Trojan.Siggen21.2964

Technical Information

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /im "ReiSpacer71.exe" /f

Modifies file system

Creates the following files

%TEMP%\is-6f2d7.tmp\is-cch4b.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-mfi93.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-fr7mu.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-frjfi.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-or3q4.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-q4rf9.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-sni1i.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-p4lv2.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-gbdbe.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-08p2b.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-vpa63.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-9ojo6.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-k9s88.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-bakja.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-v2uup.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-1tsm4.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-pii2r.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-q2ink.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-8p15r.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-l284u.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-e9e7r.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-j307u.tmp
%ProgramFiles(x86)%\reispacer71\unins000.dat
%ProgramFiles(x86)%\reispacer71\is-sbkth.tmp
%ProgramFiles(x86)%\reispacer71\is-0auu4.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-pvo63.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-l5tnb.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-2opfr.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-9ve9j.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-2mvdp.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-vv2i9.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-u15c7.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-pk272.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-0f32m.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-orovr.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-hn2lu.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-lc1gq.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-7p9a1.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-id0ka.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-4nm47.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-5v552.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-a3n84.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-ce7c3.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-32ehe.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-3nk35.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-0e9hh.tmp
%ProgramFiles(x86)%\reispacer71\is-7i4cq.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-ikq1d.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-os7t3.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-o9mef.tmp
%ProgramFiles(x86)%\reispacer71\config\is-6t32d.tmp
%ProgramFiles(x86)%\reispacer71\config\is-vn9p1.tmp
%ProgramFiles(x86)%\reispacer71\config\is-9b00k.tmp
%ProgramFiles(x86)%\reispacer71\config\is-nh5s8.tmp
%ProgramFiles(x86)%\reispacer71\config\is-bq1i0.tmp
%ProgramFiles(x86)%\reispacer71\is-41bp7.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-b4uth.tmp
%ProgramFiles(x86)%\reispacer71\is-46d0v.tmp
%ProgramFiles(x86)%\reispacer71\is-2603i.tmp
%ProgramFiles(x86)%\reispacer71\is-rjrra.tmp
%ProgramFiles(x86)%\reispacer71\is-h2dhh.tmp
%TEMP%\is-k118q.tmp\_isetup\_iscrypt.dll
%TEMP%\is-k118q.tmp\_isetup\_shfoldr.dll
%TEMP%\is-k118q.tmp\_isetup\_setup64.tmp
%TEMP%\is-k118q.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\reispacer71\reispacer71.exe
%ProgramFiles(x86)%\reispacer71\skins\blue\is-s6rt2.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-biv3c.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-r82si.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-fu2v7.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-adqhf.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-sd1ea.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-04jr4.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-ff8m4.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-2589c.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-kisnm.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-j30oq.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-2k6bs.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-5u6r4.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-d96fr.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-jp79e.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-4n3f0.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-j2r5v.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-r2at0.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-nlre8.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-jirvo.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-ej2t4.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-r7e9e.tmp
%ProgramFiles(x86)%\reispacer71\skins\blue\is-7r92e.tmp
%APPDATA%\{846ee340-7039-11de-9d20-806e6f6e6963}\akuzf16bnvykr.exe

Deletes the following files

%ProgramFiles(x86)%\reispacer71\readme.txt
%TEMP%\is-6f2d7.tmp\is-cch4b.tmp
%ProgramFiles(x86)%\reispacer71\reispacer71.exe

Moves the following files

from %ProgramFiles(x86)%\reispacer71\is-h2dhh.tmp to %ProgramFiles(x86)%\reispacer71\unins000.exe
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-frjfi.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\label.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-or3q4.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\info_usual.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-q4rf9.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\info_hover.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-sni1i.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\info_disabled.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-p4lv2.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\hvost.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-gbdbe.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\gradient_vert.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-l284u.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\gradient_horiz.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-fr7mu.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\label_a_1.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-ce7c3.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\fon_statistic_hover.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-k9s88.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\fon.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-bakja.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\edit_usual.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-v2uup.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\edit_hover.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-1tsm4.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\edit_disabled.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-pii2r.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\delete_usual.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-q2ink.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\delete_hover.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-8p15r.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\delete_disabled.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-9ojo6.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\fon_statistic.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-mfi93.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\label_a_2.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-vpa63.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\label_sel.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-08p2b.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\leftandright.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-l5tnb.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\unselect_disabled.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-2opfr.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\ugol_left_top.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-9ve9j.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\ugol2_right_top.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-2mvdp.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\ugol2_right_bottom.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-vv2i9.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\ugol2_left_top.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-u15c7.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\ugol2_left_bottom.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-pk272.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\topanddown2.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-0f32m.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\topanddown.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-orovr.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\select_usual.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-hn2lu.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\select_hover.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-lc1gq.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\select_disabled.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-7p9a1.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\progress.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-id0ka.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\point3.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-4nm47.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\point2.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-5v552.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\point.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-s6rt2.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\logo.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-j307u.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\leftandright2.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-a3n84.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btn_ok_usual.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-pvo63.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\unselect_hover.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-32ehe.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btn_ok_hover.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-0e9hh.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btn_cancel_hover.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-biv3c.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btncleanstop_hover.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-b4uth.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnabout_usual.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-fu2v7.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnabout_hover.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-ikq1d.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnabout_disabled.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-os7t3.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\add_usual.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-o9mef.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\add_hover.jpg
from %ProgramFiles(x86)%\reispacer71\config\is-6t32d.tmp to %ProgramFiles(x86)%\reispacer71\config\usrtempdirs.dat
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-e9e7r.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btncleanstop_usual.jpg
from %ProgramFiles(x86)%\reispacer71\config\is-vn9p1.tmp to %ProgramFiles(x86)%\reispacer71\config\settings.dat
from %ProgramFiles(x86)%\reispacer71\config\is-nh5s8.tmp to %ProgramFiles(x86)%\reispacer71\config\exclusions.dat
from %ProgramFiles(x86)%\reispacer71\config\is-bq1i0.tmp to %ProgramFiles(x86)%\reispacer71\config\exclusiondirs.dat
from %ProgramFiles(x86)%\reispacer71\is-7i4cq.tmp to %ProgramFiles(x86)%\reispacer71\readme.txt
from %ProgramFiles(x86)%\reispacer71\is-41bp7.tmp to %ProgramFiles(x86)%\reispacer71\notify.wav
from %ProgramFiles(x86)%\reispacer71\is-46d0v.tmp to %ProgramFiles(x86)%\reispacer71\history.txt
from %ProgramFiles(x86)%\reispacer71\is-2603i.tmp to %ProgramFiles(x86)%\reispacer71\backup_u.dll
from %ProgramFiles(x86)%\reispacer71\is-rjrra.tmp to %ProgramFiles(x86)%\reispacer71\backup_c.dll
from %ProgramFiles(x86)%\reispacer71\config\is-9b00k.tmp to %ProgramFiles(x86)%\reispacer71\config\filemask.dat
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-7r92e.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnclean_disabled.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-r82si.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnclean_hover.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-r7e9e.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnclean_usual.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-adqhf.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnstop_usual.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-sd1ea.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnstop_hover.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-04jr4.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnstatistic_usual.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-ff8m4.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnstatistic_hover.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-2589c.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnstatistic_disabled.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-kisnm.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnsettings_usual.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-j30oq.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnsettings_hover.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-2k6bs.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnsettings_disabled.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-5u6r4.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnsearch_usual.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-d96fr.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnsearch_hover.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-jp79e.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnsearch_disabled.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-4n3f0.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnexit_usual.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-j2r5v.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnexit_hover.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-r2at0.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnexclus_usual.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-nlre8.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnexclus_hover.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-jirvo.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnclose_usual.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-ej2t4.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnclose_hover.jpg
from %ProgramFiles(x86)%\reispacer71\skins\blue\is-3nk35.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btn_cancel_usual.jpg
from %ProgramFiles(x86)%\reispacer71\is-sbkth.tmp to %ProgramFiles(x86)%\reispacer71\reispacer71.exe

Substitutes the following files

%ProgramFiles(x86)%\reispacer71\readme.txt

Network activity

Connects to

'45.##.253.56':80
'45.##.253.72':80
'45.##.253.75':80

TCP

HTTP GET requests

http://45.##.253.56/advertisting/plus.php?s=###############################
http://45.##.253.72/default/stuk.php
http://45.##.253.72/default/puk.php
http://45.##.253.75/dll.php

Miscellaneous

Searches for the following windows

ClassName: 'z9d919_ReiSpacer71Class_z9d919' WindowName: ''
ClassName: '' WindowName: ''

Creates and executes the following

'%TEMP%\is-6f2d7.tmp\is-cch4b.tmp' /SL4 $F0248 "<Full path to file>" 989431 139776
'%ProgramFiles(x86)%\reispacer71\reispacer71.exe'
'%APPDATA%\{846ee340-7039-11de-9d20-806e6f6e6963}\akuzf16bnvykr.exe'
'%WINDIR%\syswow64\cmd.exe' /c taskkill /im "ReiSpacer71.exe" /f & erase "%ProgramFiles(x86)%\ReiSpacer71\ReiSpacer71.exe" & exit' (with hidden window)

Executes the following

'%WINDIR%\syswow64\net.exe' helpmsg 1
'%WINDIR%\syswow64\net1.exe' helpmsg 1
'%WINDIR%\syswow64\cmd.exe' /c taskkill /im "ReiSpacer71.exe" /f & erase "%ProgramFiles(x86)%\ReiSpacer71\ReiSpacer71.exe" & exit

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней