Trojan.Siggen22.18922

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Classes\televzr\shell\open\command] '' = '%LOCALAPPDATA%\televzr\Televzr.exe "%1"'
[HKCU\Software\Classes\mkv\shell\open\command] '' = '%LOCALAPPDATA%\televzr\Televzr.exe "%1"'
[HKCU\Software\Classes\mp4\shell\open\command] '' = '%LOCALAPPDATA%\televzr\Televzr.exe "%1"'
[HKCU\Software\Classes\avi\shell\open\command] '' = '%LOCALAPPDATA%\televzr\Televzr.exe "%1"'
[HKCU\Software\Classes\m4v\shell\open\command] '' = '%LOCALAPPDATA%\televzr\Televzr.exe "%1"'
[HKCU\Software\Classes\televzr\shell\open\command] '' = '"%LOCALAPPDATA%\televzr\Televzr.exe" "%1"'
[HKCU\Software\Classes\televzr\shell\open\command] '' = ''

Modifies file system

Creates the following files

%TEMP%\nswa89e.tmp\system.dll
%APPDATA%\televzr desktop\local storage\leveldb\000001.dbtmp
%APPDATA%\televzr desktop\code cache\wasm\index
%APPDATA%\televzr desktop\code cache\js\index
%APPDATA%\televzr desktop\partitions\yt\code cache\wasm\index
%APPDATA%\televzr desktop\partitions\yt\code cache\js\index
%APPDATA%\televzr desktop\partitions\yt\local storage\leveldb\log
%APPDATA%\televzr desktop\partitions\ui\code cache\wasm\index
%APPDATA%\televzr desktop\partitions\yt\local storage\leveldb\manifest-000001
%APPDATA%\televzr desktop\partitions\ui\gpucache\index
%APPDATA%\televzr desktop\partitions\ui\gpucache\data_0
%APPDATA%\televzr desktop\partitions\ui\gpucache\data_1
%APPDATA%\televzr desktop\partitions\ui\gpucache\data_2
%APPDATA%\televzr desktop\partitions\ui\gpucache\data_3
%APPDATA%\televzr desktop\fontlookuptablecache\font_unique_name_table.pb
%APPDATA%\televzr desktop\local storage\leveldb\log
%APPDATA%\televzr desktop\local storage\leveldb\manifest-000001
%APPDATA%\televzr desktop\partitions\ui\local storage\leveldb\000001.dbtmp
%APPDATA%\televzr desktop\partitions\ui\code cache\js\index
%APPDATA%\televzr desktop\partitions\ui\cache\data_0
%LOCALAPPDATA%\televzr\resources\bin_ia32\yt-dlp.exe
%LOCALAPPDATA%\televzr\resources\elevate.exe
%LOCALAPPDATA%\televzr\swiftshader\libegl.dll
%LOCALAPPDATA%\televzr\swiftshader\libglesv2.dll
%LOCALAPPDATA%\televzr\televzr.exe
%APPDATA%\televzr desktop\partitions\ui\cache\index
%LOCALAPPDATA%\televzr\resources\bin_ia32\ffmpeg.exe
%APPDATA%\televzr desktop\partitions\yt\local storage\leveldb\000001.dbtmp
%LOCALAPPDATA%\televzr\vk_swiftshader.dll
%APPDATA%\microsoft\windows\start menu\programs\televzr.lnk
%TEMP%\nswa89e.tmp\winshell.dll
%HOMEPATH%\desktop\televzr.lnk
%APPDATA%\televzr desktop\partitions\ui\local storage\leveldb\log
%APPDATA%\televzr desktop\partitions\ui\local storage\leveldb\manifest-000001
%LOCALAPPDATA%\televzr\vulkan-1.dll
%LOCALAPPDATA%\televzr-updater\package.7z
%LOCALAPPDATA%\televzr\uninstall televzr.exe
%LOCALAPPDATA%\televzr\locales\pl.pak
%APPDATA%\televzr desktop\partitions\ui\cache\data_1
%APPDATA%\televzr desktop\partitions\ui\4f9dacdb-a969-4062-b6b4-7c51f3b31499.tmp
%APPDATA%\televzr desktop\1ed88e71-644f-488e-bb66-7acad339ff2a.tmp
%APPDATA%\televzr desktop\partitions\yt\23a8919c-5add-4768-b633-c9678bd0de64.tmp
%APPDATA%\televzr desktop\partitions\ui\556b3989-a0af-4fe5-bffb-2c76da96e785.tmp
%APPDATA%\televzr desktop\c6e15b89-ddb1-4885-907d-abe2d35983c0.tmp
%APPDATA%\televzr desktop\partitions\yt\598dd737-403e-4eba-817f-e14f653fe776.tmp
%APPDATA%\televzr desktop\gpucache\index
%APPDATA%\televzr desktop\cookies
%LOCALAPPDATA%\televzr\libglesv2.dll
%APPDATA%\televzr desktop\cookies-journal
%APPDATA%\televzr desktop\gpucache\data_3
%APPDATA%\televzr desktop\logs\televzr-2023-11-28.log
%APPDATA%\televzr desktop\indexeddb\file__0.indexeddb.leveldb\log
%APPDATA%\televzr desktop\indexeddb\file__0.indexeddb.leveldb\manifest-000001
%APPDATA%\televzr desktop\indexeddb\file__0.indexeddb.leveldb\000001.dbtmp
%APPDATA%\televzr desktop\indexeddb\file__0.indexeddb.leveldb\000003.log
%APPDATA%\televzr desktop\gpucache\data_1
%APPDATA%\televzr desktop\gpucache\data_0
%LOCALAPPDATA%\televzr\resources\bin_ia32\ffprobe.exe
%APPDATA%\televzr desktop\partitions\yt\cache\data_3
%APPDATA%\televzr desktop\partitions\yt\code cache\wasm\index-dir\temp-index
%APPDATA%\televzr desktop\cache\index
%APPDATA%\televzr desktop\cache\data_0
%APPDATA%\televzr desktop\cache\data_1
%APPDATA%\televzr desktop\cache\data_2
%APPDATA%\televzr desktop\cache\data_3
%APPDATA%\televzr desktop\partitions\yt\cache\index
%APPDATA%\televzr desktop\config.json
%APPDATA%\televzr desktop\partitions\ui\cache\data_2
%APPDATA%\televzr desktop\partitions\ui\cache\data_3
%APPDATA%\televzr desktop\partitions\ui\code cache\wasm\index-dir\temp-index
%APPDATA%\televzr desktop\code cache\js\index-dir\temp-index
%APPDATA%\televzr desktop\code cache\wasm\index-dir\temp-index
%APPDATA%\televzr desktop\partitions\yt\cache\data_0
%APPDATA%\televzr desktop\partitions\yt\cache\data_1
%APPDATA%\televzr desktop\partitions\yt\cache\data_2
%APPDATA%\televzr desktop\partitions\yt\code cache\js\index-dir\temp-index
%APPDATA%\televzr desktop\partitions\ui\code cache\js\index-dir\temp-index
%LOCALAPPDATA%\televzr\libegl.dll
%LOCALAPPDATA%\televzr\ffmpeg.dll
%LOCALAPPDATA%\televzr\d3dcompiler_47.dll
%LOCALAPPDATA%\televzr\locales\en-gb.pak
%LOCALAPPDATA%\televzr\locales\en-us.pak
%LOCALAPPDATA%\televzr\locales\es-419.pak
%LOCALAPPDATA%\televzr\locales\es.pak
%LOCALAPPDATA%\televzr\locales\et.pak
%LOCALAPPDATA%\televzr\locales\da.pak
%LOCALAPPDATA%\televzr\chrome_100_percent.pak
%LOCALAPPDATA%\televzr\locales\el.pak
%LOCALAPPDATA%\televzr\locales\fa.pak
%LOCALAPPDATA%\televzr\locales\gu.pak
%LOCALAPPDATA%\televzr\locales\he.pak
%LOCALAPPDATA%\televzr\locales\hi.pak
%LOCALAPPDATA%\televzr\locales\hr.pak
%LOCALAPPDATA%\televzr\locales\hu.pak
%LOCALAPPDATA%\televzr\locales\fi.pak
%LOCALAPPDATA%\televzr\locales\fil.pak
%LOCALAPPDATA%\televzr\locales\fr.pak
%APPDATA%\televzr desktop\quotamanager-journal
%LOCALAPPDATA%\televzr\locales\id.pak
%LOCALAPPDATA%\televzr\locales\bn.pak
%TEMP%\nswa89e.tmp\nsexec.dll
%TEMP%\nswa89e.tmp\spiderbanner.dll
%TEMP%\nswa89e.tmp\nsprocess.dll
%TEMP%\nswa89e.tmp\inetc.dll
%LOCALAPPDATA%\televzr\uninstallericon.ico
%TEMP%\nswa89e.tmp\package.7z
%LOCALAPPDATA%\televzr\locales\ca.pak
%LOCALAPPDATA%\televzr\locales\cs.pak
%TEMP%\nswa89e.tmp\nsis7z.dll
%LOCALAPPDATA%\televzr\icudtl.dat
%LOCALAPPDATA%\televzr\license.electron.txt
%LOCALAPPDATA%\televzr\licenses.chromium.html
%LOCALAPPDATA%\televzr\locales\am.pak
%LOCALAPPDATA%\televzr\locales\ar.pak
%LOCALAPPDATA%\televzr\locales\bg.pak
%TEMP%\nswa89e.tmp\stdutils.dll
%LOCALAPPDATA%\televzr\chrome_200_percent.pak
%APPDATA%\televzr desktop\gpucache\data_2
%LOCALAPPDATA%\televzr\locales\it.pak
%LOCALAPPDATA%\televzr\locales\ko.pak
%LOCALAPPDATA%\televzr\locales\tr.pak
%LOCALAPPDATA%\televzr\locales\uk.pak
%LOCALAPPDATA%\televzr\locales\vi.pak
%LOCALAPPDATA%\televzr\locales\zh-cn.pak
%LOCALAPPDATA%\televzr\locales\zh-tw.pak
%LOCALAPPDATA%\televzr\resources.pak
%LOCALAPPDATA%\televzr\locales\ja.pak
%LOCALAPPDATA%\televzr\locales\th.pak
%LOCALAPPDATA%\televzr\locales\te.pak
%LOCALAPPDATA%\televzr\resources\app.asar.unpacked\bundle\7f8b663e6218621b36b1867f8f2ff543.ico
%LOCALAPPDATA%\televzr\resources\app.asar.unpacked\bundle\af46f86f65f624cfee407eac19d946db.ico
%LOCALAPPDATA%\televzr\resources\app.asar.unpacked\bundle\c0edcf9115ff85441b19ff0e2f387c2d.ico
%LOCALAPPDATA%\televzr\snapshot_blob.bin
%LOCALAPPDATA%\televzr\v8_context_snapshot.bin
%LOCALAPPDATA%\televzr\vk_swiftshader_icd.json
%LOCALAPPDATA%\televzr\resources\app-update.yml
%LOCALAPPDATA%\televzr\resources\app.asar.unpacked\bundle\6111917f3a5c9c62e67df5a0d0e9136e.ico
%LOCALAPPDATA%\televzr\locales\kn.pak
%LOCALAPPDATA%\televzr\resources\app.asar
%LOCALAPPDATA%\televzr\locales\de.pak
%LOCALAPPDATA%\televzr\locales\lt.pak
%LOCALAPPDATA%\televzr\locales\lv.pak
%LOCALAPPDATA%\televzr\locales\ml.pak
%LOCALAPPDATA%\televzr\locales\mr.pak
%LOCALAPPDATA%\televzr\locales\ms.pak
%LOCALAPPDATA%\televzr\locales\nb.pak
%LOCALAPPDATA%\televzr\locales\sv.pak
%LOCALAPPDATA%\televzr\locales\ta.pak
%LOCALAPPDATA%\televzr\locales\sw.pak
%LOCALAPPDATA%\televzr\locales\pt-pt.pak
%LOCALAPPDATA%\televzr\locales\ro.pak
%LOCALAPPDATA%\televzr\locales\ru.pak
%LOCALAPPDATA%\televzr\locales\sk.pak
%LOCALAPPDATA%\televzr\locales\sl.pak
%LOCALAPPDATA%\televzr\locales\sr.pak
%LOCALAPPDATA%\televzr\locales\nl.pak
%LOCALAPPDATA%\televzr\locales\pt-br.pak
%APPDATA%\televzr desktop\quotamanager

Deletes the following files

%TEMP%\nswa89e.tmp\inetc.dll
%TEMP%\nswa89e.tmp\nsexec.dll
%TEMP%\nswa89e.tmp\nsis7z.dll
%TEMP%\nswa89e.tmp\nsprocess.dll
%TEMP%\nswa89e.tmp\spiderbanner.dll
%TEMP%\nswa89e.tmp\stdutils.dll
%TEMP%\nswa89e.tmp\system.dll
%TEMP%\nswa89e.tmp\winshell.dll
%APPDATA%\televzr desktop\preferences~rf112471.tmp
%APPDATA%\televzr desktop\network persistent state~rf122857.tmp

Moves the following files

from %TEMP%\nswa89e.tmp\package.7z to %LOCALAPPDATA%\televzr-updater\package.7z
from %APPDATA%\televzr desktop\indexeddb\file__0.indexeddb.leveldb\000001.dbtmp to %APPDATA%\televzr desktop\indexeddb\file__0.indexeddb.leveldb\current
from %APPDATA%\televzr desktop\partitions\yt\598dd737-403e-4eba-817f-e14f653fe776.tmp to %APPDATA%\televzr desktop\partitions\yt\network persistent state
from %APPDATA%\televzr desktop\c6e15b89-ddb1-4885-907d-abe2d35983c0.tmp to %APPDATA%\televzr desktop\network persistent state
from %APPDATA%\televzr desktop\partitions\ui\556b3989-a0af-4fe5-bffb-2c76da96e785.tmp to %APPDATA%\televzr desktop\partitions\ui\network persistent state
from %APPDATA%\televzr desktop\partitions\yt\23a8919c-5add-4768-b633-c9678bd0de64.tmp to %APPDATA%\televzr desktop\partitions\yt\preferences
from %APPDATA%\televzr desktop\1ed88e71-644f-488e-bb66-7acad339ff2a.tmp to %APPDATA%\televzr desktop\preferences
from %APPDATA%\televzr desktop\partitions\ui\4f9dacdb-a969-4062-b6b4-7c51f3b31499.tmp to %APPDATA%\televzr desktop\partitions\ui\preferences
from %APPDATA%\televzr desktop\preferences to %APPDATA%\televzr desktop\preferences~rf112471.tmp
from %APPDATA%\televzr desktop\code cache\wasm\index-dir\temp-index to %APPDATA%\televzr desktop\code cache\wasm\index-dir\the-real-index
from %APPDATA%\televzr desktop\partitions\ui\code cache\wasm\index-dir\temp-index to %APPDATA%\televzr desktop\partitions\ui\code cache\wasm\index-dir\the-real-index
from %APPDATA%\televzr desktop\partitions\yt\code cache\js\index-dir\temp-index to %APPDATA%\televzr desktop\partitions\yt\code cache\js\index-dir\the-real-index
from %APPDATA%\televzr desktop\partitions\yt\code cache\wasm\index-dir\temp-index to %APPDATA%\televzr desktop\partitions\yt\code cache\wasm\index-dir\the-real-index
from %APPDATA%\televzr desktop\partitions\ui\code cache\js\index-dir\temp-index to %APPDATA%\televzr desktop\partitions\ui\code cache\js\index-dir\the-real-index
from %APPDATA%\televzr desktop\partitions\yt\local storage\leveldb\000001.dbtmp to %APPDATA%\televzr desktop\partitions\yt\local storage\leveldb\current
from %APPDATA%\televzr desktop\local storage\leveldb\000001.dbtmp to %APPDATA%\televzr desktop\local storage\leveldb\current
from %APPDATA%\televzr desktop\partitions\ui\local storage\leveldb\000001.dbtmp to %APPDATA%\televzr desktop\partitions\ui\local storage\leveldb\current
from %APPDATA%\televzr desktop\code cache\js\index-dir\temp-index to %APPDATA%\televzr desktop\code cache\js\index-dir\the-real-index
from %APPDATA%\televzr desktop\network persistent state to %APPDATA%\televzr desktop\network persistent state~rf122857.tmp

Network activity

Connects to

'go#####a###ytics.com':80
'de####p.televzr.com':80
'cd###elevzr.com':80
're####ctor.gvt1.com':443

TCP

HTTP GET requests

http://de####p.televzr.com/download/updater/latest/televzr.nsis.7z
http://cd###elevzr.com/televzr-1.16.5-ia32.nsis.7z
http://de####p.televzr.com/api/geo

HTTP POST requests

http://www.go#####a###ytics.com/collect

Other

'go#####a###ytics.com':443

UDP

DNS ASK go#####a###ytics.com
DNS ASK de####p.televzr.com
DNS ASK cd###elevzr.com
DNS ASK re####ctor.gvt1.com

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%APPDATA%\Televzr Desktop'

Creates and executes the following

'%LOCALAPPDATA%\televzr\televzr.exe'
'%LOCALAPPDATA%\televzr\televzr.exe' --type=gpu-process --field-trial-handle=1088,8069542005164121153,5054932930507561467,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,SameSiteByDefaultCooki...
'%LOCALAPPDATA%\televzr\televzr.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1088,8069542005164121153,5054932930507561467,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,Har...
'%LOCALAPPDATA%\televzr\televzr.exe' --type=renderer --user-data-dir="%APPDATA%\Televzr Desktop" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes=fs --fetch-schemes=app,fs --service-worker-schemes --s...
'%LOCALAPPDATA%\televzr\televzr.exe' --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1088,8069542005164121153,5054932930507561467,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,Hardwar...
'%WINDIR%\syswow64\cmd.exe' /C more < "<Full path to file>:Zone.Identifier"' (with hidden window)
'%WINDIR%\syswow64\reg.exe' QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\\UserChoice /v ProgId' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.m4v\OpenWithProgids /v televzr /t REG_SZ /d "" /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.m4v\OpenWithProgids /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.avi\OpenWithProgids /v televzr /t REG_SZ /d "" /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.avi\OpenWithProgids /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mkv\OpenWithProgids /v televzr /t REG_SZ /d "" /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mp4\OpenWithProgids /v televzr /t REG_SZ /d "" /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' QUERY HKCU\Software\Classes\ /ve' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mp4\OpenWithProgids /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\televzr\shell\open /ve /t REG_SZ /d "Open with Televzr" /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\televzr\shell\open\command /ve /t REG_SZ /d "\"%LOCALAPPDATA%\televzr\Televzr.exe\" \"%1\"" /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\televzr\shell\open\command /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\televzr /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' QUERY HKCU\SOFTWARE\Televzr /v vid' (with hidden window)
'%WINDIR%\syswow64\reg.exe' QUERY HKCU\SOFTWARE\Televzr /v userid' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mkv\OpenWithProgids /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' QUERY "HKCU\Software\Classes\(value not set)\shell\open\command" /ve' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C more < "<Full path to file>:Zone.Identifier"
'%WINDIR%\syswow64\reg.exe' QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\\UserChoice /v ProgId
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.m4v\OpenWithProgids /v televzr /t REG_SZ /d "" /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.m4v\OpenWithProgids /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.avi\OpenWithProgids /v televzr /t REG_SZ /d "" /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.avi\OpenWithProgids /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mp4\OpenWithProgids /v televzr /t REG_SZ /d "" /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mp4\OpenWithProgids /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mkv\OpenWithProgids /v televzr /t REG_SZ /d "" /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mkv\OpenWithProgids /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\televzr\shell\open /ve /t REG_SZ /d "Open with Televzr" /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\televzr\shell\open\command /ve /t REG_SZ /d "\"%LOCALAPPDATA%\televzr\Televzr.exe\" \"%1\"" /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\televzr\shell\open\command /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\televzr /f
'%WINDIR%\syswow64\reg.exe' QUERY HKCU\SOFTWARE\Televzr /v vid
'%WINDIR%\syswow64\reg.exe' QUERY HKCU\SOFTWARE\Televzr /v userid
'%WINDIR%\syswow64\reg.exe' QUERY HKCU\Software\Classes\ /ve
'%WINDIR%\syswow64\reg.exe' QUERY "HKCU\Software\Classes\(value not set)\shell\open\command" /ve

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней