Trojan.PWS.Siggen5.32226

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

%APPDATA%\microsoft\windows\start menu\programs\startup\windowsupdate.exe

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%LOCALAPPDATA%\microsoft\edge\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\login data
%HOMEPATH%\desktop\1189.jpg
%HOMEPATH%\desktop\13.jpg
%HOMEPATH%\desktop\168.jpeg
%HOMEPATH%\desktop\210252809.jpg
%HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
%HOMEPATH%\desktop\4f0bf7ff71f28.jpg
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\region-north-karelia.jpeg
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx

Изменения в файловой системе

Создает следующие файлы

%TEMP%\_mei24922\pil\_avif.cp310-win_amd64.pyd
%TEMP%\_mei24922\pil\_imaging.cp310-win_amd64.pyd
%TEMP%\_mei24922\pil\_imagingcms.cp310-win_amd64.pyd
%TEMP%\_mei24922\pil\_imagingmath.cp310-win_amd64.pyd
%TEMP%\_mei24922\pil\_imagingtk.cp310-win_amd64.pyd
%TEMP%\_mei24922\pil\_webp.cp310-win_amd64.pyd
%TEMP%\_mei24922\vcruntime140.dll
%TEMP%\_mei24922\vcruntime140_1.dll
%TEMP%\_mei24922\_asyncio.pyd
%TEMP%\_mei24922\_brotli.cp310-win_amd64.pyd
%TEMP%\_mei24922\_bz2.pyd
%TEMP%\_mei24922\_cffi_backend.cp310-win_amd64.pyd
%TEMP%\_mei24922\_ctypes.pyd
%TEMP%\_mei24922\_decimal.pyd
%TEMP%\_mei24922\_elementtree.pyd
%TEMP%\_mei24922\_hashlib.pyd
%TEMP%\_mei24922\_lzma.pyd
%TEMP%\_mei24922\_multiprocessing.pyd
%TEMP%\_mei24922\_overlapped.pyd
%TEMP%\_mei24922\_queue.pyd
%TEMP%\_mei24922\_socket.pyd
%TEMP%\_mei24922\_sqlite3.pyd
%TEMP%\_mei24922\_ssl.pyd
%TEMP%\_mei24922\base_library.zip
%TEMP%\_mei24922\bcrypt\_bcrypt.pyd
%TEMP%\_mei24922\certifi\cacert.pem
%TEMP%\_mei24922\charset_normalizer\md.cp310-win_amd64.pyd
%TEMP%\_mei24922\charset_normalizer\md__mypyc.cp310-win_amd64.pyd
%TEMP%\_mei24922\cryptography-41.0.7.dist-info\installer
%TEMP%\_mei24922\cryptography-41.0.7.dist-info\license
%TEMP%\_mei24922\cryptography-41.0.7.dist-info\license.apache
%TEMP%\_mei24922\cryptography-41.0.7.dist-info\license.bsd
%TEMP%\_mei24922\cryptography-41.0.7.dist-info\metadata
%TEMP%\_mei24922\cryptography-41.0.7.dist-info\record
%TEMP%\_mei24922\cryptography-41.0.7.dist-info\wheel
%TEMP%\_mei24922\cryptography-41.0.7.dist-info\top_level.txt
%TEMP%\_mei24922\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei24922\libcrypto-1_1.dll
%TEMP%\_mei24922\libffi-7.dll
%TEMP%\_mei24922\libssl-1_1.dll
%TEMP%\_mei24922\numpy-2.2.6.dist-info\delvewheel
%TEMP%\_mei24922\numpy-2.2.6.dist-info\installer
%TEMP%\_mei24922\numpy-2.2.6.dist-info\license.txt
%TEMP%\_mei24922\numpy-2.2.6.dist-info\metadata
%TEMP%\_mei24922\numpy-2.2.6.dist-info\record
%TEMP%\_mei24922\numpy-2.2.6.dist-info\wheel
%TEMP%\_mei24922\numpy-2.2.6.dist-info\entry_points.txt
%TEMP%\_mei24922\numpy.libs\libscipy_openblas64_-13e2df515630b4a41f92893938845698.dll
%TEMP%\_mei24922\numpy.libs\msvcp140-263139962577ecda4cd9469ca360a746.dll
%TEMP%\_mei24922\numpy\_core\_multiarray_tests.cp310-win_amd64.pyd
%TEMP%\_mei24922\numpy\_core\_multiarray_umath.cp310-win_amd64.pyd
%TEMP%\_mei24922\numpy\fft\_pocketfft_umath.cp310-win_amd64.pyd
%TEMP%\_mei24922\numpy\linalg\_umath_linalg.cp310-win_amd64.pyd
%TEMP%\_mei24922\numpy\random\_bounded_integers.cp310-win_amd64.pyd
%TEMP%\_mei24922\numpy\random\_common.cp310-win_amd64.pyd
%TEMP%\_mei24922\numpy\random\_generator.cp310-win_amd64.pyd
%TEMP%\_mei24922\numpy\random\_mt19937.cp310-win_amd64.pyd
%TEMP%\_mei24922\numpy\random\_pcg64.cp310-win_amd64.pyd
%TEMP%\_mei24922\numpy\random\_philox.cp310-win_amd64.pyd
%TEMP%\_mei24922\numpy\random\_sfc64.cp310-win_amd64.pyd
%TEMP%\_mei24922\numpy\random\bit_generator.cp310-win_amd64.pyd
%TEMP%\_mei24922\numpy\random\mtrand.cp310-win_amd64.pyd
%TEMP%\_mei24922\psutil\_psutil_windows.pyd
%TEMP%\_mei24922\pyexpat.pyd
%TEMP%\_mei24922\python3.dll
%TEMP%\_mei24922\python310.dll
%TEMP%\_mei24922\pywin32_system32\pywintypes310.dll
%TEMP%\_mei24922\select.pyd
%TEMP%\_mei24922\sqlite3.dll
%TEMP%\_mei24922\unicodedata.pyd
%TEMP%\_mei24922\win32\win32pdh.pyd
%TEMP%\_mei24922\yaml\_yaml.cp310-win_amd64.pyd
%APPDATA%\windowsupdate.exe
%TEMP%\screenshot_v48j877hjv.png
%TEMP%\chrome_pass_v48j877hjv.db
%TEMP%\edge_pass_v48j877hjv.db
%TEMP%\chrome_history_v48j877hjv.db
%TEMP%\browser_history_v48j877hjv.txt
%TEMP%\desktop_contents_v48j877hjv.txt