Trojan.PWS.Siggen2.390

Technical Information

Malicious functions:

Creates and executes the following:

'<Current directory>\Data\Total Privacy\local\stubexe\0x051979D0E39EBC7B\TotalPrivacy.exe'

Searches for registry branches where third party applications store passwords:

[<HKCU>\Software\America Online\AIM6\Passwords]
[<HKCU>\SOFTWARE\Yahoo\Pager]
[<HKCU>\Software\Microsoft\MSNMessenger]

Modifies file system:

Creates the following files:

<Current directory>\Data\Total Privacy\local\temp\@APPDATA@\Total Privacy\log2.txt
<Current directory>\Data\Total Privacy\roaming\meta\@APPDATA@\Total Privacy\log2.txt.__meta__.__tmp__
<Current directory>\Data\Total Privacy\roaming\modified\@APPDATA@\Total Privacy\log.txt
<Current directory>\Data\Total Privacy\local\temp\@APPDATA@\Total Privacy\log.txt
<Current directory>\Data\Total Privacy\roaming\meta\@APPDATA@\Total Privacy\log.txt.__meta__.__tmp__
<Current directory>\Data\Total Privacy\local\temp\@APPDATALOCAL@\Licenses\{08F99BC7-F692-44B0-BEEB-87FAEE320370}\setup.ini
<Current directory>\Data\Total Privacy\roaming\meta\@APPDATA@\Pointstone\Total Privacy\6\Settings.xml.__meta__.__tmp__
<Current directory>\Data\Total Privacy\roaming\modified\@APPDATA@\Pointstone\Total Privacy\6\Settings.xml
<Current directory>\Data\Total Privacy\local\temp\@APPDATA@\Pointstone\Total Privacy\6\Settings.xml
<Current directory>\Data\Total Privacy\local\meta\@APPDATALOCAL@\Licenses\{08F99BC7-F692-44B0-BEEB-87FAEE320370}\setup.ini.__meta__.__tmp__
<Current directory>\Data\Total Privacy\local\modified\@APPDATALOCAL@\Licenses\{08F99BC7-F692-44B0-BEEB-87FAEE320370}\setup.ini
<Current directory>\Data\Total Privacy\local\stubexe\0x051979D0E39EBC7B\TotalPrivacy.exe.__tmp__
<Current directory>\Data\Total Privacy\local\stubexe\0x051979D0E39EBC7B\TotalPrivacy.exe.manifest.__tmp__
<Current directory>\Data\Total Privacy\local\meta\@PROGRAMFILESX86@\Pointstone\Total Privacy 6\TotalPrivacy.exe.__meta__.__tmp__
<Current directory>\Data\Total Privacy\xsandbox.bin.__tmp__
<Current directory>\Data\Total Privacy\local\temp\@PROGRAMFILESX86@\Pointstone\Total Privacy 6\TotalPrivacy.exe
%TEMP%\SPOON\CACHE\0x356FA2EF983BF843\sxs\_UACAwareApplication@1.0.0.0\_UACAwareApplication@1.0.0.0.manifest.__tmp__
<Current directory>\Data\Total Privacy\local\temp\@PROGRAMFILESX86@\Pointstone\Total Privacy 6\log.txt
<Current directory>\Data\Total Privacy\roaming\meta\@PROGRAMFILESX86@\Pointstone\Total Privacy 6\log.txt.__meta__.__tmp__
%TEMP%\SPOON\CACHE\0x356FA2EF983BF843\sxs\Manifests\TotalPrivacy.exe_0x2328682e603d0817cf7d5f61d4d6e733.1.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x356FA2EF983BF843\sxs\_UACAwareApplication@1.0.0.0\UACAwareApplication.manifest.__tmp__
%TEMP%\SPOON\CACHE\0x356FA2EF983BF843\sxs\Manifests\Shredder.exe_0xb8514866c6de4d2dbc523041b1f8f6f1.1.manifest.__tmp__

Deletes the following files:

<Current directory>\Data\Total Privacy\roaming\modified\@APPDATA@\Total Privacy\log2.txt
<Current directory>\Data\Total Privacy\roaming\meta\@APPDATA@\Total Privacy\log2.txt.__meta__
<Current directory>\Data\Total Privacy\roaming\modified\@PROGRAMFILESX86@\Pointstone\Total Privacy 6\log.txt
<Current directory>\Data\Total Privacy\roaming\meta\@PROGRAMFILESX86@\Pointstone\Total Privacy 6\log.txt.__meta__

Moves the following files:

from <Current directory>\Data\Total Privacy\roaming\meta\@APPDATA@\Total Privacy\log.txt.__meta__.__tmp__ to <Current directory>\Data\Total Privacy\roaming\meta\@APPDATA@\Total Privacy\log.txt.__meta__
from <Current directory>\Data\Total Privacy\local\temp\@APPDATA@\Total Privacy\log2.txt to <Current directory>\Data\Total Privacy\roaming\modified\@APPDATA@\Total Privacy\log2.txt
from <Current directory>\Data\Total Privacy\roaming\meta\@PROGRAMFILESX86@\Pointstone\Total Privacy 6\log.txt.__meta__.__tmp__ to <Current directory>\Data\Total Privacy\roaming\meta\@PROGRAMFILESX86@\Pointstone\Total Privacy 6\log.txt.__meta__
from <Current directory>\Data\Total Privacy\local\temp\@APPDATA@\Total Privacy\log.txt to <Current directory>\Data\Total Privacy\roaming\modified\@APPDATA@\Total Privacy\log.txt
from <Current directory>\Data\Total Privacy\roaming\meta\@APPDATA@\Total Privacy\log2.txt.__meta__.__tmp__ to <Current directory>\Data\Total Privacy\roaming\meta\@APPDATA@\Total Privacy\log2.txt.__meta__
from <Current directory>\Data\Total Privacy\local\temp\@APPDATA@\Pointstone\Total Privacy\6\Settings.xml to <Current directory>\Data\Total Privacy\roaming\modified\@APPDATA@\Pointstone\Total Privacy\6\Settings.xml
from <Current directory>\Data\Total Privacy\roaming\meta\@APPDATA@\Pointstone\Total Privacy\6\Settings.xml.__meta__.__tmp__ to <Current directory>\Data\Total Privacy\roaming\meta\@APPDATA@\Pointstone\Total Privacy\6\Settings.xml.__meta__
from <Current directory>\Data\Total Privacy\local\temp\@APPDATALOCAL@\Licenses\{08F99BC7-F692-44B0-BEEB-87FAEE320370}\setup.ini to <Current directory>\Data\Total Privacy\local\modified\@APPDATALOCAL@\Licenses\{08F99BC7-F692-44B0-BEEB-87FAEE320370}\setup.ini
from <Current directory>\Data\Total Privacy\local\meta\@APPDATALOCAL@\Licenses\{08F99BC7-F692-44B0-BEEB-87FAEE320370}\setup.ini.__meta__.__tmp__ to <Current directory>\Data\Total Privacy\local\meta\@APPDATALOCAL@\Licenses\{08F99BC7-F692-44B0-BEEB-87FAEE320370}\setup.ini.__meta__
from <Current directory>\Data\Total Privacy\local\temp\@PROGRAMFILESX86@\Pointstone\Total Privacy 6\log.txt to <Current directory>\Data\Total Privacy\roaming\modified\@PROGRAMFILESX86@\Pointstone\Total Privacy 6\log.txt
from <Current directory>\Data\Total Privacy\local\meta\@PROGRAMFILESX86@\Pointstone\Total Privacy 6\TotalPrivacy.exe.__meta__.__tmp__ to <Current directory>\Data\Total Privacy\local\meta\@PROGRAMFILESX86@\Pointstone\Total Privacy 6\TotalPrivacy.exe.__meta__
from <Current directory>\Data\Total Privacy\local\stubexe\0x051979D0E39EBC7B\TotalPrivacy.exe.__tmp__ to <Current directory>\Data\Total Privacy\local\stubexe\0x051979D0E39EBC7B\TotalPrivacy.exe
from <Current directory>\Data\Total Privacy\xsandbox.bin.__tmp__ to <Current directory>\Data\Total Privacy\xsandbox.bin
from <Current directory>\Data\Total Privacy\local\temp\@PROGRAMFILESX86@\Pointstone\Total Privacy 6\TotalPrivacy.exe to <Current directory>\Data\Total Privacy\local\modified\@PROGRAMFILESX86@\Pointstone\Total Privacy 6\TotalPrivacy.exe
from <Current directory>\Data\Total Privacy\local\stubexe\0x051979D0E39EBC7B\TotalPrivacy.exe.manifest.__tmp__ to <Current directory>\Data\Total Privacy\local\stubexe\0x051979D0E39EBC7B\TotalPrivacy.exe.manifest
from %TEMP%\SPOON\CACHE\0x356FA2EF983BF843\sxs\Manifests\Shredder.exe_0xb8514866c6de4d2dbc523041b1f8f6f1.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x356FA2EF983BF843\sxs\Manifests\Shredder.exe_0xb8514866c6de4d2dbc523041b1f8f6f1.1.manifest
from %TEMP%\SPOON\CACHE\0x356FA2EF983BF843\sxs\Manifests\TotalPrivacy.exe_0x2328682e603d0817cf7d5f61d4d6e733.1.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x356FA2EF983BF843\sxs\Manifests\TotalPrivacy.exe_0x2328682e603d0817cf7d5f61d4d6e733.1.manifest
from %TEMP%\SPOON\CACHE\0x356FA2EF983BF843\sxs\_UACAwareApplication@1.0.0.0\_UACAwareApplication@1.0.0.0.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x356FA2EF983BF843\sxs\_UACAwareApplication@1.0.0.0\_UACAwareApplication@1.0.0.0.manifest
from %TEMP%\SPOON\CACHE\0x356FA2EF983BF843\sxs\_UACAwareApplication@1.0.0.0\UACAwareApplication.manifest.__tmp__ to %TEMP%\SPOON\CACHE\0x356FA2EF983BF843\sxs\_UACAwareApplication@1.0.0.0\UACAwareApplication.manifest

Substitutes the following files:

<Current directory>\Data\Total Privacy\roaming\modified\@PROGRAMFILESX86@\Pointstone\Total Privacy 6\log.txt
<Current directory>\Data\Total Privacy\roaming\modified\@APPDATA@\Total Privacy\log2.txt

Network activity:

Connects to:

'st###.spoon.net':443

UDP:

DNS ASK st###.spoon.net

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней