Trojan.PWS.Siggen1.7833

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\їмЅЭ·ЅКЅ\KKJDock.exe'
'%PROGRAM_FILES%\game888\setup.exe'
'<SYSTEM32>\SeFastInstall_3135a.exe'
'%HOMEPATH%\Templates\installstat.exe'
'%TEMP%\RarSFX0\gamesetup.exe' /Silent
'%TEMP%\is-VQDGP.tmp\gamesetup.tmp' /SL5="$10104,1512257,51712,%TEMP%\RarSFX0\gamesetup.exe" /Silent
'%PROGRAM_FILES%\game888\setup_4846.exe'

Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:

[<HKLM>\SOFTWARE\FlashFXP]
[<HKCU>\Software\FlashFXP]

Изменяет следующие настройки проводника Windows (Windows Explorer):

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\CS.png
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\ACDSee.png
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\ОТµДОДµµ.png
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\PS.png
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\MSN.png
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\FXP.png
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\ОТµДµзДФ.png
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\IE2.png
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\IE1.png
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\KKJDock.exe
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\їШЦЖГж°е.png
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\јЗКВ±ѕ.png
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\јЖЛгЖч.png
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\QQ.png
<SYSTEM32>\SeFastInstall_3135a.exe
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\uninst.exe
%TEMP%\pyversion.ini
%TEMP%\version.ini
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\kkjDock.cfg
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\УЕ»ЇґуК¦.png
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\Word.png
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\Winamp.png
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\RealOne.png
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\З§З§ѕІМэ.png
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\їб№·.png
%PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\і¬ј¶НГЧУ.png
%HOMEPATH%\Templates\statistics.dll
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\і¬єГНжУОП·.lnk
%ALLUSERSPROFILE%\Desktop\і¬єГНжУОП·.lnk
%PROGRAM_FILES%\game888\is-KFMPE.tmp
%PROGRAM_FILES%\Internet Explorer\SIGNUP\msn.ink
%TEMP%\nsp2.tmp\System.dll
%PROGRAM_FILES%\game888\unins000.dat
%PROGRAM_FILES%\game888\is-3I0MJ.tmp
%TEMP%\is-R5NFQ.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-VQDGP.tmp\gamesetup.tmp
%TEMP%\RarSFX0\gamesetup.exe
%PROGRAM_FILES%\game888\is-FQS0M.tmp
%PROGRAM_FILES%\game888\is-ATQMO.tmp
%TEMP%\is-R5NFQ.tmp\_isetup\_shfoldr.dll
%HOMEPATH%\Desktop\Internet Exlporer.ink
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\і¬єГНжУОП·.txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
%HOMEPATH%\Templates\installstat.exe
%HOMEPATH%\Favorites\УгУгРЎУОП·.url
%PROGRAM_FILES%\Internet Explorer\SIGNUP\in
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.txt
%HOMEPATH%\My Documents\backup\Show Desktop.scf
%HOMEPATH%\My Documents\backup\Launch Internet Explorer Browser.lnk
%HOMEPATH%\My Documents\backup\desktop.ini
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Exlporer.ink
%HOMEPATH%\My Documents\backup\і¬єГНжУОП·.lnk
%HOMEPATH%\My Documents\backup\Windows Media Player.lnk

Удаляет следующие файлы:

%HOMEPATH%\Templates\installstat.exe
%HOMEPATH%\My Documents\backup\і¬єГНжУОП·.txt
%TEMP%\nsp2.tmp\System.dll
%HOMEPATH%\Templates\statistics.dll
%HOMEPATH%\My Documents\backup\Windows Media Player.txt
%HOMEPATH%\My Documents\backup\desktop.ini
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\і¬єГНжУОП·.lnk
%HOMEPATH%\My Documents\backup\Show Desktop.scf
%HOMEPATH%\My Documents\backup\Launch Internet Explorer Browser.txt

Перемещает следующие файлы:

%HOMEPATH%\My Documents\backup\і¬єГНжУОП·.lnk в %HOMEPATH%\My Documents\backup\і¬єГНжУОП·.txt
%HOMEPATH%\My Documents\backup\Windows Media Player.lnk в %HOMEPATH%\My Documents\backup\Windows Media Player.txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.txt в %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\і¬єГНжУОП·.txt в %APPDATA%\Microsoft\Internet Explorer\Quick Launch\і¬єГНжУОП·.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.txt в %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
%PROGRAM_FILES%\game888\is-FQS0M.tmp в %PROGRAM_FILES%\game888\setup_4846.exe
%PROGRAM_FILES%\game888\is-ATQMO.tmp в %PROGRAM_FILES%\game888\unins000.exe
%PROGRAM_FILES%\game888\is-3I0MJ.tmp в %PROGRAM_FILES%\game888\all.exe
%HOMEPATH%\My Documents\backup\Launch Internet Explorer Browser.lnk в %HOMEPATH%\My Documents\backup\Launch Internet Explorer Browser.txt
%PROGRAM_FILES%\game888\is-KFMPE.tmp в %PROGRAM_FILES%\game888\setup.exe

Сетевая активность:

Подключается к:

'pi##.#e.sogou.com':80
'localhost':1043
'www.ba###.comclcount':80
'li####nz.kkjie.com':80
'co####.ie.sogou.com':80
'im#.#ogou.com':80

TCP:

Запросы HTTP GET:

pi##.#e.sogou.com/sepush.gif?h=########################################################
im#.#ogou.com/fastversion.txt
co####.ie.sogou.com/seversion.txt?h=################################

Запросы HTTP POST: