Trojan.Siggen31.27572

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\Software\Classes\CLSID\{FB562550-BBE6-4298-861A-5C0A6562C272}\Shell\Open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe'
[HKLM\Software\Classes\RevoUninstallerPro.ruel\shell\open\command] '' = '%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe /implog "%1"'
[HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\Revoflt] 'ImagePath' = 'system32\DRIVERS\revoflt.sys'

Создает следующие сервисы

'Revoflt' system32\DRIVERS\revoflt.sys

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\taskkill.exe' /f /im ruplp.exe

Регистрирует фильтр файловой системы

[HKLM\System\CurrentControlSet\Services\Revoflt] 'Group' = 'FSFilter Activity Monitor'

Изменения в файловой системе

Создает следующие файлы

C:\kinghaze\kur.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\is-3pilo.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-uim0n.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-5pniv.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-j0742.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-itacn.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7d9fg.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-kq6an.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-570g7.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2qtar.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-te6m4.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-subt8.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-iu5k4.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4qfcb.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-48pjr.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tjudn.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ir44f.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-88eug.tmp
%LOCALAPPDATA%\vs revo group\revo uninstaller pro\logfile.vslog
<DRIVERS>\setf353.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\unins000.dat
%ProgramFiles%\vs revo group\revo uninstaller pro\unins000.msg
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro help.lnk
C:\users\public\desktop\revo uninstaller pro.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\uninstall revo uninstaller pro.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro on the web.url
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\revo uninstaller pro\revo uninstaller pro.lnk
%ProgramFiles%\vs revo group\revo uninstaller pro\is-uc2sp.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-93lik.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-flh08.tmp
%ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\is-hjbhk.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-9ttmo.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-eu8mq.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7d77p.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-peabj.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hobuq.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-v2fhf.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-h5mrr.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-764od.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-h6skb.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qftbb.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-0fj2p.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-nmnit.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-418r0.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1aqof.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1v6e8.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-mjo2h.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-c08ul.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-bau1p.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\is-t6t3l.tmp
%TEMP%\is-c8att.tmp\_isetup\_setup64.tmp
%TEMP%\is-4cme5.tmp\setup.tmp
C:\kinghaze\setup.exe
%LOCALAPPDATA%\vs revo group\revo uninstaller pro\data\cachedata.dat
%ProgramFiles%\vs revo group\revo uninstaller pro\is-jerdm.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-64dp5.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7ture.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-oasol.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-84vnj.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ohi0v.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-h7pug.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-pvllf.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4cuqt.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-f7o3r.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-o6prm.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-gl9rt.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-giq40.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-usk4l.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-plbl8.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-pvtud.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4f593.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-6srkm.tmp
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-lvd08.tmp
%TEMP%\aut27da.tmp

Удаляет следующие файлы

%TEMP%\is-c8att.tmp\_isetup\_setup64.tmp
%TEMP%\is-4cme5.tmp\setup.tmp
%ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\revouninstallerpro5.lic
%TEMP%\aut27da.tmp
C:\kinghaze\kur.exe
C:\kinghaze\setup.exe

Перемещает следующие файлы

%ProgramFiles%\vs revo group\revo uninstaller pro\is-t6t3l.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\unins000.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-hobuq.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\romanian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7d77p.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\russian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-48pjr.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\serbian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4qfcb.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\serbianlatin.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-iu5k4.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\simplifiedchinese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-subt8.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\slovak.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-te6m4.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\slovenian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-2qtar.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\swedish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-peabj.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\spanish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-tjudn.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\thai.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7d9fg.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\traditionalchinese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-h5mrr.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-v2fhf.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguese_standard.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-itacn.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\turkish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\is-uim0n.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.inf
%ProgramFiles%\vs revo group\revo uninstaller pro\is-3pilo.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\is-570g7.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revocmd.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\is-kq6an.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoappbar.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\is-88eug.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\ruext.dll
%ProgramFiles%\vs revo group\revo uninstaller pro\is-jerdm.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revoflt.sys
%ProgramFiles%\vs revo group\revo uninstaller pro\is-eu8mq.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\revo uninstaller pro help.pdf
%ProgramFiles%\vs revo group\revo uninstaller pro\is-9ttmo.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\license.txt
%ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\is-hjbhk.tmp в %ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\revouninstallerpro5.lic
%ProgramFiles%\vs revo group\revo uninstaller pro\is-flh08.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\ruplp.exe
%ProgramFiles%\vs revo group\revo uninstaller pro\is-93lik.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\rupilogs.rupldb
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-j0742.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\ukrainian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-5pniv.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\vietnamese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-84vnj.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\portuguesebrazil.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ohi0v.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\polish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-h7pug.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\persian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-c08ul.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\arabic.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1v6e8.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\armenian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-764od.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\azerbaijani.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-1aqof.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\bengali.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-418r0.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\bulgarian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-nmnit.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\czech.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-0fj2p.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\danish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-qftbb.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\dutch.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-h6skb.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\english.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-oasol.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\estonian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-mjo2h.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\finnish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-64dp5.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\french.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-bau1p.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\albanian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-ir44f.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\german.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-7ture.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hebrew.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-6srkm.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hellenic.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4f593.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hindi.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-pvtud.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hrvatski.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-plbl8.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\hungarian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-usk4l.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\italiano.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-giq40.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\indonesian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-gl9rt.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\japanese.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-o6prm.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\korean.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-f7o3r.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\kurdish.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-4cuqt.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\macedonian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-pvllf.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\norwegian.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\lang\is-lvd08.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\lang\gujarati.ini
%ProgramFiles%\vs revo group\revo uninstaller pro\is-uc2sp.tmp в %ProgramFiles%\vs revo group\revo uninstaller pro\reg_lp.bat
<DRIVERS>\setf353.tmp в <DRIVERS>\revoflt.sys

Изменяет следующие файлы

%LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl

Подменяет следующие файлы

%ALLUSERSPROFILE%\vs revo group\revo uninstaller pro\revouninstallerpro5.lic

Другое

Ищет следующие окна

ClassName: '' WindowName: ''

Создает и запускает на исполнение

'C:\kinghaze\kur.exe'
'C:\kinghaze\setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-4cme5.tmp\setup.tmp' /SL5="$70180,16849616,196608,C:\Kinghaze\setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%ProgramFiles%\vs revo group\revo uninstaller pro\ruplp.exe' /regserver /NOREDIRECT
'%ProgramFiles%\vs revo group\revo uninstaller pro\revouninpro.exe' /bc

Запускает на исполнение

'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
'<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %ProgramFiles%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
'<SYSTEM32>\runonce.exe' -r
'<SYSTEM32>\grpconv.exe' -o
'%WINDIR%\syswow64\taskkill.exe' /f /im ruplp.exe (со скрытым окном)

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней