Trojan.Siggen32.46315

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\rarsfx0\cybermania.url
%TEMP%\rarsfx0\32.exe
%TEMP%\rarsfx0\keygen.7z
%TEMP%\rarsfx0\64.exe
%TEMP%\rarsfx0\resizer-server.exe
%TEMP%\rarsfx0\32or64.cmd
%TEMP%\rarsfx0\x86x64.7z
%TEMP%\nszef58.tmp
%TEMP%\nsoef68.tmp\system.dll
%ProgramFiles%\im-magic\partition resizer\core.dll
%ProgramFiles%\im-magic\partition resizer\core2.dll
%ProgramFiles%\im-magic\partition resizer\languages\arj.lng
%ProgramFiles%\im-magic\partition resizer\languages\bgr.lng
%ProgramFiles%\im-magic\partition resizer\languages\cat.lng
%ProgramFiles%\im-magic\partition resizer\languages\chs.lng
%ProgramFiles%\im-magic\partition resizer\languages\cht.lng
%ProgramFiles%\im-magic\partition resizer\languages\csy.lng
%ProgramFiles%\im-magic\partition resizer\languages\deu.lng
%ProgramFiles%\im-magic\partition resizer\languages\ell.lng
%ProgramFiles%\im-magic\partition resizer\languages\eng.lng
%ProgramFiles%\im-magic\partition resizer\languages\esp.lng
%ProgramFiles%\im-magic\partition resizer\languages\fin.lng
%ProgramFiles%\im-magic\partition resizer\languages\fra.lng
%ProgramFiles%\im-magic\partition resizer\languages\heb.lng
%ProgramFiles%\im-magic\partition resizer\languages\hrv.lng
%ProgramFiles%\im-magic\partition resizer\languages\hun.lng
%ProgramFiles%\im-magic\partition resizer\languages\ita.lng
%ProgramFiles%\im-magic\partition resizer\languages\jpn.lng
%ProgramFiles%\im-magic\partition resizer\languages\kor.lng
%ProgramFiles%\im-magic\partition resizer\languages\nld.lng
%ProgramFiles%\im-magic\partition resizer\languages\nor.lng
%ProgramFiles%\im-magic\partition resizer\languages\plk.lng
%ProgramFiles%\im-magic\partition resizer\languages\ptg.lng
%ProgramFiles%\im-magic\partition resizer\languages\rom.lng
%ProgramFiles%\im-magic\partition resizer\languages\rus.lng
%ProgramFiles%\im-magic\partition resizer\languages\slv.lng
%ProgramFiles%\im-magic\partition resizer\languages\sve.lng
%ProgramFiles%\im-magic\partition resizer\languages\trk.lng
%ProgramFiles%\im-magic\partition resizer\languages\ukr.lng
%ProgramFiles%\im-magic\partition resizer\dm.api
%ProgramFiles%\im-magic\partition resizer\dm.resizer.exe
%ProgramFiles%\im-magic\partition resizer\serv.api
%ProgramFiles%\im-magic\partition resizer\website.url
%APPDATA%\microsoft\windows\start menu\programs\im-magic partition resizer server\website.lnk
%APPDATA%\microsoft\windows\start menu\programs\im-magic partition resizer server\uninstall.lnk
%APPDATA%\microsoft\windows\start menu\programs\im-magic partition resizer server\im-magic partition resizer server.lnk
%HOMEPATH%\desktop\im-magic partition resizer server.lnk
%ProgramFiles%\im-magic\partition resizer\uninst.exe
%ProgramFiles%\im-magic\partition resizer\impr.lkeys
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a1ccb6f-14d0.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a1ccb73-1354.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3351369d6616fd1e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f6b2e04d03c656dc_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5610223cb6087d2f_0
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000004
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000004.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9e5c59d5a0eec716_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f8deeab672257e1f_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\99a566994112de1e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\060a09b50906ca92_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7f43a816b2242666_0
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6019b090dc496db5_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3db514d3bf00d878_0
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
%TEMP%\af0cdd19-acd9-468e-a99c-0039a5c2ee43.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3ec64e4490b09fe1_0
%LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
%LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000c
%LOCALAPPDATA%\microsoft\edge\user data\default\entityextraction\extractable_domains.pb
%LOCALAPPDATA%\microsoft\edge\user data\default\entityextraction\domains_config.json

Присваивает атрибут 'скрытый' для следующих файлов

%ProgramFiles%\im-magic\partition resizer\serv.api

Удаляет файлы, которые сам же создал

%TEMP%\nsoef68.tmp\system.dll
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a1ccb6f-14d0.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a1ccb73-1354.pma
%TEMP%\edge_bits_4948_932721265\01f25ed6-a822-49f8-87db-59f5a6eed3ac

Перемещает следующие файлы

%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\current
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current

Изменяет следующие файлы

%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\visited links
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
%LOCALAPPDATA%\microsoft\edge\user data\last browser
%LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\history
%TEMP%\.ses
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons

Подменяет следующие файлы

%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\BudgetDatabase\LOG

Сетевая активность

Подключается к

'co####.edge.skype.com':443
'cy###mania.ws':80
'cy###mania.ws':443
'go#####agmanager.com':443
'dr#######bidk.cloudfront.net':443
'cr#.####g2.amazontrust.com':80
'st####e.ko-fi.com':443
'st####.##oudflareinsights.com':443
'x.##2.us':80
'gd.###checarib.com':443
'x1.#.lencr.org':80
'ou#####tobeconsist.org':443
'gh####ethec.info':443
'yr####efurther.org':443
'nd####eensoa.org':443
'uk####ngwithea.com':443
'fa###ook.com':443
'accounts.google.com':443
'a###ytics.google.com':443
'pa#####.#ooglesyndication.com':443
'go##le.ru':443
'a.###.#loudflare.com':443

TCP

Запросы HTTP GET

http://cy###mania.ws/
http://cr#.####g2.amazontrust.com/rootg2.cer
http://x.##2.us/x.cer
http://x1.#.lencr.org/

Другие

'co####.edge.skype.com':443
'cy###mania.ws':443
'go#####agmanager.com':443
'dr#######bidk.cloudfront.net':443
'st####e.ko-fi.com':443
'st####.##oudflareinsights.com':443
'gd.###checarib.com':443
'ou#####tobeconsist.org':443
'gh####ethec.info':443
'yr####efurther.org':443
'nd####eensoa.org':443
'uk####ngwithea.com':443
'fa###ook.com':443
'accounts.google.com':443
'a###ytics.google.com':443
'pa#####.#ooglesyndication.com':443
'go##le.ru':443
'a.###.#loudflare.com':443

UDP

DNS ASK co####.edge.skype.com
DNS ASK cy###mania.ws
DNS ASK fo###.#oogleapis.com
DNS ASK go#####agmanager.com
DNS ASK dr#######bidk.cloudfront.net
DNS ASK cr#.####g2.amazontrust.com
DNS ASK gd.###checarib.com
DNS ASK st####e.ko-fi.com
DNS ASK st####.##oudflareinsights.com
DNS ASK x.##2.us
DNS ASK x1.#.lencr.org
DNS ASK ou#####tobeconsist.org
DNS ASK yr####efurther.org
DNS ASK gh####ethec.info
DNS ASK nd####eensoa.org
DNS ASK uk####ngwithea.com
DNS ASK di##ord.gg
DNS ASK pa##al.me
DNS ASK t.#e
DNS ASK yo##ube.com
DNS ASK fa###ook.com
DNS ASK accounts.google.com
DNS ASK a###ytics.google.com
DNS ASK st###.#.doubleclick.net
DNS ASK go##le.ru
DNS ASK pa#####.#ooglesyndication.com
DNS ASK a.###.#loudflare.com

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'

Создает и запускает на исполнение

'%TEMP%\rarsfx0\resizer-server.exe' /S
'%TEMP%\rarsfx0\64.exe'

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\32or64.cmd" " (со скрытым окном)
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://cybermania.ws/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate http://cybermania.ws/ (со скрытым окном)
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,15381291707974839860,2817855031140007569,131072 --lang=en-US --service-sandbox-type=none --mojo-...

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней