Trojan.Siggen30.10705

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SEDService.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onlinent.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EMLPROXY.EXE] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SAPISSVC.EXE] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\quhlpsvc.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opssvc.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ARWSRVC.EXE] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\coreServiceShell.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\coreFrameworkHost.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TMBMSRV.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iVPAgent.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EPSecurityService.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdredline.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EPProtectedService.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EPIntegrationService.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\epag.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sepWscSvc64.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EPUpdateService.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PccNt.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MBAMService.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfemactl.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dsa.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cyserver.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tlaservice.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CyveraService.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpsus.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfemms.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\masvc.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASDSvc.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\klserver.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\macompatsvc.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpmapp.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAYCSER.EXE] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EconSer.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SavService.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\macmnsvc.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTgui.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTservice.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TmCCSF.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavtray.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360EntClient.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360sd.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rp.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavfswh.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360bdoctor.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kmplayer.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TTPlayer.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCRealTimeSpeedup.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCRTP.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sophos UI.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SophosFileScanner.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SSPService.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwmusic.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavfs.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavfswp.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksnproxy.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TmListen.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\k7emlpxy.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TmPfw.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NTRTScan.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PccNTMon.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswEngSrv.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswidsagent.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastSvc.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\k7tsecurity.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\k7twp.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\k7fwsrvc.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavfsgt.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\k7rtscan.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\k7tsmngr.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7CrvSvc.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\eguiProxy.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NortonSecurity.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nsWscSvc.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\klnagent.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ds_monitor.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Notifier.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'

Вредоносные функции

Запускает на исполнение

'<SYSTEM32>\taskkill.exe' /f /im PccNt.exe
'<SYSTEM32>\taskkill.exe' /f /im PccNTMon.exe
'<SYSTEM32>\taskkill.exe' /f /im NTRTScan.exe
'<SYSTEM32>\taskkill.exe' /f /im kavtray.exe
'<SYSTEM32>\taskkill.exe' /f /im kavfswp.exe
'<SYSTEM32>\taskkill.exe' /f /im kavfswh.exe
'<SYSTEM32>\taskkill.exe' /f /im ksnproxy.exe
'<SYSTEM32>\taskkill.exe' /f /im kavfs.exe
'<SYSTEM32>\taskkill.exe' /f /im kavfsgt.exe
'<SYSTEM32>\taskkill.exe' /f /im klnagent.exe

Изменения в файловой системе

Самоперемещается

из <Полный путь к файлу> в <SYSTEM32>\__147872403_541144814

Другое

Ищет следующие окна

ClassName: '' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней