Trojan.Siggen32.9627

Техническая информация

Вредоносные функции

Запускает большое число процессов

Изменения в файловой системе

Создает следующие файлы

%TEMP%\_mei35682\vcruntime140.dll
%TEMP%\_mei35682\_bz2.pyd
%TEMP%\_mei35682\_ctypes.pyd
%TEMP%\_mei35682\_decimal.pyd
%TEMP%\_mei35682\_hashlib.pyd
%TEMP%\_mei35682\_lzma.pyd
%TEMP%\_mei35682\_socket.pyd
%TEMP%\_mei35682\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-fibers-l1-1-1.dll
%TEMP%\_mei35682\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei35682\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-kernel32-legacy-l1-1-1.dll
%TEMP%\_mei35682\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei35682\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei35682\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei35682\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-sysinfo-l1-2-0.dll
%TEMP%\_mei35682\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei35682\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei35682\base_library.zip
%TEMP%\_mei35682\libcrypto-3.dll
%TEMP%\_mei35682\libffi-8.dll
%TEMP%\_mei35682\python313.dll
%TEMP%\_mei35682\select.pyd
%TEMP%\_mei35682\ucrtbase.dll
%TEMP%\_mei35682\unicodedata.pyd
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69232919-768.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6923291b-1534.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6923291b-ac8.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6923291c-de4.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6923291d-48.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6923291f-1728.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69232926-c58.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6923292b-12ec.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6923292b-12c0.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6923292b-a84.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6923292b-13a4.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69232930-14f0.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69232930-b70.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69232932-b6c.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69232936-177c.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69232938-1498.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6923293a-c80.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69232941-bf8.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69232975-e70.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6923296e-1474.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69232978-808.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69232975-e48.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69232978-f38.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69232978-1718.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69232978-b14.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69232978-fbc.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6923297a-16c8.pma

Удаляет файлы, которые сам же создал

%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002

Перемещает следующие файлы

%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\current
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current

Изменяет следующие файлы

%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\edge\user data\default\visited links
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal

Подменяет следующие файлы

%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG

Сетевая активность

Подключается к

'co####.edge.skype.com':443
'tw##ch.tv':443
'eb##.com':443
'np#.gov':443
'36#.#andex.com':443
'ha##ard.edu':443
'bu###eed.com':443
'x1.#.lencr.org':80
'ch###rbate.com':443
'fr###etvinfo.fr':443
'ch####aily.com.cn':443
'fr###einfo.fr':443
'sd#.###vacy-center.org':443
'lo####38.xiti.com':443
'cr#.####g2.amazontrust.com':80
'x.##2.us':80
'pl#####m.twitter.com':443
'gi##y.com':443
'st#####cdn.jtvnw.net':443
'bo###cams10.com':443

TCP

Запросы HTTP GET

http://x1.#.lencr.org/
http://cr#.####g2.amazontrust.com/rootg2.cer
http://x.##2.us/x.cer

Другие

'co####.edge.skype.com':443
'k.###tchcdn.net':443
'eb##.com':443
'36#.#andex.com':443
'np#.gov':443
'ha##ard.edu':443
'ab######public.buzzfeed.com':443
'ch###rbate.com':443
'fr###etvinfo.fr':443
'tw##ch.tv':443
'ho##.nps.gov':443
'ch####aily.com.cn':443
'fr###einfo.fr':443
'lo####38.xiti.com':443
'sd#.###vacy-center.org':443
'cn.####adaily.com.cn':443
'ad#.###nadaily.com.cn':443
'pl#####m.twitter.com':443
'ap#.#intup.com':443
'ap#.#witch.tv':443
'as####.twitch.tv':443
'st#####cdn.jtvnw.net':443
'gq#.#witch.tv':443

UDP

DNS ASK co####.edge.skype.com
DNS ASK eb##.com
DNS ASK tw##ch.tv
DNS ASK np#.gov
DNS ASK 36#.#andex.com
DNS ASK bu###eed.com
DNS ASK ha##ard.edu
DNS ASK x1.#.lencr.org
DNS ASK ch###rbate.com
DNS ASK fr###etvinfo.fr
DNS ASK ho##.nps.gov
DNS ASK ch####aily.com.cn
DNS ASK fr###einfo.fr
DNS ASK lo####38.xiti.com
DNS ASK sd#.###vacy-center.org
DNS ASK no######.live.franceinfo.fr
DNS ASK pi######.live.franceinfo.fr
DNS ASK ti#######.live.franceinfo.fr
DNS ASK cr#.####g2.amazontrust.com
DNS ASK im##.##inadaily.com.cn
DNS ASK ad#.###nadaily.com.cn
DNS ASK x.##2.us
DNS ASK gi##y.com
DNS ASK pl#####m.twitter.com
DNS ASK ap#.#witch.tv
DNS ASK st#####cdn.jtvnw.net
DNS ASK gq#.#witch.tv
DNS ASK as####.twitch.tv
DNS ASK bo###cams10.com

Другое

Ищет следующие окна

ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'

Перезапускает анализируемый образец

Запускает на исполнение

'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://twitch.tv/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://360.yandex.com/disk/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://t.amyfc.link/66056/779/0?aff_sub=bestfreecams&bo=2779,2778,2777,2776,2775&po=6533
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://iso.org/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://nginx.com/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://trello.com/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.e-monsite.com/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://twitch.tv/ (со скрытым окном)
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.canada.ca/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://chaturbate.com/in/?track=Bestfreecams.club&tour=grq0&campaign=eS8wH
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.academia.edu/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://trello.com/ (со скрытым окном)
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://bongacams10.com/track?c=716918
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://usgs.gov/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.ebay.com/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://harvard.edu/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://francetvinfo.fr/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://nps.gov/index.htm/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://buzzfeed.com/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://chinadaily.com.cn/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://umich.edu/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://go.xxxiijmp.com/?campaignId=bestfreecams.club&userId=9b65bf46ffaa65f3a0e9f48617bfce410a91e0834859e07cbac61729433ad6e8
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://ouest-france.fr/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.bestfreecams.club/top.html
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://dropbox.com/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://taringa.net/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://web.mit.edu/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://icann.org/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.leparisien.fr/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.ucla.edu/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.soratemplates.com/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://tour.camsoda.com/enter.php?id=rmedia&type=REV&t=best&cmp=bestfreecams
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://columbia.edu/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.washingtonpost.com/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://microsoft.com/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://scholastic.com/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://guardian.co.uk/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.gov.br/planalto/pt-br
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://european-union.europa.eu/index_es
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://news.com.au/

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней