Trojan.Siggen32.60614

Техническая информация

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\microsoft\edge\user data\default\login data

Изменения в файловой системе

Создает следующие файлы

%TEMP%\_mei25882\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
%TEMP%\_mei25882\vcruntime140.dll
%TEMP%\_mei25882\vcruntime140_1.dll
%TEMP%\_mei25882\_asyncio.pyd
%TEMP%\_mei25882\_bz2.pyd
%TEMP%\_mei25882\_cffi_backend.cp314-win_amd64.pyd
%TEMP%\_mei25882\_ctypes.pyd
%TEMP%\_mei25882\_decimal.pyd
%TEMP%\_mei25882\_hashlib.pyd
%TEMP%\_mei25882\_lzma.pyd
%TEMP%\_mei25882\_multiprocessing.pyd
%TEMP%\_mei25882\_overlapped.pyd
%TEMP%\_mei25882\_queue.pyd
%TEMP%\_mei25882\_socket.pyd
%TEMP%\_mei25882\_sqlite3.pyd
%TEMP%\_mei25882\_ssl.pyd
%TEMP%\_mei25882\_wmi.pyd
%TEMP%\_mei25882\_zstd.pyd
%TEMP%\_mei25882\base_library.zip
%TEMP%\_mei25882\certifi\cacert.pem
%TEMP%\_mei25882\charset_normalizer\cd.cp314-win_amd64.pyd
%TEMP%\_mei25882\charset_normalizer\md.cp314-win_amd64.pyd
%TEMP%\_mei25882\cryptography-49.0.0.dist-info\installer
%TEMP%\_mei25882\cryptography-49.0.0.dist-info\metadata
%TEMP%\_mei25882\cryptography-49.0.0.dist-info\record
%TEMP%\_mei25882\cryptography-49.0.0.dist-info\wheel
%TEMP%\_mei25882\cryptography-49.0.0.dist-info\licenses\license
%TEMP%\_mei25882\cryptography-49.0.0.dist-info\licenses\license.apache
%TEMP%\_mei25882\cryptography-49.0.0.dist-info\licenses\license.bsd
%TEMP%\_mei25882\cryptography-49.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
%TEMP%\_mei25882\cryptography-49.0.0.dist-info\sboms\sbom.json
%TEMP%\_mei25882\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei25882\libcrypto-3.dll
%TEMP%\_mei25882\libffi-8.dll
%TEMP%\_mei25882\libssl-3.dll
%TEMP%\_mei25882\pyexpat.pyd
%TEMP%\_mei25882\python3.dll
%TEMP%\_mei25882\python314.dll
%TEMP%\_mei25882\select.pyd
%TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
%TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
%TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
%TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
%TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
%TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
%TEMP%\_mei25882\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei25882\sqlite3.dll
%TEMP%\_mei25882\unicodedata.pyd
%TEMP%\wuauclt.bat
nul
%TEMP%\cook_chrome_tmp.db
%TEMP%\br_chrome_tmp.db
%TEMP%\br_edge_tmp.db

Удаляет файлы, которые сам же создал

%TEMP%\wuauclt.bat
%TEMP%\_mei25882\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
%TEMP%\_mei25882\certifi\cacert.pem
%TEMP%\_mei25882\charset_normalizer\cd.cp314-win_amd64.pyd
%TEMP%\_mei25882\charset_normalizer\md.cp314-win_amd64.pyd
%TEMP%\_mei25882\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei25882\cryptography-49.0.0.dist-info\installer
%TEMP%\_mei25882\cryptography-49.0.0.dist-info\licenses\license
%TEMP%\_mei25882\cryptography-49.0.0.dist-info\licenses\license.apache
%TEMP%\_mei25882\cryptography-49.0.0.dist-info\licenses\license.bsd
%TEMP%\_mei25882\cryptography-49.0.0.dist-info\metadata
%TEMP%\_mei25882\cryptography-49.0.0.dist-info\record
%TEMP%\_mei25882\cryptography-49.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
%TEMP%\_mei25882\cryptography-49.0.0.dist-info\sboms\sbom.json
%TEMP%\_mei25882\cryptography-49.0.0.dist-info\wheel
%TEMP%\_mei25882\libcrypto-3.dll
%TEMP%\_mei25882\libffi-8.dll
%TEMP%\_mei25882\libssl-3.dll
%TEMP%\_mei25882\pyexpat.pyd
%TEMP%\_mei25882\python3.dll
%TEMP%\_mei25882\python314.dll
%TEMP%\_mei25882\select.pyd
%TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
%TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
%TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
%TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
%TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
%TEMP%\_mei25882\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
%TEMP%\_mei25882\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei25882\sqlite3.dll
%TEMP%\_mei25882\unicodedata.pyd
%TEMP%\_mei25882\vcruntime140.dll
%TEMP%\_mei25882\vcruntime140_1.dll
%TEMP%\_mei25882\_asyncio.pyd
%TEMP%\_mei25882\_bz2.pyd
%TEMP%\_mei25882\_cffi_backend.cp314-win_amd64.pyd
%TEMP%\_mei25882\_ctypes.pyd
%TEMP%\_mei25882\_decimal.pyd
%TEMP%\_mei25882\_hashlib.pyd
%TEMP%\_mei25882\_lzma.pyd
%TEMP%\_mei25882\_multiprocessing.pyd
%TEMP%\_mei25882\_overlapped.pyd
%TEMP%\_mei25882\_queue.pyd
%TEMP%\_mei25882\_socket.pyd
%TEMP%\_mei25882\_sqlite3.pyd
%TEMP%\_mei25882\_ssl.pyd
%TEMP%\_mei25882\_wmi.pyd
%TEMP%\_mei25882\_zstd.pyd
%TEMP%\cook_chrome_tmp.db
%TEMP%\br_chrome_tmp.db
%TEMP%\br_edge_tmp.db