Trojan.Siggen33.50215

Technical Information

Malicious functions

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\login data
%APPDATA%\opera software\opera stable\login data

Modifies file system

Creates the following files

%TEMP%\_mei000002e02\vcruntime140.dll
%TEMP%\_mei000002e02\vcruntime140_1.dll
%TEMP%\_mei000002e02\_bz2.pyd
%TEMP%\_mei000002e02\_ctypes.pyd
%TEMP%\_mei000002e02\_decimal.pyd
%TEMP%\_mei000002e02\_hashlib.pyd
%TEMP%\_mei000002e02\_lzma.pyd
%TEMP%\_mei000002e02\_socket.pyd
%TEMP%\_mei000002e02\_ssl.pyd
%TEMP%\_mei000002e02\_uuid.pyd
%TEMP%\_mei000002e02\_wmi.pyd
%TEMP%\_mei000002e02\_zstd.pyd
%TEMP%\_mei000002e02\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-fibers-l1-1-1.dll
%TEMP%\_mei000002e02\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-kernel32-legacy-l1-1-1.dll
%TEMP%\_mei000002e02\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei000002e02\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-sysinfo-l1-2-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei000002e02\base_library.zip
%TEMP%\_mei000002e02\libcrypto-3.dll
%TEMP%\_mei000002e02\libffi-8.dll
%TEMP%\_mei000002e02\libssl-3.dll
%TEMP%\_mei000002e02\python314.dll
%TEMP%\_mei000002e02\select.pyd
%TEMP%\_mei000002e02\ucrtbase.dll
%TEMP%\_mei000002e02\unicodedata.pyd
%TEMP%\zostealth_3f14b5a7\decoy.exe
%TEMP%\zostealth_3f14b5a7\stealer.exe
%TEMP%\_mei000013a42\vcruntime140.dll
%TEMP%\_mei000013a42\vcruntime140_1.dll
%TEMP%\_mei000013a42\_bz2.pyd
%TEMP%\_mei000013a42\_ctypes.pyd
%TEMP%\_mei000013a42\_decimal.pyd
%TEMP%\_mei000013a42\_hashlib.pyd
%TEMP%\_mei000013a42\_lzma.pyd
%TEMP%\_mei000013a42\_multiprocessing.pyd
%TEMP%\_mei000013a42\_queue.pyd
%TEMP%\_mei000013a42\_socket.pyd
%TEMP%\_mei000013a42\_sqlite3.pyd
%TEMP%\_mei000013a42\_ssl.pyd
%TEMP%\_mei000013a42\_uuid.pyd
%TEMP%\_mei000013a42\_wmi.pyd
%TEMP%\_mei000013a42\_zstd.pyd
%TEMP%\_mei000013a42\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-fibers-l1-1-1.dll
%TEMP%\_mei000013a42\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-kernel32-legacy-l1-1-1.dll
%TEMP%\_mei000013a42\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei000013a42\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-sysinfo-l1-2-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei000013a42\base_library.zip
%TEMP%\_mei000013a42\certifi\cacert.pem
%TEMP%\_mei000013a42\charset_normalizer\cd.cp314-win_amd64.pyd
%TEMP%\_mei000013a42\charset_normalizer\md.cp314-win_amd64.pyd
%TEMP%\_mei000013a42\libcrypto-3.dll
%TEMP%\_mei000013a42\libffi-8.dll
%TEMP%\_mei000013a42\libssl-3.dll
%TEMP%\_mei000013a42\psutil\_psutil_windows.pyd
%TEMP%\_mei000013a42\pyexpat.pyd
%TEMP%\_mei000013a42\python3.dll
%TEMP%\_mei000013a42\python314.dll
%TEMP%\_mei000013a42\pywin32_system32\pywintypes314.dll
%TEMP%\_mei000013a42\select.pyd
%TEMP%\_mei000013a42\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei000013a42\sqlite3.dll
%TEMP%\_mei000013a42\ucrtbase.dll
%TEMP%\_mei000013a42\unicodedata.pyd
%TEMP%\_mei000013a42\win32\win32crypt.pyd
%TEMP%\logindata_temp.db
%TEMP%\history_temp.db

Deletes following files that it created itself

%TEMP%\_mei000002e02\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-fibers-l1-1-1.dll
%TEMP%\_mei000002e02\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-kernel32-legacy-l1-1-1.dll
%TEMP%\_mei000002e02\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei000002e02\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-sysinfo-l1-2-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei000002e02\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei000002e02\base_library.zip
%TEMP%\_mei000002e02\libcrypto-3.dll
%TEMP%\_mei000002e02\libffi-8.dll
%TEMP%\_mei000002e02\libssl-3.dll
%TEMP%\_mei000002e02\python314.dll
%TEMP%\_mei000002e02\select.pyd
%TEMP%\_mei000002e02\ucrtbase.dll
%TEMP%\_mei000002e02\unicodedata.pyd
%TEMP%\_mei000002e02\vcruntime140.dll
%TEMP%\_mei000002e02\vcruntime140_1.dll
%TEMP%\_mei000002e02\_bz2.pyd
%TEMP%\_mei000002e02\_ctypes.pyd
%TEMP%\_mei000002e02\_decimal.pyd
%TEMP%\_mei000002e02\_hashlib.pyd
%TEMP%\_mei000002e02\_lzma.pyd
%TEMP%\_mei000002e02\_socket.pyd
%TEMP%\_mei000002e02\_ssl.pyd
%TEMP%\_mei000002e02\_uuid.pyd
%TEMP%\_mei000002e02\_wmi.pyd
%TEMP%\_mei000002e02\_zstd.pyd
%TEMP%\logindata_temp.db
%TEMP%\history_temp.db
%TEMP%\_mei000013a42\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-fibers-l1-1-1.dll
%TEMP%\_mei000013a42\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-kernel32-legacy-l1-1-1.dll
%TEMP%\_mei000013a42\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei000013a42\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-sysinfo-l1-2-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei000013a42\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei000013a42\base_library.zip
%TEMP%\_mei000013a42\certifi\cacert.pem
%TEMP%\_mei000013a42\charset_normalizer\cd.cp314-win_amd64.pyd
%TEMP%\_mei000013a42\charset_normalizer\md.cp314-win_amd64.pyd
%TEMP%\_mei000013a42\libcrypto-3.dll
%TEMP%\_mei000013a42\libffi-8.dll
%TEMP%\_mei000013a42\libssl-3.dll
%TEMP%\_mei000013a42\psutil\_psutil_windows.pyd
%TEMP%\_mei000013a42\pyexpat.pyd
%TEMP%\_mei000013a42\python3.dll
%TEMP%\_mei000013a42\python314.dll
%TEMP%\_mei000013a42\pywin32_system32\pywintypes314.dll
%TEMP%\_mei000013a42\select.pyd
%TEMP%\_mei000013a42\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei000013a42\sqlite3.dll
%TEMP%\_mei000013a42\ucrtbase.dll
%TEMP%\_mei000013a42\unicodedata.pyd
%TEMP%\_mei000013a42\vcruntime140.dll
%TEMP%\_mei000013a42\vcruntime140_1.dll
%TEMP%\_mei000013a42\win32\win32crypt.pyd
%TEMP%\_mei000013a42\_bz2.pyd
%TEMP%\_mei000013a42\_ctypes.pyd
%TEMP%\_mei000013a42\_decimal.pyd
%TEMP%\_mei000013a42\_hashlib.pyd
%TEMP%\_mei000013a42\_lzma.pyd
%TEMP%\_mei000013a42\_multiprocessing.pyd
%TEMP%\_mei000013a42\_queue.pyd
%TEMP%\_mei000013a42\_socket.pyd
%TEMP%\_mei000013a42\_sqlite3.pyd
%TEMP%\_mei000013a42\_ssl.pyd
%TEMP%\_mei000013a42\_uuid.pyd
%TEMP%\_mei000013a42\_wmi.pyd
%TEMP%\_mei000013a42\_zstd.pyd

Substitutes the following files

%TEMP%\logindata_temp.db
%TEMP%\history_temp.db

Network activity

Connects to

'ap#.#pify.org':443
'di##ord.com':443

TCP

Other

'ap#.#pify.org':443
'di##ord.com':443

UDP

DNS ASK ap#.#pify.org
DNS ASK di##ord.com

Miscellaneous

Creates and executes the following

'%TEMP%\zostealth_3f14b5a7\decoy.exe'
'%TEMP%\zostealth_3f14b5a7\stealer.exe'

Restarts the analyzed sample

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней