Trojan.Siggen29.38600

Technical Information

Modifies file system

Creates the following files

%TEMP%\rarsfx0\cbb98cf515335d033d318a6b13c5ad03.exe
%TEMP%\rarsfx33\7acd73b2a8acc5316701a3768aa0224e.exe
%TEMP%\rarsfx34\01c7b8b847a7376baebf8e9d15ee8631.exe
%TEMP%\rarsfx35\bfe62a66d7f68920983cbf6990992ef0.exe
%TEMP%\rarsfx36\f19689f4d4a7afa6c9661af2395839e3.exe
%TEMP%\rarsfx37\23925dcd44a3ab57ae20ede954b5598c.exe
%TEMP%\rarsfx38\2073628709bd59efa0217a68be787965.exe
%TEMP%\rarsfx39\820b2fb2e6b5a4c60c5e7b4c30178540.exe
%TEMP%\rarsfx40\7c5b30cdff3036091bb7d7b6dd934a8b.exe
%TEMP%\rarsfx41\e463e69885abdf7fa0f72ed08938b568.exe
%TEMP%\rarsfx42\d9957062a7db2ed1a4a971365a2e2beb.exe
%TEMP%\rarsfx43\jujitsu.exe
%TEMP%\rarsfx31\865c9f5ca4e716067213075ae97d1baf.exe
%TEMP%\rarsfx32\ae3dce0c2600dfefe6ee50328f93f41e.exe
%TEMP%\rarsfx44\setup.exe
%TEMP%\php4e29.tmp
%TEMP%\etilqs_0sfyhdoql6pqpte
%TEMP%\etilqs_tadtrhwbutcvgrh
%TEMP%\etilqs_uhmkehqaa8boctb
%TEMP%\etilqs_qsggxiwbvaaqx8s
%TEMP%\etilqs_np8eqp9kfvpxomk
%TEMP%\etilqs_sldzxuuqe6jli5c
%TEMP%\etilqs_mkfvcbeiryrpehk
%TEMP%\etilqs_cvqfhbz2nrazdwl
%TEMP%\etilqs_rsblx04cwejghdd
%TEMP%\etilqs_ijokqgmrcgbp0jr
%TEMP%\rarsfx44\init_setup.vbs
%TEMP%\rarsfx44\driver.sys
%TEMP%\rarsfx30\0f3d8988a484374d727895ac558c6e1f.exe
%TEMP%\rarsfx29\5274a3bd0093ae765ff287103a1b8c52.exe
%TEMP%\rarsfx28\9c6556de6903abeef0e71b28f6523dca.exe
%TEMP%\rarsfx2\1be738bcf685d86cc52f53d8d8b2a37c.exe
%TEMP%\rarsfx3\fd2f9f807bea2b58b3f22a20a2a33d50.exe
%TEMP%\rarsfx4\a59e73c5d5f9287366b2259ee47fc571.exe
%TEMP%\rarsfx5\f07d7c9a33ce46477503452cda8ef2a7.exe
%TEMP%\rarsfx6\0c233848cf5dd29959b07ff0c6f2ff5e.exe
%TEMP%\rarsfx7\b72f8c0ea38e3483feccb835e709f474.exe
%TEMP%\rarsfx8\6ec9d1951f2fb869f3ffef863e926fbd.exe
%TEMP%\rarsfx9\4bcafc1873d962b9668218853bd06451.exe
%TEMP%\rarsfx10\949c735c343b85fcd3ca9ade2860ae0a.exe
%TEMP%\rarsfx11\972fc21556c7b012deb91ca0ea3d35a7.exe
%TEMP%\rarsfx12\9f57c7ad210d70b83404ac59a0d235bd.exe
%TEMP%\rarsfx13\a2c01c8ed8510df507dd1dc0b5a449fe.exe
%TEMP%\rarsfx1\cf7bd006818a555576afbf4ed5795f1b.exe
%TEMP%\rarsfx14\02588a6c1f8430a6d79e2c7045307bb4.exe
%TEMP%\rarsfx16\599842301873266ab1bd5861472b40a4.exe
%TEMP%\rarsfx17\ce722b2442e0c578e4225df509b98b0c.exe
%TEMP%\rarsfx18\48fcb5f6aad2ff3bb41c90e135881587.exe
%TEMP%\rarsfx19\cae7c345c12ebee968952829d4f49cc3.exe
%TEMP%\rarsfx20\7383c23f19a1eafbf461f22043bf1c4a.exe
%TEMP%\rarsfx21\04bc5842c23bd1ea842fed8aacf9d282.exe
%TEMP%\rarsfx22\9cc2f3930c1c290473e28a390aa5d47d.exe
%TEMP%\rarsfx23\7011e18963fc63a33ae7ea259d55742e.exe
%TEMP%\rarsfx24\ff11856678af0a74cbdf333cd93ed223.exe
%TEMP%\rarsfx25\991de8bad46a8e16ee2c7e3927d9f920.exe
%TEMP%\rarsfx26\d7732fd7e7e4f61183248f81dfb51472.exe
%TEMP%\rarsfx27\2f59bbf86b98919100932a0c513138c3.exe
%TEMP%\rarsfx15\a23b01b7cd95224481138b31129d43fe.exe
%TEMP%\etilqs_ohmhqlgfwqrtz6v
%TEMP%\etilqs_fo1haemrvopjt8l

Sets the 'hidden' attribute to the following files

%TEMP%\rarsfx44\setup.exe
%TEMP%\rarsfx44\init_setup.vbs

Deletes the following files

%TEMP%\php4e29.tmp
%TEMP%\rarsfx20\7383c23f19a1eafbf461f22043bf1c4a.exe
%TEMP%\rarsfx19\cae7c345c12ebee968952829d4f49cc3.exe
%TEMP%\rarsfx18\48fcb5f6aad2ff3bb41c90e135881587.exe
%TEMP%\rarsfx17\ce722b2442e0c578e4225df509b98b0c.exe
%TEMP%\rarsfx16\599842301873266ab1bd5861472b40a4.exe
%TEMP%\rarsfx15\a23b01b7cd95224481138b31129d43fe.exe
%TEMP%\rarsfx14\02588a6c1f8430a6d79e2c7045307bb4.exe
%TEMP%\rarsfx13\a2c01c8ed8510df507dd1dc0b5a449fe.exe
%TEMP%\rarsfx12\9f57c7ad210d70b83404ac59a0d235bd.exe
%TEMP%\rarsfx11\972fc21556c7b012deb91ca0ea3d35a7.exe
%TEMP%\rarsfx10\949c735c343b85fcd3ca9ade2860ae0a.exe
%TEMP%\rarsfx9\4bcafc1873d962b9668218853bd06451.exe
%TEMP%\rarsfx8\6ec9d1951f2fb869f3ffef863e926fbd.exe
%TEMP%\rarsfx7\b72f8c0ea38e3483feccb835e709f474.exe
%TEMP%\rarsfx6\0c233848cf5dd29959b07ff0c6f2ff5e.exe
%TEMP%\rarsfx5\f07d7c9a33ce46477503452cda8ef2a7.exe
%TEMP%\rarsfx4\a59e73c5d5f9287366b2259ee47fc571.exe
%TEMP%\rarsfx3\fd2f9f807bea2b58b3f22a20a2a33d50.exe
%TEMP%\rarsfx2\1be738bcf685d86cc52f53d8d8b2a37c.exe
%TEMP%\rarsfx21\04bc5842c23bd1ea842fed8aacf9d282.exe
%TEMP%\rarsfx1\cf7bd006818a555576afbf4ed5795f1b.exe
%TEMP%\rarsfx22\9cc2f3930c1c290473e28a390aa5d47d.exe
%TEMP%\rarsfx24\ff11856678af0a74cbdf333cd93ed223.exe
%TEMP%\rarsfx43\jujitsu.exe
%TEMP%\rarsfx42\d9957062a7db2ed1a4a971365a2e2beb.exe
%TEMP%\rarsfx41\e463e69885abdf7fa0f72ed08938b568.exe
%TEMP%\rarsfx40\7c5b30cdff3036091bb7d7b6dd934a8b.exe
%TEMP%\rarsfx39\820b2fb2e6b5a4c60c5e7b4c30178540.exe
%TEMP%\rarsfx38\2073628709bd59efa0217a68be787965.exe
%TEMP%\rarsfx37\23925dcd44a3ab57ae20ede954b5598c.exe
%TEMP%\rarsfx36\f19689f4d4a7afa6c9661af2395839e3.exe
%TEMP%\rarsfx35\bfe62a66d7f68920983cbf6990992ef0.exe
%TEMP%\rarsfx34\01c7b8b847a7376baebf8e9d15ee8631.exe
%TEMP%\rarsfx33\7acd73b2a8acc5316701a3768aa0224e.exe
%TEMP%\rarsfx32\ae3dce0c2600dfefe6ee50328f93f41e.exe
%TEMP%\rarsfx31\865c9f5ca4e716067213075ae97d1baf.exe
%TEMP%\rarsfx30\0f3d8988a484374d727895ac558c6e1f.exe
%TEMP%\rarsfx29\5274a3bd0093ae765ff287103a1b8c52.exe
%TEMP%\rarsfx28\9c6556de6903abeef0e71b28f6523dca.exe
%TEMP%\rarsfx27\2f59bbf86b98919100932a0c513138c3.exe
%TEMP%\rarsfx26\d7732fd7e7e4f61183248f81dfb51472.exe
%TEMP%\rarsfx25\991de8bad46a8e16ee2c7e3927d9f920.exe
%TEMP%\rarsfx23\7011e18963fc63a33ae7ea259d55742e.exe
%TEMP%\rarsfx0\cbb98cf515335d033d318a6b13c5ad03.exe

Network activity

Connects to

'xs.ht':443
'go#####agmanager.com':443
'pk#.goog':80
'support.google.com':443
'ya###.opera.com':80
'si#####ck2.opera.com':443
'en.###ipedia.org':443
'se####.yahoo.com':443
'am##on.com':443
'en.###ipedia.org':80
'bing.com':80
'am##on.com':80
'du###uckgo.com':443
'se####.yahoo.com':80
'google.com':80
'au######te.geo.opera.com':443
'au######te.geo.opera.com':80
'20##.ninja':443
'go#####a###ytics.com':443
'fo###.gstatic.com':443

TCP

HTTP GET requests

http://au######te.geo.opera.com/geolocation/
http://www.google.com/favicon.ico
http://www.am##on.com/favicon.ico
http://se####.yahoo.com/favicon.ico
http://www.bing.com/s/a/bing_p.ico
http://en.###ipedia.org/favicon.ico
http://ya###.opera.com/favicon.ico
http://pk#.goog/gsr1/gsr1.crt

Other

'xs.ht':443
'20##.ninja':443
'au######te.geo.opera.com':443
'du###uckgo.com':443
'am##on.com':443
'se####.yahoo.com':443
'en.###ipedia.org':443
'si#####ck2.opera.com':443
'ya###.opera.com':443
'op##a.com':443
'support.google.com':443
'go#####agmanager.com':443
'go#####a###ytics.com':443
'fo###.gstatic.com':443
'gs##tic.com':443

UDP

DNS ASK xs.ht
DNS ASK go#####agmanager.com
DNS ASK go#####a###ytics.com
DNS ASK pk#.goog
DNS ASK support.google.com
DNS ASK op##a.com
DNS ASK ya###.opera.com
DNS ASK si#####ck2.opera.com
DNS ASK fo###.gstatic.com
DNS ASK en.###ipedia.org
DNS ASK bing.com
DNS ASK am##on.com
DNS ASK du###uckgo.com
DNS ASK se####.yahoo.com
DNS ASK au######te.geo.opera.com
DNS ASK google.com
DNS ASK 20##.ninja
DNS ASK bi##.#ikimedia.org
DNS ASK gs##tic.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'

Creates and executes the following

'%TEMP%\rarsfx0\cbb98cf515335d033d318a6b13c5ad03.exe'
'%TEMP%\rarsfx26\d7732fd7e7e4f61183248f81dfb51472.exe'
'%TEMP%\rarsfx27\2f59bbf86b98919100932a0c513138c3.exe'
'%TEMP%\rarsfx28\9c6556de6903abeef0e71b28f6523dca.exe'
'%TEMP%\rarsfx29\5274a3bd0093ae765ff287103a1b8c52.exe'
'%TEMP%\rarsfx30\0f3d8988a484374d727895ac558c6e1f.exe'
'%TEMP%\rarsfx31\865c9f5ca4e716067213075ae97d1baf.exe'
'%TEMP%\rarsfx32\ae3dce0c2600dfefe6ee50328f93f41e.exe'
'%TEMP%\rarsfx33\7acd73b2a8acc5316701a3768aa0224e.exe'
'%TEMP%\rarsfx11\972fc21556c7b012deb91ca0ea3d35a7.exe'
'%TEMP%\rarsfx34\01c7b8b847a7376baebf8e9d15ee8631.exe'
'%TEMP%\rarsfx36\f19689f4d4a7afa6c9661af2395839e3.exe'
'%TEMP%\rarsfx37\23925dcd44a3ab57ae20ede954b5598c.exe'
'%TEMP%\rarsfx38\2073628709bd59efa0217a68be787965.exe'
'%TEMP%\rarsfx39\820b2fb2e6b5a4c60c5e7b4c30178540.exe'
'%TEMP%\rarsfx40\7c5b30cdff3036091bb7d7b6dd934a8b.exe'
'%TEMP%\rarsfx41\e463e69885abdf7fa0f72ed08938b568.exe'
'%TEMP%\rarsfx42\d9957062a7db2ed1a4a971365a2e2beb.exe'
'%TEMP%\rarsfx43\jujitsu.exe'
'%TEMP%\rarsfx24\ff11856678af0a74cbdf333cd93ed223.exe'
'%TEMP%\rarsfx25\991de8bad46a8e16ee2c7e3927d9f920.exe'
'%TEMP%\rarsfx23\7011e18963fc63a33ae7ea259d55742e.exe'
'%TEMP%\rarsfx22\9cc2f3930c1c290473e28a390aa5d47d.exe'
'%TEMP%\rarsfx21\04bc5842c23bd1ea842fed8aacf9d282.exe'
'%TEMP%\rarsfx2\1be738bcf685d86cc52f53d8d8b2a37c.exe'
'%TEMP%\rarsfx3\fd2f9f807bea2b58b3f22a20a2a33d50.exe'
'%TEMP%\rarsfx4\a59e73c5d5f9287366b2259ee47fc571.exe'
'%TEMP%\rarsfx5\f07d7c9a33ce46477503452cda8ef2a7.exe'
'%TEMP%\rarsfx6\0c233848cf5dd29959b07ff0c6f2ff5e.exe'
'%TEMP%\rarsfx7\b72f8c0ea38e3483feccb835e709f474.exe'
'%TEMP%\rarsfx8\6ec9d1951f2fb869f3ffef863e926fbd.exe'
'%TEMP%\rarsfx9\4bcafc1873d962b9668218853bd06451.exe'
'<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX44\init_setup.vbs"
'%TEMP%\rarsfx35\bfe62a66d7f68920983cbf6990992ef0.exe'
'%TEMP%\rarsfx10\949c735c343b85fcd3ca9ade2860ae0a.exe'
'%TEMP%\rarsfx13\a2c01c8ed8510df507dd1dc0b5a449fe.exe'
'%TEMP%\rarsfx14\02588a6c1f8430a6d79e2c7045307bb4.exe'
'%TEMP%\rarsfx15\a23b01b7cd95224481138b31129d43fe.exe'
'%TEMP%\rarsfx16\599842301873266ab1bd5861472b40a4.exe'
'%TEMP%\rarsfx17\ce722b2442e0c578e4225df509b98b0c.exe'
'%TEMP%\rarsfx18\48fcb5f6aad2ff3bb41c90e135881587.exe'
'%TEMP%\rarsfx19\cae7c345c12ebee968952829d4f49cc3.exe'
'%TEMP%\rarsfx20\7383c23f19a1eafbf461f22043bf1c4a.exe'
'%TEMP%\rarsfx1\cf7bd006818a555576afbf4ed5795f1b.exe'
'%TEMP%\rarsfx12\9f57c7ad210d70b83404ac59a0d235bd.exe'
'%TEMP%\rarsfx44\setup.exe'

Executes the following

'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="4036.5.1971671672\1379102458" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="4036.19.1536357492\23835548" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="4036.18.53397518\2040959527" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="4036.17.1804737990\1948503491" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="4036.14.597345247\407754103" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="4036.13.146478887\516317752" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="4036.12.1049603297\342789323" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="4036.11.166240187\1697624523" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="4036.10.1700777319\66155525" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="4036.9.999070726\1036633258" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="4036.8.689658871\1626319771" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="4036.4.561853478\315653369" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=3676
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="4036.7.1872718175\635469822" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="4036.6.255249039\376413774" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="4036.21.1408483702\1442412257" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="4036.4.561853478\315653369" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="4036.0.727122080\2033064836" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://support.google.com/chrome /crash-reporter-parent-id=4036
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://support.google.com/chrome
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://support.google.com/chrome"
'<SYSTEM32>\cmd.exe' /b /c start /high /b /min https://support.google.com/chrome
'<SYSTEM32>\cmd.exe' /s /c "%COMSPEC% /b /c start /high /b /min https://support.google.com/chrome"
'<SYSTEM32>\wbem\wmic.exe' diskdrive get size
'<SYSTEM32>\cmd.exe' /s /c "wmic diskdrive get size"
'<SYSTEM32>\wbem\wmic.exe' logicaldisk get name
'<SYSTEM32>\cmd.exe' /s /c "wmic logicaldisk get name"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="4036.20.971982915\888952558" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%TEMP%\rarsfx44\setup.exe' ' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней