Trojan.Siggen29.38613

Technical Information

Modifies file system

Creates the following files

%TEMP%\rarsfx0\fd2f9f807bea2b58b3f22a20a2a33d50.exe
%TEMP%\rarsfx30\7acd73b2a8acc5316701a3768aa0224e.exe
%TEMP%\rarsfx31\01c7b8b847a7376baebf8e9d15ee8631.exe
%TEMP%\rarsfx32\bfe62a66d7f68920983cbf6990992ef0.exe
%TEMP%\rarsfx33\f19689f4d4a7afa6c9661af2395839e3.exe
%TEMP%\rarsfx34\23925dcd44a3ab57ae20ede954b5598c.exe
%TEMP%\rarsfx35\2073628709bd59efa0217a68be787965.exe
%TEMP%\rarsfx36\820b2fb2e6b5a4c60c5e7b4c30178540.exe
%TEMP%\rarsfx37\7c5b30cdff3036091bb7d7b6dd934a8b.exe
%TEMP%\rarsfx38\e463e69885abdf7fa0f72ed08938b568.exe
%TEMP%\rarsfx39\d9957062a7db2ed1a4a971365a2e2beb.exe
%TEMP%\rarsfx40\jujitsu.exe
%TEMP%\rarsfx41\setup.exe
%TEMP%\rarsfx41\init_setup.vbs
%TEMP%\rarsfx41\driver.sys
%TEMP%\php5634.tmp
%TEMP%\etilqs_juwuyina2nu9leg
%TEMP%\etilqs_1kbvm7u1asqjpjc
%TEMP%\etilqs_vx0xyqllzzk2obt
%TEMP%\etilqs_dz7ry8yoiwihi4g
%TEMP%\etilqs_hl7717cumtz7rqy
%TEMP%\etilqs_boumsh73buo4cxt
%TEMP%\etilqs_7kmfdaheoofxq4k
%TEMP%\etilqs_cpezp3bcwhe1ffp
%TEMP%\etilqs_ov5jwayfzme8s5r
%TEMP%\etilqs_zxegyc4xcndgz0b
%TEMP%\rarsfx29\ae3dce0c2600dfefe6ee50328f93f41e.exe
%TEMP%\etilqs_mowovksr8zjal1f
%TEMP%\rarsfx28\865c9f5ca4e716067213075ae97d1baf.exe
%TEMP%\rarsfx26\5274a3bd0093ae765ff287103a1b8c52.exe
%TEMP%\rarsfx1\a59e73c5d5f9287366b2259ee47fc571.exe
%TEMP%\rarsfx2\f07d7c9a33ce46477503452cda8ef2a7.exe
%TEMP%\rarsfx3\0c233848cf5dd29959b07ff0c6f2ff5e.exe
%TEMP%\rarsfx4\b72f8c0ea38e3483feccb835e709f474.exe
%TEMP%\rarsfx5\6ec9d1951f2fb869f3ffef863e926fbd.exe
%TEMP%\rarsfx6\4bcafc1873d962b9668218853bd06451.exe
%TEMP%\rarsfx7\949c735c343b85fcd3ca9ade2860ae0a.exe
%TEMP%\rarsfx8\972fc21556c7b012deb91ca0ea3d35a7.exe
%TEMP%\rarsfx9\9f57c7ad210d70b83404ac59a0d235bd.exe
%TEMP%\rarsfx10\a2c01c8ed8510df507dd1dc0b5a449fe.exe
%TEMP%\rarsfx11\02588a6c1f8430a6d79e2c7045307bb4.exe
%TEMP%\rarsfx12\a23b01b7cd95224481138b31129d43fe.exe
%TEMP%\rarsfx13\599842301873266ab1bd5861472b40a4.exe
%TEMP%\rarsfx14\ce722b2442e0c578e4225df509b98b0c.exe
%TEMP%\rarsfx15\48fcb5f6aad2ff3bb41c90e135881587.exe
%TEMP%\rarsfx16\cae7c345c12ebee968952829d4f49cc3.exe
%TEMP%\rarsfx17\7383c23f19a1eafbf461f22043bf1c4a.exe
%TEMP%\rarsfx18\04bc5842c23bd1ea842fed8aacf9d282.exe
%TEMP%\rarsfx19\9cc2f3930c1c290473e28a390aa5d47d.exe
%TEMP%\rarsfx20\7011e18963fc63a33ae7ea259d55742e.exe
%TEMP%\rarsfx21\ff11856678af0a74cbdf333cd93ed223.exe
%TEMP%\rarsfx22\991de8bad46a8e16ee2c7e3927d9f920.exe
%TEMP%\rarsfx23\d7732fd7e7e4f61183248f81dfb51472.exe
%TEMP%\rarsfx24\2f59bbf86b98919100932a0c513138c3.exe
%TEMP%\rarsfx25\9c6556de6903abeef0e71b28f6523dca.exe
%TEMP%\rarsfx27\0f3d8988a484374d727895ac558c6e1f.exe
%TEMP%\etilqs_nbpojgguiyrerce

Sets the 'hidden' attribute to the following files

%TEMP%\rarsfx41\setup.exe
%TEMP%\rarsfx41\init_setup.vbs

Deletes the following files

%TEMP%\rarsfx40\jujitsu.exe
%TEMP%\rarsfx16\cae7c345c12ebee968952829d4f49cc3.exe
%TEMP%\rarsfx15\48fcb5f6aad2ff3bb41c90e135881587.exe
%TEMP%\rarsfx14\ce722b2442e0c578e4225df509b98b0c.exe
%TEMP%\rarsfx13\599842301873266ab1bd5861472b40a4.exe
%TEMP%\rarsfx12\a23b01b7cd95224481138b31129d43fe.exe
%TEMP%\rarsfx11\02588a6c1f8430a6d79e2c7045307bb4.exe
%TEMP%\rarsfx10\a2c01c8ed8510df507dd1dc0b5a449fe.exe
%TEMP%\rarsfx30\7acd73b2a8acc5316701a3768aa0224e.exe
%TEMP%\rarsfx9\9f57c7ad210d70b83404ac59a0d235bd.exe
%TEMP%\rarsfx7\949c735c343b85fcd3ca9ade2860ae0a.exe
%TEMP%\rarsfx6\4bcafc1873d962b9668218853bd06451.exe
%TEMP%\rarsfx5\6ec9d1951f2fb869f3ffef863e926fbd.exe
%TEMP%\rarsfx4\b72f8c0ea38e3483feccb835e709f474.exe
%TEMP%\rarsfx3\0c233848cf5dd29959b07ff0c6f2ff5e.exe
%TEMP%\rarsfx2\f07d7c9a33ce46477503452cda8ef2a7.exe
%TEMP%\rarsfx1\a59e73c5d5f9287366b2259ee47fc571.exe
%TEMP%\rarsfx18\04bc5842c23bd1ea842fed8aacf9d282.exe
%TEMP%\rarsfx17\7383c23f19a1eafbf461f22043bf1c4a.exe
%TEMP%\rarsfx19\9cc2f3930c1c290473e28a390aa5d47d.exe
%TEMP%\rarsfx20\7011e18963fc63a33ae7ea259d55742e.exe
%TEMP%\rarsfx21\ff11856678af0a74cbdf333cd93ed223.exe
%TEMP%\rarsfx38\e463e69885abdf7fa0f72ed08938b568.exe
%TEMP%\rarsfx37\7c5b30cdff3036091bb7d7b6dd934a8b.exe
%TEMP%\rarsfx36\820b2fb2e6b5a4c60c5e7b4c30178540.exe
%TEMP%\rarsfx35\2073628709bd59efa0217a68be787965.exe
%TEMP%\rarsfx34\23925dcd44a3ab57ae20ede954b5598c.exe
%TEMP%\rarsfx33\f19689f4d4a7afa6c9661af2395839e3.exe
%TEMP%\rarsfx32\bfe62a66d7f68920983cbf6990992ef0.exe
%TEMP%\rarsfx0\fd2f9f807bea2b58b3f22a20a2a33d50.exe
%TEMP%\rarsfx8\972fc21556c7b012deb91ca0ea3d35a7.exe
%TEMP%\rarsfx31\01c7b8b847a7376baebf8e9d15ee8631.exe
%TEMP%\rarsfx28\865c9f5ca4e716067213075ae97d1baf.exe
%TEMP%\rarsfx27\0f3d8988a484374d727895ac558c6e1f.exe
%TEMP%\rarsfx26\5274a3bd0093ae765ff287103a1b8c52.exe
%TEMP%\rarsfx25\9c6556de6903abeef0e71b28f6523dca.exe
%TEMP%\rarsfx24\2f59bbf86b98919100932a0c513138c3.exe
%TEMP%\rarsfx23\d7732fd7e7e4f61183248f81dfb51472.exe
%TEMP%\rarsfx22\991de8bad46a8e16ee2c7e3927d9f920.exe
%TEMP%\rarsfx39\d9957062a7db2ed1a4a971365a2e2beb.exe
%TEMP%\rarsfx29\ae3dce0c2600dfefe6ee50328f93f41e.exe
%TEMP%\php5634.tmp

Network activity

Connects to

'xs.ht':443
'og#####a.googleapis.com':443
'ro###.ebay.com':443
'bo##ing.com':443
'ya##o.com':443
'bo##ing.com':80
'tw##ter.com':80
'ro###.ebay.com':80
'sd#####es.operacdn.com':443
'bl#####st.rkn.gov.ru':443
'bl#####st.rkn.gov.ru':80
'fa###ook.com':80
'ss#.#static.com':443
'go#####a###ytics.com':443
'fo###.gstatic.com':443
'oc##.#ectigo.com':80
'go#####agmanager.com':443
'pk#.goog':80
'support.google.com':443
'en.###ipedia.org':443
'ya###.opera.com':80
'en.###ipedia.org':80
'am##on.com':443
'bing.com':80
'am##on.com':80
'du###uckgo.com':443
'se####.yahoo.com':80
'google.com':80
'au######te.geo.opera.com':443
'au######te.geo.opera.com':80
'20##.ninja':443
're###.opera.com':80
's.##mg.com':443

TCP

HTTP GET requests

http://au######te.geo.opera.com/geolocation/
http://www.op##a.com/follow?ut###############################################################################################
http://ro###.ebay.com/rover/1/711-53200-19255-0/1?ic###########################################################################################################################
http://www.bo##ing.com/index.html?ai##########################################################################################
http://www.tw##ter.com/?pa################
http://www.ya##o.com/?il#####
http://re###.opera.com/speeddials/partner/wikipedia_org_us
http://re###.opera.com/speeddials/partner/youtube
http://re###.opera.com/speeddials/partner/product
http://re###.opera.com/speeddials/partner/booking_com_us
http://re###.opera.com/speeddials/partner/twitter_us
http://re###.opera.com/speeddials/partner/yahoo
http://re###.opera.com/favicon.ico
http://re###.opera.com/speeddials/partner/ebay_us
http://bl#####st.rkn.gov.ru/
http://www.fa###ook.com/campaign/landing.php?ca#########################
http://re###.opera.com/speeddials/partner/facebook
http://re###.opera.com/www.opera.com/firstrun/
http://pk#.goog/gsr1/gsr1.crt
http://ya###.opera.com/favicon.ico
http://en.###ipedia.org/favicon.ico
http://www.bing.com/s/a/bing_p.ico
http://www.am##on.com/favicon.ico
http://se####.yahoo.com/favicon.ico
http://www.google.com/favicon.ico
http://re###.opera.com/speeddials/partner/amazon_us
http://oc##.#ectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEFNp5w0OfFpfbm3j7C%2BJjKU%3D

Other

'xs.ht':443
'apis.google.com':443
'og#####a.googleapis.com':443
'ro###.ebay.com':443
'ya##o.com':443
'bo##ing.com':443
'google.com':443
'sd#####es.operacdn.com':443
'bl#####st.rkn.gov.ru':443
'gs##tic.com':443
'ss#.#static.com':443
'eb##.com':443
'go#####a###ytics.com':443
'go#####agmanager.com':443
'support.google.com':443
'si#####ck2.opera.com':443
'op##a.com':443
'ya###.opera.com':443
'en.###ipedia.org':443
'am##on.com':443
'du###uckgo.com':443
'au######te.geo.opera.com':443
'20##.ninja':443
'fo###.gstatic.com':443
'pa###.ebay.com':443

UDP

DNS ASK xs.ht
DNS ASK fo###.gstatic.com
DNS ASK ss#.#static.com
DNS ASK gs##tic.com
DNS ASK fa###ook.com
DNS ASK bl#####st.rkn.gov.ru
DNS ASK sd#####es.operacdn.com
DNS ASK ro###.ebay.com
DNS ASK bi##.#ikimedia.org
DNS ASK bo##ing.com
DNS ASK tw##ter.com
DNS ASK og#####a.googleapis.com
DNS ASK apis.google.com
DNS ASK oc##.#ectigo.com
DNS ASK eb##.com
DNS ASK go#####a###ytics.com
DNS ASK go#####agmanager.com
DNS ASK re###.opera.com
DNS ASK pk#.goog
DNS ASK support.google.com
DNS ASK si#####ck2.opera.com
DNS ASK op##a.com
DNS ASK ya###.opera.com
DNS ASK en.###ipedia.org
DNS ASK ya##o.com
DNS ASK bing.com
DNS ASK du###uckgo.com
DNS ASK am##on.com
DNS ASK se####.yahoo.com
DNS ASK au######te.geo.opera.com
DNS ASK google.com
DNS ASK 20##.ninja
DNS ASK s.##mg.com
DNS ASK pa###.ebay.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'

Creates and executes the following

'%TEMP%\rarsfx0\fd2f9f807bea2b58b3f22a20a2a33d50.exe'
'%TEMP%\rarsfx23\d7732fd7e7e4f61183248f81dfb51472.exe'
'%TEMP%\rarsfx24\2f59bbf86b98919100932a0c513138c3.exe'
'%TEMP%\rarsfx25\9c6556de6903abeef0e71b28f6523dca.exe'
'%TEMP%\rarsfx26\5274a3bd0093ae765ff287103a1b8c52.exe'
'%TEMP%\rarsfx27\0f3d8988a484374d727895ac558c6e1f.exe'
'%TEMP%\rarsfx28\865c9f5ca4e716067213075ae97d1baf.exe'
'%TEMP%\rarsfx29\ae3dce0c2600dfefe6ee50328f93f41e.exe'
'%TEMP%\rarsfx30\7acd73b2a8acc5316701a3768aa0224e.exe'
'%TEMP%\rarsfx32\bfe62a66d7f68920983cbf6990992ef0.exe'
'<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX41\init_setup.vbs"
'%TEMP%\rarsfx33\f19689f4d4a7afa6c9661af2395839e3.exe'
'%TEMP%\rarsfx34\23925dcd44a3ab57ae20ede954b5598c.exe'
'%TEMP%\rarsfx35\2073628709bd59efa0217a68be787965.exe'
'%TEMP%\rarsfx36\820b2fb2e6b5a4c60c5e7b4c30178540.exe'
'%TEMP%\rarsfx37\7c5b30cdff3036091bb7d7b6dd934a8b.exe'
'%TEMP%\rarsfx38\e463e69885abdf7fa0f72ed08938b568.exe'
'%TEMP%\rarsfx39\d9957062a7db2ed1a4a971365a2e2beb.exe'
'%TEMP%\rarsfx40\jujitsu.exe'
'%TEMP%\rarsfx22\991de8bad46a8e16ee2c7e3927d9f920.exe'
'%TEMP%\rarsfx31\01c7b8b847a7376baebf8e9d15ee8631.exe'
'%TEMP%\rarsfx21\ff11856678af0a74cbdf333cd93ed223.exe'
'%TEMP%\rarsfx9\9f57c7ad210d70b83404ac59a0d235bd.exe'
'%TEMP%\rarsfx1\a59e73c5d5f9287366b2259ee47fc571.exe'
'%TEMP%\rarsfx2\f07d7c9a33ce46477503452cda8ef2a7.exe'
'%TEMP%\rarsfx3\0c233848cf5dd29959b07ff0c6f2ff5e.exe'
'%TEMP%\rarsfx4\b72f8c0ea38e3483feccb835e709f474.exe'
'%TEMP%\rarsfx5\6ec9d1951f2fb869f3ffef863e926fbd.exe'
'%TEMP%\rarsfx6\4bcafc1873d962b9668218853bd06451.exe'
'%TEMP%\rarsfx7\949c735c343b85fcd3ca9ade2860ae0a.exe'
'%TEMP%\rarsfx8\972fc21556c7b012deb91ca0ea3d35a7.exe'
'%TEMP%\rarsfx10\a2c01c8ed8510df507dd1dc0b5a449fe.exe'
'%TEMP%\rarsfx19\9cc2f3930c1c290473e28a390aa5d47d.exe'
'%TEMP%\rarsfx11\02588a6c1f8430a6d79e2c7045307bb4.exe'
'%TEMP%\rarsfx12\a23b01b7cd95224481138b31129d43fe.exe'
'%TEMP%\rarsfx13\599842301873266ab1bd5861472b40a4.exe'
'%TEMP%\rarsfx14\ce722b2442e0c578e4225df509b98b0c.exe'
'%TEMP%\rarsfx15\48fcb5f6aad2ff3bb41c90e135881587.exe'
'%TEMP%\rarsfx16\cae7c345c12ebee968952829d4f49cc3.exe'
'%TEMP%\rarsfx17\7383c23f19a1eafbf461f22043bf1c4a.exe'
'%TEMP%\rarsfx18\04bc5842c23bd1ea842fed8aacf9d282.exe'
'%TEMP%\rarsfx20\7011e18963fc63a33ae7ea259d55742e.exe'
'%TEMP%\rarsfx41\setup.exe'

Executes the following

'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3532.5.1711760704\415910560" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3532.19.2107804330\352180651" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3532.18.47206597\2034415388" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3532.17.1958506929\1110994685" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3532.14.433863187\1468635111" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3532.13.1060940832\1669237047" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3532.12.215759791\1382606497" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3532.11.46748849\1890499980" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3532.10.1020463418\1507862305" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3532.9.188634157\1513736109" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="3532.4.123140903\615266837" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=1148
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3532.8.244483913\1373590719" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3532.7.738230486\1762810321" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3532.6.616357110\1192411435" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3532.21.1221448359\903238129" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3532.4.123140903\615266837" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="3532.0.539136161\1117721032" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://support.google.com/chrome /crash-reporter-parent-id=3532
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://support.google.com/chrome
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://support.google.com/chrome"
'<SYSTEM32>\cmd.exe' /b /c start /high /b /min https://support.google.com/chrome
'<SYSTEM32>\cmd.exe' /s /c "%COMSPEC% /b /c start /high /b /min https://support.google.com/chrome"
'<SYSTEM32>\wbem\wmic.exe' diskdrive get size
'<SYSTEM32>\cmd.exe' /s /c "wmic diskdrive get size"
'<SYSTEM32>\wbem\wmic.exe' logicaldisk get name
'<SYSTEM32>\cmd.exe' /s /c "wmic logicaldisk get name"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3532.20.443789252\1176787020" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%TEMP%\rarsfx41\setup.exe' ' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней