Trojan.Siggen6.31887

Техническая информация

Для обеспечения автозапуска и распространения:

Изменяет следующие исполняемые системные файлы:

<SYSTEM32>\capesnpn.dll
<SYSTEM32>\csseqchk.dll
<SYSTEM32>\bthci.dll
<SYSTEM32>\comuid.dll
<SYSTEM32>\comrepl.dll
<SYSTEM32>\certmgr.dll
<SYSTEM32>\cc3250mt.dll
<SYSTEM32>\cfgmgr32.dll
<SYSTEM32>\avwav.dll
<SYSTEM32>\camocx.dll
<SYSTEM32>\cnetcfg.dll
<SYSTEM32>\appmgr.dll
<SYSTEM32>\6to4svc.dll
<SYSTEM32>\d3d8thk.dll
<SYSTEM32>\appmgmts.dll
<SYSTEM32>\blackbox.dll
<SYSTEM32>\batt.dll
<SYSTEM32>\cards.dll
<SYSTEM32>\avtapi.dll
<SYSTEM32>\acledit.dll
<SYSTEM32>\d3drm.dll
<SYSTEM32>\cc3290.dll
<SYSTEM32>\cygwin1.dll
<SYSTEM32>\cfgbkend.dll
<SYSTEM32>\cnvfat.dll
<SYSTEM32>\cewmdm.dll
<SYSTEM32>\atrace.dll
<SYSTEM32>\audiosrv.dll
<SYSTEM32>\adsnds.dll
<SYSTEM32>\cryptdlg.dll
<SYSTEM32>\d3dim.dll
<SYSTEM32>\browsewm.dll
<SYSTEM32>\asycfilt.dll
<SYSTEM32>\adsmsext.dll
<SYSTEM32>\atmlib.dll
<SYSTEM32>\atl100.dll
<SYSTEM32>\catsrvps.dll
<SYSTEM32>\asferror.dll
<SYSTEM32>\bitsprx3.dll
<SYSTEM32>\cdfview.dll
<SYSTEM32>\cmsetACL.dll
<SYSTEM32>\corpol.dll
<SYSTEM32>\comaddin.dll
<SYSTEM32>\catsrvut.dll
<SYSTEM32>\cmpbk32.dll
<SYSTEM32>\adsnt.dll
<SYSTEM32>\avmeter.dll
<SYSTEM32>\bitsprx2.dll
<SYSTEM32>\confmsp.dll
<SYSTEM32>\adsldp.dll
<SYSTEM32>\cdm.dll
<SYSTEM32>\avicap32.dll
<SYSTEM32>\cryptext.dll
<SYSTEM32>\aclui.dll
<SYSTEM32>\amstream.dll
<SYSTEM32>\cc3280.dll
<SYSTEM32>\aspnet_counters.dll
<SYSTEM32>\adptif.dll
<SYSTEM32>\adsnw.dll
<SYSTEM32>\apcups.dll
<SYSTEM32>\atkctrs.dll
<SYSTEM32>\cabinet.dll
<SYSTEM32>\comcat.dll
<SYSTEM32>\cc3290mt.dll
<SYSTEM32>\comsnap.dll
<SYSTEM32>\acctres.dll
<SYSTEM32>\cc3260.dll
<SYSTEM32>\cc3280mt.dll
<SYSTEM32>\browselc.dll
<SYSTEM32>\cc3260mt.dll
<SYSTEM32>\cc3270.dll
<SYSTEM32>\avifil32.dll
<SYSTEM32>\cryptnet.dll
<SYSTEM32>\ciodm.dll
<SYSTEM32>\console.dll
<SYSTEM32>\danim.dll
<SYSTEM32>\cdosys.dll
<SYSTEM32>\cmprops.dll
<SYSTEM32>\cabview.dll
<SYSTEM32>\alrsvc.dll
<SYSTEM32>\admparse.dll
<SYSTEM32>\bootvid.dll
<SYSTEM32>\dataclen.dll
<SYSTEM32>\btpanui.dll
<SYSTEM32>\cmdial32.dll
<SYSTEM32>\d3dxof.dll
<SYSTEM32>\d3dim700.dll
<SYSTEM32>\ciadmin.dll
<SYSTEM32>\d3d8.dll
<SYSTEM32>\d3dpmesh.dll
<SYSTEM32>\catsrv.dll
<SYSTEM32>\borlndmm.dll
<SYSTEM32>\cmcfg32.dll
<SYSTEM32>\atmpvcno.dll
<SYSTEM32>\aaaamon.dll
<SYSTEM32>\crtdll.dll
<SYSTEM32>\clb.dll
<SYSTEM32>\cliconfg.dll
<SYSTEM32>\bthserv.dll
<SYSTEM32>\compatUI.dll
<SYSTEM32>\cc3250.dll
<SYSTEM32>\autodisc.dll
<SYSTEM32>\advpack.dll
<SYSTEM32>\cmutil.dll
<SYSTEM32>\d3d9.dll
<SYSTEM32>\cic.dll
<SYSTEM32>\bidispl.dll
<SYSTEM32>\cc3270mt.dll
<SYSTEM32>\ccfgnt.dll
<SYSTEM32>\compstui.dll
<SYSTEM32>\ctl3d32.dll
<SYSTEM32>\d3dramp.dll
<SYSTEM32>\cdmodem.dll
<SYSTEM32>\clbcatex.dll

Заражает следующие исполняемые файлы:

<SYSTEM32>\aspnet_counters.dll
<SYSTEM32>\cc3280.dll
<SYSTEM32>\amstream.dll
<SYSTEM32>\aclui.dll
<SYSTEM32>\cryptext.dll
<SYSTEM32>\avicap32.dll
<SYSTEM32>\cdm.dll
<SYSTEM32>\confmsp.dll
<SYSTEM32>\bitsprx2.dll
<SYSTEM32>\adsnds.dll
<SYSTEM32>\adsldp.dll
<SYSTEM32>\adsnt.dll
<SYSTEM32>\cmpbk32.dll
<SYSTEM32>\catsrvut.dll
<SYSTEM32>\comaddin.dll
<SYSTEM32>\corpol.dll
<SYSTEM32>\cmsetACL.dll
<SYSTEM32>\cdfview.dll
<SYSTEM32>\bitsprx3.dll
<SYSTEM32>\asferror.dll
<SYSTEM32>\catsrvps.dll
<SYSTEM32>\atl100.dll
<SYSTEM32>\atmlib.dll
<SYSTEM32>\adsmsext.dll
<SYSTEM32>\asycfilt.dll
<SYSTEM32>\browsewm.dll
<SYSTEM32>\d3dim.dll
<SYSTEM32>\cryptdlg.dll
<SYSTEM32>\camocx.dll
<SYSTEM32>\cliconfg.dll
<SYSTEM32>\ciadmin.dll
<SYSTEM32>\cmcfg32.dll
<SYSTEM32>\compatUI.dll
<SYSTEM32>\cards.dll
<SYSTEM32>\d3drm.dll
<SYSTEM32>\aaaamon.dll
<SYSTEM32>\adsnw.dll
<SYSTEM32>\atkctrs.dll
<SYSTEM32>\cabview.dll
<SYSTEM32>\cc3260mt.dll
<SYSTEM32>\compstui.dll
<SYSTEM32>\cc3270mt.dll
<SYSTEM32>\d3dramp.dll
<SYSTEM32>\bthci.dll
<SYSTEM32>\capesnpn.dll
<SYSTEM32>\comuid.dll
<SYSTEM32>\appmgr.dll
<SYSTEM32>\avwav.dll
<SYSTEM32>\cfgmgr32.dll
<SYSTEM32>\cnetcfg.dll
<SYSTEM32>\audiosrv.dll
<SYSTEM32>\blackbox.dll
<SYSTEM32>\appmgmts.dll
<SYSTEM32>\cnvfat.dll
<SYSTEM32>\cfgbkend.dll
<SYSTEM32>\cygwin1.dll
<SYSTEM32>\cc3290.dll

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\wbem\wmiadap.exe' /R /T

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\x3q1w0q.dll
<SYSTEM32>\j5mvwz0.dll
<SYSTEM32>\gw8ftni.dll
<SYSTEM32>\gjqdgg5.dll
<SYSTEM32>\quvgiio.dll
<SYSTEM32>\wt0muwb.dll
<SYSTEM32>\jegz5vj.dll
<SYSTEM32>\etu1s19.dll
<SYSTEM32>\se9yn1z.dll
<SYSTEM32>\qd25xxk.dll
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\_filelst.cfg
<SYSTEM32>\f1svfki.dll
<SYSTEM32>\tv9ts6c.dll
<SYSTEM32>\r469rmw.dll
<SYSTEM32>\xdlh1ql.dll
<SYSTEM32>\t0000001.tmp
%TEMP%\t0000002.tmp
<SYSTEM32>\prsgrc.dll
<SYSTEM32>\clauth2.dll
<SYSTEM32>\rkdcy4a.dll
<SYSTEM32>\ssprs.dll
<SYSTEM32>\clauth1.dll
<SYSTEM32>\grcauth1.dll
<SYSTEM32>\lwwmant.dll
<SYSTEM32>\ipfrixy.dll
<SYSTEM32>\jpqm0i9.dll
<SYSTEM32>\x8efiz3.tgz
<SYSTEM32>\grcauth2.dll
<SYSTEM32>\cu0l4yl.dll
<SYSTEM32>\x8efiz3.dll