Trojan.Siggen31.2422

Техническая информация

Вредоносные функции

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе

Создает следующие файлы

%HOMEPATH%\desktop\В±В¬Г°В¦qqВ±ГГ§Г©.lnk
%TEMP%\setupfiles\3.0.6.106\funshion\swscale-2.dll
%TEMP%\setupfiles\3.0.6.106\funshion\simpleie.dll
%TEMP%\setupfiles\3.0.6.106\funshion\pncrt.dll
%TEMP%\setupfiles\3.0.6.106\funshiontools\npfunshion.dll
%TEMP%\setupfiles\3.0.6.106\fundata\luainterface_mt.dll
%TEMP%\setupfiles\3.0.6.106\funshion\lua51.dll
%TEMP%\setupfiles\3.0.6.106\funshion\lua5.1.dll
%TEMP%\setupfiles\3.0.6.106\fundata\funworks64.dll
%TEMP%\setupfiles\3.0.6.106\funshion\coreaac.ax
%TEMP%\setupfiles\3.0.6.106\fundata\funworks.dll
%TEMP%\setupfiles\3.0.6.106\funshion\funshionplugin2.dll
%TEMP%\setupfiles\3.0.6.106\fundata\funshadow.dll
%TEMP%\setupfiles\3.0.6.106\fundata\funseed64.dll
%TEMP%\setupfiles\3.0.6.106\fundata\funseed.dll
%TEMP%\setupfiles\3.0.6.106\funshiontools\funoictl64.dll
%TEMP%\setupfiles\3.0.6.106\funshion\gma.dll
%TEMP%\setupfiles\3.0.6.106\funshion\funshionweb.exe
%TEMP%\setupfiles\3.0.6.106\funshion\coreavc.ax
%TEMP%\setupfiles\3.0.6.106\funshion\skin\upgradedefault.skin
%TEMP%\setupfiles\3.0.6.106\funshion\skin\default.skin
%TEMP%\setupfiles\3.0.6.106\funshion\windows.lua
%TEMP%\setupfiles\3.0.6.106\funshion\lua\socket\url.lua
%TEMP%\setupfiles\3.0.6.106\funshion\lua\socket\tp.lua
%TEMP%\setupfiles\3.0.6.106\funshion\lua\socket.lua
%TEMP%\setupfiles\3.0.6.106\funshion\lua\socket\smtp.lua
%TEMP%\setupfiles\3.0.6.106\funshiontools\funoictl.dll
%TEMP%\setupfiles\3.0.6.106\winusb.dll
%TEMP%\setupfiles\3.0.6.106\funshion\lua\socket\http.lua
%TEMP%\setupfiles\3.0.6.106\funshion\lua\socket\ftp.lua
%TEMP%\setupfiles\3.0.6.106\funshion\lang\funshionupgrade.en_us
%TEMP%\setupfiles\3.0.6.106\funshion\lang\funshion.en_us
%TEMP%\setupfiles\3.0.6.106\fundata\sdodge.daw
%TEMP%\setupfiles\3.0.6.106\funshion\lang\funshion.zh_cn.bak
%TEMP%\setupfiles\3.0.6.106\funshion\lang\funshion.en_us.bak
%TEMP%\setupfiles\3.0.6.106\funshion\lua\ltn12.lua
%TEMP%\setupfiles\3.0.6.106\funshion\fpvddec.ax
%TEMP%\setupfiles\3.0.6.106\fundata\funnail.dll
%TEMP%\setupfiles\3.0.6.106\fundata\fundodge.dll
%TEMP%\setupfiles\3.0.6.106\funshion\drvc.dll
%TEMP%\tools\crashreport.exe
%HOMEPATH%\funshion\funshion.ini
%APPDATA%\microsoft\windows\cookies\user@funshion[2].txt
%HOMEPATH%\funshion.ini
%APPDATA%\microsoft\windows\cookies\user@funshion[1].txt
%WINDIR%\syswow64\funshion.ini
%TEMP%\setupfiles\3.0.6.106\funshion.ini
%TEMP%\setupfiles\3.0.6.106\funshion\lang\funshion.zh_cn
%TEMP%\setupfiles\3.0.6.106\donghuanew_18.swf
%TEMP%\tools\tools.7z
%WINDIR%\funshioninstall_c43318.exe
%LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dzhkzdlo\errorpagestrings[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\q1e129qo\errorpagetemplate[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\604pwz7f\dnserrordiagoff_weboc[1]
%HOMEPATH%\desktop\ГіГҐВїГЎГЈГўВ·Г±ВµГ§ГіВ°.lnk
%TEMP%\tools\gma.dll
%TEMP%\setupfiles\3.0.6.106\funshion\lua\mime.lua
%TEMP%\setupfiles\3.0.6.106\funshion\icon\funshiongame2.ico
%TEMP%\setupfiles\3.0.6.106\funshion\icon\rmvb.ico
%TEMP%\setupfiles\3.0.6.106\funshion\icon\funshop4.ico
%TEMP%\setupfiles\3.0.6.106\funshion\socket\core.dll
%TEMP%\setupfiles\3.0.6.106\funshion\mime\core.dll
%TEMP%\setupfiles\3.0.6.106\funshion\cook.dll
%TEMP%\setupfiles\3.0.6.106\funshion\cjson.dll
%TEMP%\setupfiles\3.0.6.106\funshion\avutil-52.dll
%TEMP%\setupfiles\3.0.6.106\funshion\avcodec-55.dll
%TEMP%\setupfiles\3.0.6.106\funshion\icon\mp4.ico
%TEMP%\setupfiles\3.0.6.106\funshion\atrc.dll
%TEMP%\setupfiles\3.0.6.106\setupfiles.7z
%TEMP%\setupfiles\3.0.6.106\funshion\funshionupgrade.exe
%TEMP%\setupfiles\3.0.6.106\funshion\funshionservice.exe
%TEMP%\setupfiles\3.0.6.106\funshion\funshion.exe
%TEMP%\setupfiles\3.0.6.106\funshion\funbob.exe
%TEMP%\setupfiles\3.0.6.106\funshion\crashreport.exe
%TEMP%\setupfiles\3.0.6.106\fundata\seedicon.ico
%TEMP%\setupfiles\3.0.6.106\funshion\uninstall.exe
%TEMP%\setupfiles\3.0.6.106\funshion\lang\funshionupgrade.zh_cn

Удаляет следующие файлы

%APPDATA%\microsoft\windows\cookies\user@funshion[1].txt

Сетевая активность

Подключается к

'pa#####.funshion.com':80
'ne#####.funshion.net':80
'u.###00dnet.cn':80
'zc####l.zcominc.com':80
'st##.#unshion.net':80

TCP

Запросы HTTP GET

http://pa#####.funshion.com/partner/download.php?id###############
http://ne#####.funshion.net/software/download.php?id#####################################
http://u.###00dnet.cn/down/LetvLive.028.749.exe
http://st##.#unshion.net/client/cinstall?rp######################################################################################################################################################...

UDP