Exploit.Siggen3.43914

Техническая информация

Вредоносные функции

Запускает на исполнение (эксплоит)

'%ProgramFiles%\opera\launcher.exe' -noautoupdate -- "http://excelvba.ru/buy/EULA/trial_expired?name=PastePictures"

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7427.tmp
%TEMP%\file_mainpicture_pastepictures
%HOMEPATH%\application data\microsoft\forms\excel.box
%APPDATA%\pastepictures.ini
%TEMP%\etilqs_gv8o9xoxafigfbf
%TEMP%\etilqs_5eivmv0sh6zp879
%TEMP%\etilqs_yai1cevite6npoo
%TEMP%\etilqs_gssptmezgs7xuau
%TEMP%\etilqs_ccuybn8gnkkunjb
%TEMP%\b86d.tmp
%TEMP%\b87e.tmp
%TEMP%\b88e.tmp
%TEMP%\b86c.tmp

Присваивает атрибут 'скрытый' для следующих файлов

%APPDATA%\pastepictures.ini

Удаляет следующие файлы

%TEMP%\7427.tmp
%TEMP%\b86d.tmp
%TEMP%\b87e.tmp
%TEMP%\b88e.tmp
%TEMP%\b86c.tmp

Сетевая активность

Подключается к

'ex##lvba.ru':80
'cj.##tomi.com':80
'kq##fj.com':80
'do#####d3.operacdn.com':443
'ro###.ebay.com':443
'al##ems.com':443
'ro###.ebay.com':80
'nl.##hoo.com':80
'ya###.opera.com':80
'sd#####es.operacdn.com':443
'fa###ook.com':443
'fa###ook.com':80
'cj.##tomi.com':443
'ex##lvba.ru':443
'si#####ck2.opera.com':80
'en.###ipedia.org':443
'se####.yahoo.com':443
'am##on.com':443
'en.###ipedia.org':80
'au######te.geo.opera.com':443
'am##on.com':80
'du###uckgo.com':443
'se####.yahoo.com':80
'au######te.geo.opera.com':80
'xn######kunbi5c.xn--p1ai':80
're###.opera.com':80
'oc##.#ectigo.com':80

TCP

Запросы HTTP GET

http://xn######kunbi5c.xn--p1ai/ip.php
http://www.tk##hce.com/click-8384705-12525324
http://www.kq##fj.com/click-8384705-10668447
http://re###.opera.com/speeddials/partner/tripadvisor_us
http://re###.opera.com/speeddials/partner/overstock_us
http://re###.opera.com/speeddials/partner/wallmart_com_us
http://ro###.ebay.com/rover/1/711-53200-19255-0/1?ic###########################################################################################################################
http://nl.##hoo.com/?il#####
http://www.am##on.com/?ta#########################
http://ya###.opera.com/favicon.ico
http://re###.opera.com/favicon.ico
http://re###.opera.com/speeddials/partner/bestbuy_com
http://re###.opera.com/speeddials/partner/twitter_us
http://re###.opera.com/speeddials/partner/surfeasy
http://oc##.#ectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEGDK6ymdPNaHf53L1fbpHxs%3D
http://re###.opera.com/speeddials/partner/buzzfeed_com
http://re###.opera.com/speeddials/partner/aliexpress_com_us
http://re###.opera.com/speeddials/partner/yahoo
http://re###.opera.com/speeddials/partner/ebay_us
http://re###.opera.com/speeddials/partner/amazon_us
http://www.fa###ook.com/
http://re###.opera.com/speeddials/partner/facebook
http://ex##lvba.ru/buy/EULA/trial_expired?na################
http://re###.opera.com/www.opera.com/firstrun/
http://si#####ck2.opera.com/?ho###################################################
http://en.###ipedia.org/favicon.ico
http://www.am##on.com/favicon.ico
http://se####.yahoo.com/favicon.ico
http://au######te.geo.opera.com/geolocation/
http://re###.opera.com/speeddials/partner/booking_com_us
http://oc##.#ectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEQCCq9q1TD9g81Fl7xtXvh8N

Запросы HTTP POST

http://ex##lvba.ru/php2/updates.php

Другие

'du###uckgo.com':443
'au######te.geo.opera.com':443
'am##on.com':443
'se####.yahoo.com':443
'en.###ipedia.org':443
'ex##lvba.ru':443
'fa###ook.com':443
'sd#####es.operacdn.com':443
'ya###.opera.com':443
'op##a.com':443
'al##ems.com':443
'ya##o.com':443
'ro###.ebay.com':443
'do#####d3.operacdn.com':443
'kq##fj.com':443

UDP

DNS ASK ex##lvba.ru
DNS ASK tk##hce.com
DNS ASK kq##fj.com
DNS ASK li#####ergy.walmart.com
DNS ASK do#####d3.operacdn.com
DNS ASK ya##o.com
DNS ASK ro###.ebay.com
DNS ASK al##ems.com
DNS ASK nl.##hoo.com
DNS ASK op##a.com
DNS ASK ya###.opera.com
DNS ASK sd#####es.operacdn.com
DNS ASK fa###ook.com
DNS ASK re###.opera.com
DNS ASK si#####ck2.opera.com
DNS ASK en.###ipedia.org
DNS ASK bi##.#ikimedia.org
DNS ASK am##on.com
DNS ASK du###uckgo.com
DNS ASK se####.yahoo.com
DNS ASK au######te.geo.opera.com
DNS ASK xn######kunbi5c.xn--p1ai
DNS ASK cj.##tomi.com
DNS ASK oc##.#ectigo.com

Другое

Ищет следующие окна

ClassName: 'MSAA_DA_Class' WindowName: 'MSAA_DA_a88'
ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'

Запускает на исполнение

'%ProgramFiles%\opera\33.0.1990.115\opera.exe' -noautoupdate --ran-launcher -- http://excelvba.ru/buy/EULA/trial_expired?name=PastePictures
'%ProgramFiles%\opera\33.0.1990.115\opera_crashreporter.exe' -noautoupdate --ran-launcher --crash-reporter-parent-id=2792 -- http://excelvba.ru/buy/EULA/trial_expired?name=PastePictures
'%ProgramFiles%\opera\33.0.1990.115\opera.exe' --type=renderer --alt-high-dpi-setting=96 --system-dpi-setting=96 --disable-direct-npapi-requests --disable-win32k-renderer-lockdown --lang=en-US --disable-client-side-phishing-detection --with...
'%ProgramFiles%\opera\33.0.1990.115\opera.exe' --type=renderer --alt-high-dpi-setting=96 --system-dpi-setting=96 --disable-direct-npapi-requests --disable-win32k-renderer-lockdown --lang=en-US --extension-process --enable-webrtc-hw-h264-enc...
'%ProgramFiles%\opera\33.0.1990.115\opera.exe' --type=utility --channel="2792.4.1321422108\2114935031" --lang=en-US --no-sandbox --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide...
'%ProgramFiles%\opera\33.0.1990.115\opera.exe' --type=utility --channel="2792.5.992197315\1884443401" --lang=en-US --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-...
'%ProgramFiles%\opera\33.0.1990.115\opera.exe' --type=utility --channel="2792.8.1618437142\812196113" --lang=en-US --with-feature:installer-experiment-test=off --with-feature:installer-ui-stats=on --with-feature:installer-hide-from-program-...