Trojan.Siggen2.40967

Техническая информация

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/1999" -f *+0:1999:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/520" -f *+0:520:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/2001" -f *+0:2001:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/2583" -f *+0:2583:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/2023" -f *+0:2023:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/23" -f *+0:23:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block UDP/53" -f *+0:53:UDP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/79" -f *+0:79:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/53" -f *+0:53:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/808" -f *+0:808:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/707" -f *+0:707:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/3389" -f *+0:3389:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/6671" -f *+0:6671:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/660" -f *+0:660:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/6939" -f *+0:6939:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/7511" -f *+0:7511:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/7306" -f *+0:7306:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/6267" -f *+0:6267:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/4899" -f *+0:4899:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/4444" -f *+0:4444:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/5800" -f *+0:5800:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/8888" -f *+0:8888:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/5900" -f *+0:5900:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/113" -f *+0:113:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block UDP/445" -f *+0:445:UDP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/445" -f *+0:445:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/1025" -f *+0:1025:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/1068" -f *+0:1068:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block UDP/139" -f *+0:139:UDP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block UDP/135" -f *+0:135:UDP -n BLOCK -x
<SYSTEM32>\gpupdate.exe
<SYSTEM32>\cmd.exe /c """%TEMP%\ CMD9DD1.CMD"""
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -o -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/135" -f *+0:135:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/5554" -f *+0:5554:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/3996" -f *+0:3996:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/1092" -f *+0:1092:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/4060" -f *+0:4060:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/1080" -f *+0:1080:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/4590" -f *+0:4590:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/20034" -f *+0:20034:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/9996" -f *+0:9996:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/9995" -f *+0:9995:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/6129" -f *+0:6129:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block TCP/43958" -f *+0:43958:TCP -n BLOCK -x
<SYSTEM32>\ipconfig.exe -w REG -p "HFUT_SECU" -r "Block ICMP/255" -f *+0:255:ICMP -n BLOCK -x