Trojan.Siggen9.11870

Technical Information

Modifies file system

Creates the following files

%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\apbin\config.ini
<DRIVERS>\rtspd652.rra
%ProgramFiles(x86)%\realtek\realtek card reader\rtspd519.rra
%ProgramFiles(x86)%\realtek\realtek card reader\rtspd4fa.rra
%ProgramFiles(x86)%\realtek\realtek card reader\rtspd4db.rra
%ProgramFiles(x86)%\realtek\realtek card reader\revcd4db.rra
%ProgramFiles(x86)%\realtek\realtek card reader\rscrd4bc.rra
%ProgramFiles(x86)%\realtek\realtek card reader\ricod46d.rra
%ProgramFiles(x86)%\realtek\realtek card reader\confd661.rra
%TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\_isrd102.rra
%TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\isrtd0f3.rra
%TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\strid0e3.rra
%TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\isbed0d4.rra
%TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\vasdd0d4.rra
%TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\difxd0d4.rra
%TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\fontd0d4.rra
%TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\dotnd0c4.rra
%TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\defad0f3.rra
%ProgramFiles(x86)%\realtek\realtek card reader\dispd661.rra
%ProgramFiles(x86)%\realtek\realtek card reader\rmbcd671.rra
%ProgramFiles(x86)%\realtek\realtek card reader\rmbcd6b0.rra
%WINDIR%\syswow64\sda\sdrt26f2.rra
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
%TEMP%\{2a73d4e4-f68c-7a93-6a5a-cf1f4c5f5877}\sete43f.tmp
%TEMP%\{2a73d4e4-f68c-7a93-6a5a-cf1f4c5f5877}\sete373.tmp
%TEMP%\{2a73d4e4-f68c-7a93-6a5a-cf1f4c5f5877}\sete259.tmp
%TEMP%\{2a73d4e4-f68c-7a93-6a5a-cf1f4c5f5877}\sete14e.tmp
%ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\setud875.rra
%ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\issed855.rra
%ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\_setd846.rra
%ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\setud836.rra
%ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\datad7d8.rra
%ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\layod7c9.rra
%ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\pkgcd70d.rra
%ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\usetd70d.rra
%ProgramFiles(x86)%\realtek\realtek card reader\thumd6ee.rra
%ProgramFiles(x86)%\realtek\realtek card reader\seted6ee.rra
%ProgramFiles(x86)%\realtek\realtek card reader\sdrtd6de.rra
%TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\cored0c4.rra
%ProgramFiles(x86)%\realtek\realtek card reader\rmb.log
%TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\setud0b4.rra
%TEMP%\{394d754e-c519-4517-abdd-c682ef5853f3}\setup.ini
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\u2setup.iss
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\setup.iss
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\setup.inx
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\setup.ini
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\readme.txt
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\pkgconfig.ini
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\layout.bin
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\u3setup.iss
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\driverbin_64bit\rtsper64.cat
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\driverbin_32bit\rtsper32.cat
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\driverbin_32bit\rtsper.inf
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\data2.cab
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\data1.hdr
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\data1.cab
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\apbin\thumbs.db
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\apbin\displayicon.ico
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\driverbin_64bit\rtsper.inf
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\usetup.iss
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\apbin\rmbchange_pcie.exe
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\apbin\rmbchange_usb.exe
%TEMP%\{394d754e-c519-4517-abdd-c682ef5853f3}\_setup.dll
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\_setup.dll
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\setup.exe
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\issetup.dll
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\driverbin_64bit\rtspericon.dll
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\driverbin_64bit\rtsper.sys
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\driverbin_64bit\revcon.exe
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\driverbin_32bit\sdrtcprm.dll
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\driverbin_32bit\rtspericon.dll
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\driverbin_32bit\rtsper.sys
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\driverbin_32bit\revcon.exe
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\apbin_64bit\rscrlib.dll
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\apbin_64bit\riconman.exe
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\apbin_32bit\rscrlib.dll
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\apbin_32bit\riconman.exe
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\apbin\setehcikey.exe
%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\apbin\sdrtcprm.dll
%TEMP%\d037.rra
%ProgramFiles(x86)%\realtek\realtek card reader\config.ini

Sets the 'hidden' attribute to the following files

<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat

Deletes the following files

%TEMP%\{2a73d4e4-f68c-7a93-6a5a-cf1f4c5f5877}\rtsper.inf
%TEMP%\{2a73d4e4-f68c-7a93-6a5a-cf1f4c5f5877}\rtsper.sys
%TEMP%\{2a73d4e4-f68c-7a93-6a5a-cf1f4c5f5877}\rtsper64.cat
%TEMP%\{2a73d4e4-f68c-7a93-6a5a-cf1f4c5f5877}\rtspericon.dll

Moves the following files

from %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\setud0b4.rra to %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\setup.inx
from %ProgramFiles(x86)%\realtek\realtek card reader\rmbcd6b0.rra to %ProgramFiles(x86)%\realtek\realtek card reader\rmbchange_usb.exe
from %ProgramFiles(x86)%\realtek\realtek card reader\sdrtd6de.rra to %ProgramFiles(x86)%\realtek\realtek card reader\sdrtcprm.dll
from %ProgramFiles(x86)%\realtek\realtek card reader\seted6ee.rra to %ProgramFiles(x86)%\realtek\realtek card reader\setehcikey.exe
from %ProgramFiles(x86)%\realtek\realtek card reader\thumd6ee.rra to %ProgramFiles(x86)%\realtek\realtek card reader\thumbs.db
from %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\usetd70d.rra to %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\usetup.iss
from %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\pkgcd70d.rra to %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\pkgconfig.ini
from %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\layod7c9.rra to %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\layout.bin
from %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\datad7d8.rra to %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\data1.hdr
from %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\datad7d8.rra to %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\data1.cab
from %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\setud836.rra to %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\setup.exe
from %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\_setd846.rra to %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\_setup.dll
from %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\issed855.rra to %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\issetup.dll
from %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\setud875.rra to %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\setup.inx
from %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\setud875.rra to %ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\setup.ini
from %TEMP%\{2a73d4e4-f68c-7a93-6a5a-cf1f4c5f5877}\sete14e.tmp to %TEMP%\{2a73d4e4-f68c-7a93-6a5a-cf1f4c5f5877}\rtsper.inf
from %TEMP%\{2a73d4e4-f68c-7a93-6a5a-cf1f4c5f5877}\sete259.tmp to %TEMP%\{2a73d4e4-f68c-7a93-6a5a-cf1f4c5f5877}\rtsper.sys
from %TEMP%\{2a73d4e4-f68c-7a93-6a5a-cf1f4c5f5877}\sete373.tmp to %TEMP%\{2a73d4e4-f68c-7a93-6a5a-cf1f4c5f5877}\rtsper64.cat
from %ProgramFiles(x86)%\realtek\realtek card reader\rmbcd671.rra to %ProgramFiles(x86)%\realtek\realtek card reader\rmbchange_pcie.exe
from %TEMP%\{2a73d4e4-f68c-7a93-6a5a-cf1f4c5f5877}\sete43f.tmp to %TEMP%\{2a73d4e4-f68c-7a93-6a5a-cf1f4c5f5877}\rtspericon.dll
from %ProgramFiles(x86)%\realtek\realtek card reader\dispd661.rra to %ProgramFiles(x86)%\realtek\realtek card reader\displayicon.ico
from <DRIVERS>\rtspd652.rra to <DRIVERS>\rtsper.sys
from %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\cored0c4.rra to %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\corecomp.ini
from %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\dotnd0c4.rra to %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\dotnetinstaller.exe
from %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\fontd0d4.rra to %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\fontdata.ini
from %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\difxd0d4.rra to %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\difxdata.ini
from %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\vasdd0d4.rra to %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\vasdata.ini
from %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\isbed0d4.rra to %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\isbew64.exe
from %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\strid0e3.rra to %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\stringtable-0009-english.ips
from %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\isrtd0f3.rra to %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\isrt.dll
from %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\defad0f3.rra to %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\default.pal
from %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\_isrd102.rra to %TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\_isres.dll
from %ProgramFiles(x86)%\realtek\realtek card reader\ricod46d.rra to %ProgramFiles(x86)%\realtek\realtek card reader\riconman.exe
from %ProgramFiles(x86)%\realtek\realtek card reader\rscrd4bc.rra to %ProgramFiles(x86)%\realtek\realtek card reader\rscrlib.dll
from %ProgramFiles(x86)%\realtek\realtek card reader\revcd4db.rra to %ProgramFiles(x86)%\realtek\realtek card reader\revcon.exe
from %ProgramFiles(x86)%\realtek\realtek card reader\rtspd4db.rra to %ProgramFiles(x86)%\realtek\realtek card reader\rtsper.inf
from %ProgramFiles(x86)%\realtek\realtek card reader\rtspd4fa.rra to %ProgramFiles(x86)%\realtek\realtek card reader\rtsper.sys
from %ProgramFiles(x86)%\realtek\realtek card reader\rtspd519.rra to %ProgramFiles(x86)%\realtek\realtek card reader\rtsper64.cat
from %ProgramFiles(x86)%\realtek\realtek card reader\rtspd519.rra to %ProgramFiles(x86)%\realtek\realtek card reader\rtspericon.dll
from %ProgramFiles(x86)%\realtek\realtek card reader\confd661.rra to %ProgramFiles(x86)%\realtek\realtek card reader\config.ini
from %WINDIR%\syswow64\sda\sdrt26f2.rra to %WINDIR%\syswow64\sda\sdrtcprm.dll

Substitutes the following files

%ProgramFiles(x86)%\realtek\realtek card reader\rtspd519.rra
%ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\datad7d8.rra
%ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\setud875.rra
%ProgramFiles(x86)%\installshield installation information\{f0a8bf4a-972f-41e0-9800-1efe3bf28266}\setup.ini

Miscellaneous

Creates and executes the following

'%TEMP%\7zs4894e5ef\rtsper_6.2.9200.21232_xpw7w8_whql_20130606\setup.exe'
'%ProgramFiles(x86)%\realtek\realtek card reader\revcon.exe' RS_remove PCI\VEN_10EC&DEV_5227&CC_FF00
'%ProgramFiles(x86)%\realtek\realtek card reader\revcon.exe' RS_dp_add RtsPer.inf
'%ProgramFiles(x86)%\realtek\realtek card reader\revcon.exe' RS_update RtsPer.inf PCI\VEN_10EC&DEV_5227&CC_FF00
'%ProgramFiles(x86)%\realtek\realtek card reader\rmbchange_usb.exe' /install
'%TEMP%\{c1794533-7388-4671-90ee-5f81030895a9}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B867B829-63D3-479D-A3F8-44E35F9D085D}
'%ProgramFiles(x86)%\realtek\realtek card reader\revcon.exe' RS_update RtsPer.inf PCI\VEN_10EC&DEV_5249&CC_FF00
'%ProgramFiles(x86)%\realtek\realtek card reader\rmbchange_pcie.exe' /install
'%ProgramFiles(x86)%\realtek\realtek card reader\revcon.exe' RS_remove PCI\VEN_10EC&DEV_5249&CC_FF00
'%ProgramFiles(x86)%\realtek\realtek card reader\revcon.exe' RS_update RtsPer.inf PCI\VEN_10EC&DEV_5287&CC_FF00
'%ProgramFiles(x86)%\realtek\realtek card reader\revcon.exe' RS_remove PCI\VEN_10EC&DEV_5287&CC_FF00
'%ProgramFiles(x86)%\realtek\realtek card reader\revcon.exe' RS_dp_add RtsPer.inf' (with hidden window)
'%ProgramFiles(x86)%\realtek\realtek card reader\revcon.exe' RS_update RtsPer.inf PCI\VEN_10EC&DEV_5287&CC_FF00' (with hidden window)
'%ProgramFiles(x86)%\realtek\realtek card reader\rmbchange_usb.exe' /install' (with hidden window)
'%ProgramFiles(x86)%\realtek\realtek card reader\revcon.exe' RS_remove PCI\VEN_10EC&DEV_5287&CC_FF00' (with hidden window)
'%ProgramFiles(x86)%\realtek\realtek card reader\revcon.exe' RS_update RtsPer.inf PCI\VEN_10EC&DEV_5249&CC_FF00' (with hidden window)
'%ProgramFiles(x86)%\realtek\realtek card reader\revcon.exe' RS_remove PCI\VEN_10EC&DEV_5249&CC_FF00' (with hidden window)
'%ProgramFiles(x86)%\realtek\realtek card reader\revcon.exe' RS_remove PCI\VEN_10EC&DEV_5227&CC_FF00' (with hidden window)
'%ProgramFiles(x86)%\realtek\realtek card reader\revcon.exe' RS_update RtsPer.inf PCI\VEN_10EC&DEV_5227&CC_FF00' (with hidden window)
'%ProgramFiles(x86)%\realtek\realtek card reader\rmbchange_pcie.exe' /install' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней