Trojan.PWS.Siggen5.34202

Техническая информация

Вредоносные функции

Внедряет код в

следующие системные процессы:

<SYSTEM32>\rundll32.exe

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%LOCALAPPDATA%\microsoft\edge\user data\default\login data
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\ovp25012015.doc
%APPDATA%\mozilla\firefox\profiles.ini
%HOMEPATH%\desktop\toolbar.bmp

Изменения в файловой системе

Создает следующие файлы

%TEMP%\~scr.tmp
%LOCALAPPDATA%4eef90857a83ce9e.tmp\chrome\local state
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\aoc_saq_d_v3_merchant.docx
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\applicantform_en.doc
%LOCALAPPDATA%4eef90857a83ce9e.tmp\chrome\passwords.txt
%TEMP%\hist_chrome.tmp
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\dashborder_120.bmp
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\dialmap.bmp
%LOCALAPPDATA%4eef90857a83ce9e.tmp\chrome\history.txt
%LOCALAPPDATA%4eef90857a83ce9e.tmp\edge\local state
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\fi51.doc
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\file_p_00000000_1371597592.docx
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\google chrome.lnk
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\hadac_newsletter_july_2010_final.docx
%TEMP%\login_data_edge.tmp
%LOCALAPPDATA%4eef90857a83ce9e.tmp\edge\passwords.txt
%TEMP%\hist_edge.tmp
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\hanni_umami_chapter.doc
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\holycrosschurchinstructions.docx
%LOCALAPPDATA%4eef90857a83ce9e.tmp\opera\local state
%LOCALAPPDATA%4eef90857a83ce9e.tmp\opera\passwords.txt
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\ovp25012015.doc
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\telegram.lnk
%LOCALAPPDATA%4eef90857a83ce9e.tmp\firefox\dnyauhh1.default-release\key4.db
%LOCALAPPDATA%4eef90857a83ce9e.tmp\firefox\dnyauhh1.default-release\cert9.db
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\toolbar.bmp
%LOCALAPPDATA%4eef90857a83ce9e.tmp\firefox\dnyauhh1.default-release\cookies.sqlite
%LOCALAPPDATA%4eef90857a83ce9e.tmp\firefox\dnyauhh1.default-release\places.sqlite
%LOCALAPPDATA%4eef90857a83ce9e.tmp\firefox\dnyauhh1.default-release\formhistory.sqlite
%LOCALAPPDATA%4eef90857a83ce9e.tmp\firefox\dnyauhh1.default-release\permissions.sqlite
%LOCALAPPDATA%4eef90857a83ce9e.tmp\firefox\dnyauhh1.default-release\extensions\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\.metadata-v2
%LOCALAPPDATA%4eef90857a83ce9e.tmp\firefox\dnyauhh1.default-release\extensions\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo....
%LOCALAPPDATA%4eef90857a83ce9e.tmp\sysinfo.txt
%LOCALAPPDATA%4eef90857a83ce9e.tmp\extras\screenshot.png
%LOCALAPPDATA%4eef90857a83ce9e.tmp\passwords.txt
%LOCALAPPDATA%4eef90857a83ce9e.tmp\state.txt
%LOCALAPPDATA%4eef90857a83ce9e.tmp\session.txt

Удаляет файлы, которые сам же создал

%TEMP%\hist_chrome.tmp
%TEMP%\login_data_edge.tmp
%TEMP%\hist_edge.tmp
%TEMP%\~scr.tmp
%LOCALAPPDATA%4eef90857a83ce9e.tmp\chrome\history.txt
%LOCALAPPDATA%4eef90857a83ce9e.tmp\chrome\local state
%LOCALAPPDATA%4eef90857a83ce9e.tmp\chrome\passwords.txt
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\aoc_saq_d_v3_merchant.docx
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\applicantform_en.doc
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\dashborder_120.bmp
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\dialmap.bmp
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\fi51.doc
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\file_p_00000000_1371597592.docx
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\google chrome.lnk
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\hadac_newsletter_july_2010_final.docx
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\hanni_umami_chapter.doc
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\holycrosschurchinstructions.docx
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\ovp25012015.doc
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\telegram.lnk
%LOCALAPPDATA%4eef90857a83ce9e.tmp\desktop\toolbar.bmp
%LOCALAPPDATA%4eef90857a83ce9e.tmp\edge\local state
%LOCALAPPDATA%4eef90857a83ce9e.tmp\edge\passwords.txt
%LOCALAPPDATA%4eef90857a83ce9e.tmp\extras\screenshot.png
%LOCALAPPDATA%4eef90857a83ce9e.tmp\firefox\dnyauhh1.default-release\cert9.db
%LOCALAPPDATA%4eef90857a83ce9e.tmp\firefox\dnyauhh1.default-release\cookies.sqlite
%LOCALAPPDATA%4eef90857a83ce9e.tmp\firefox\dnyauhh1.default-release\extensions\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\.metadata-v2
%LOCALAPPDATA%4eef90857a83ce9e.tmp\firefox\dnyauhh1.default-release\extensions\moz-extension+++dbda0cde-7d0a-4e53-a3f9-27dc54886ff6^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo....
%LOCALAPPDATA%4eef90857a83ce9e.tmp\firefox\dnyauhh1.default-release\formhistory.sqlite
%LOCALAPPDATA%4eef90857a83ce9e.tmp\firefox\dnyauhh1.default-release\key4.db
%LOCALAPPDATA%4eef90857a83ce9e.tmp\firefox\dnyauhh1.default-release\permissions.sqlite
%LOCALAPPDATA%4eef90857a83ce9e.tmp\firefox\dnyauhh1.default-release\places.sqlite
%LOCALAPPDATA%4eef90857a83ce9e.tmp\opera\local state
%LOCALAPPDATA%4eef90857a83ce9e.tmp\opera\passwords.txt
%LOCALAPPDATA%4eef90857a83ce9e.tmp\passwords.txt
%LOCALAPPDATA%4eef90857a83ce9e.tmp\session.txt
%LOCALAPPDATA%4eef90857a83ce9e.tmp\state.txt
%LOCALAPPDATA%4eef90857a83ce9e.tmp\sysinfo.txt

Сетевая активность

Подключается к

'31.#6.10.48':9090

TCP

Запросы HTTP GET

Запросы HTTP POST

http://31.##.10.48:9090/api/backup/upload via 31.#6.10.48

Другое

Запускает на исполнение

'<SYSTEM32>\rundll32.exe' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c wmic cpu get Name /value (со скрытым окном)
'<SYSTEM32>\wbem\wmic.exe' cpu get Name /value
'<SYSTEM32>\cmd.exe' /c wmic ComputerSystem get TotalPhysicalMemory /value (со скрытым окном)
'<SYSTEM32>\wbem\wmic.exe' ComputerSystem get TotalPhysicalMemory /value
'<SYSTEM32>\cmd.exe' /c wmic path win32_VideoController get Name /value (со скрытым окном)
'<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get Name /value