium\datarecovery.exe
%ProgramFiles(x86)%\burnaware premium\is-2m1ik.tmp в %ProgramFiles(x86)%\burnaware premium\copydisc.exe
%ProgramFiles(x86)%\burnaware premium\is-k96s1.tmp в %ProgramFiles(x86)%\burnaware premium\makeiso.exe
%ProgramFiles(x86)%\burnaware premium\is-pbq6v.tmp в %ProgramFiles(x86)%\burnaware premium\copyimage.exe
%ProgramFiles(x86)%\burnaware premium\is-t2urj.tmp в %ProgramFiles(x86)%\burnaware premium\erasedisc.exe
%ProgramFiles(x86)%\burnaware premium\is-isevj.tmp в %ProgramFiles(x86)%\burnaware premium\mp3disc.exe
%ProgramFiles(x86)%\burnaware premium\is-690ee.tmp в %ProgramFiles(x86)%\burnaware premium\discinfo.exe
%ProgramFiles(x86)%\burnaware premium\is-2j1b8.tmp в %ProgramFiles(x86)%\burnaware premium\datadisc.exe
%ProgramFiles(x86)%\burnaware premium\is-qehal.tmp в %ProgramFiles(x86)%\burnaware premium\dvdvideo.exe
%ProgramFiles(x86)%\burnaware premium\is-h3i80.tmp в %ProgramFiles(x86)%\burnaware premium\burnimage.exe
%ProgramFiles(x86)%\burnaware premium\is-28rsn.tmp в %ProgramFiles(x86)%\burnaware premium\audiocd.exe
%ProgramFiles(x86)%\burnaware premium\is-sjnvv.tmp в %ProgramFiles(x86)%\burnaware premium\foxsdku32w.dll
%ProgramFiles(x86)%\burnaware premium\is-da49h.tmp в %ProgramFiles(x86)%\burnaware premium\ba6premium.dll

Сетевая активность

Подключается к

'au######te.geo.opera.com':80
'do#####d3.operacdn.com':443
'pa#####.#oogleadservices.com':443
'go######s.g.doubleclick.net':443
'microsoft.com':80
's.##mg.com':443
'pk#.goog':80
'bo##ing.com':443
'bo##ing.com':80
'tw##ter.com':80
'pa#####.#ooglesyndication.com':443
'ro###.ebay.com':443
'ro###.ebay.com':80
'sd#####es.operacdn.com':443
'ze#####.ocsp.sectigo.com':80
'fa###ook.com':80
'bu###ware.com':443
'bu###ware.com':80
're###.opera.com':80
'si#####ck2.opera.com':80
'en.###ipedia.org':443
'en.###ipedia.org':80
'se####.yahoo.com':443
'am##on.com':443
'du###uckgo.com':443
'bing.com':80
'am##on.com':80
'se####.yahoo.com':80
'google.com':80
'au######te.geo.opera.com':443
'tp#.####lesyndication.com':443
'google.com':443

TCP

Запросы HTTP GET

http://au######te.geo.opera.com/geolocation/
http://oc##.#ectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEQCp70IN7BShQ0I%2Ftsk0M5XU
http://pk#.goog/gsr1/gsr1.crt
http://www.bo##ing.com/index.html?ai##########################################################################################
http://www.ya##o.com/?il#####
http://www.tw##ter.com/?pa################
http://ro###.ebay.com/rover/1/711-53200-19255-0/1?ic###########################################################################################################################
http://re###.opera.com/speeddials/partner/wikipedia_org_us
http://re###.opera.com/speeddials/partner/youtube
http://re###.opera.com/speeddials/partner/product
http://re###.opera.com/speeddials/partner/booking_com_us
http://re###.opera.com/speeddials/partner/twitter_us
http://re###.opera.com/speeddials/partner/yahoo
http://re###.opera.com/speeddials/partner/ebay_us
http://re###.opera.com/speeddials/partner/amazon_us
http://ze#####.ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQzH%2F4%2F%2FQuEFihPlI1WwH4Dktj2TQQUD2vmS845R672fpAeefAwkZLIX6MCEF8gOffwyY0o7L5KkKQfDjs%3D
http://re###.opera.com/favicon.ico
http://www.fa###ook.com/campaign/landing.php?ca#########################
http://re###.opera.com/speeddials/partner/facebook
http://www.bu###ware.com/after-install/
http://re###.opera.com/www.opera.com/firstrun/
http://si#####ck2.opera.com/?ho###################################################
http://si#####ck2.opera.com/?ho#####################################################
http://en.###ipedia.org/favicon.ico
http://www.bing.com/s/a/bing_p.ico
http://www.am##on.com/favicon.ico
http://se####.yahoo.com/favicon.ico
http://www.google.com/favicon.ico
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://www.op##a.com/follow?ut###############################################################################################

Другие

'au######te.geo.opera.com':443
'do#####d3.operacdn.com':443
'pa#####.#oogleadservices.com':443
'go######s.g.doubleclick.net':443
'op##a.com':443
'pa###.ebay.com':443
's.##mg.com':443
'eb##.com':443
'bo##ing.com':443
'ya##o.com':443
'pa#####.#ooglesyndication.com':443
'ro###.ebay.com':443
'sd#####es.operacdn.com':443
'bu###ware.com':443
'en.###ipedia.org':443
'se####.yahoo.com':443
'am##on.com':443
'du###uckgo.com':443
'tp#.####lesyndication.com':443
'google.com':443

UDP

DNS ASK google.com
DNS ASK pa#####.#oogleadservices.com
DNS ASK go######s.g.doubleclick.net
DNS ASK op##a.com
DNS ASK microsoft.com
DNS ASK pa###.ebay.com
DNS ASK s.##mg.com
DNS ASK eb##.com
DNS ASK oc##.#ectigo.com
DNS ASK pk#.goog
DNS ASK bo##ing.com
DNS ASK tw##ter.com
DNS ASK ya##o.com
DNS ASK pa#####.#ooglesyndication.com
DNS ASK ro###.ebay.com
DNS ASK sd#####es.operacdn.com
DNS ASK ze#####.ocsp.sectigo.com
DNS ASK fa###ook.com
DNS ASK bu###ware.com
DNS ASK re###.opera.com
DNS ASK si#####ck2.opera.com
DNS ASK en.###ipedia.org
DNS ASK bi##.#ikimedia.org
DNS ASK bing.com
DNS ASK am##on.com
DNS ASK du###uckgo.com
DNS ASK se####.yahoo.com
DNS ASK au######te.geo.opera.com
DNS ASK do#####d3.operacdn.com
DNS ASK tp#.####lesyndication.com

Другое

Ищет следующие окна

ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'

Создает и запускает на исполнение

'%TEMP%\7zipsfx.000\burnaware_premium.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-cjogn.tmp\burnaware_premium.tmp' /SL5="$110254,12661068,187904,%TEMP%\7ZipSfx.000\burnaware_premium.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Запускает на исполнение

'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "http://www.burnaware.com/after-install/"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1480.19.928187684\2003682821" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1480.18.976454238\887315463" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1480.15.895008362\1506923667" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1480.14.589897811\851138446" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1480.13.689487369\1978309596" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1480.12.1363020234\1846702538" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1480.11.419948226\1624193084" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1480.10.1021747629\720930854" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1480.9.2058885433\1355236813" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1480.20.1196496708\1754740093" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="1480.4.206531381\125063461" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=3932
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1480.7.364309537\83876225" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1480.6.1019046869\474258248" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1480.4.206531381\125063461" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1480.5.307953504\1865203986" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="1480.0.454831756\1814395475" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- http://www.burnaware.com/after-install/ /crash-reporter-parent-id=1480
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- http://www.burnaware.com/after-install/
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1480.8.444914153\1099045663" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1480.21.212069193\1005575338" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней