Trojan.PWS.Siggen3.22031

Technical Information

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx

Modifies file system

Creates the following files

<Current directory>\qad.ds
<Current directory>\guid_app0_1272691709_0908214017387_5.sft
<Current directory>\guid_app0_1272691709_0908214017387_6.sft
<Current directory>\guid_app0_1272691709_0908214017387_7.sft
<Current directory>\guid_app0_1272691709_0908214017387_8.sft
<Current directory>\guid_app0_1272691709_0908214017886_0.sft
<Current directory>\guid_app0_1272691709_0908214017886_1.sft
<Current directory>\guid_app0_1272691709_0908214017886_2.sft
<Current directory>\guid_app0_1272691709_0908214017886_3.sft
<Current directory>\guid_app0_1272691709_0908214017886_4.sft
<Current directory>\guid_app0_1272691709_0908214017886_5.sft
<Current directory>\guid_app0_1272691709_0908214017886_6.sft
<Current directory>\guid_app0_1272691709_0908214017886_7.sft
<Current directory>\guid_app0_1272691709_0908214017886_8.sft
<Current directory>\guid_app0_1272691709_0908214017886_9.sft
<Current directory>\guid_app0_1272691709_0908214017886_10.sft
<Current directory>\guid_app0_1272691709_0908214017886_11.sft
<Current directory>\guid_app0_1272691709_0908214017886_12.sft
<Current directory>\guid_app0_1272691709_0908214017886_13.sft
<Current directory>\guid_app0_1272691709_0908214017886_14.sft
<Current directory>\guid_app0_1272691709_0908214017886_15.sft
<Current directory>\guid_app0_1272691709_0908214017886_16.sft
<Current directory>\guid_app0_1272691709_0908214018089_0.sft
<Current directory>\guid_app0_1272691709_0908214018120_0.sft
<Current directory>\guid_app0_1272691709_0908214018230_0.sft
<Current directory>\guid_app0_1272691709_0908214018230_1.sft
<Current directory>\guid_app0_1272691709_0908214018230_2.sft
<Current directory>\guid_app0_1272691709_0908214018276_0.sft
<Current directory>\guid_app0_1272691709_0908214017387_4.sft
<Current directory>\guid_app0_1272691709_0908214018323_0.sft
<Current directory>\guid_app0_1272691709_0908214017387_3.sft
<Current directory>\guid_app0_1272691709_0908214017387_1.sft
<Current directory>\tlk.ds
<Current directory>\guid_app0_1272691709_0908214014891_0.sft
<Current directory>\guid_app0_1272691709_0908214014954_0.sft
<Current directory>\guid_app0_1272691709_0908214014985_0.sft
<Current directory>\guid_app0_1272691709_0908214015032_0.sft
<Current directory>\guid_app0_1272691709_0908214015063_0.sft
<Current directory>\guid_app0_1272691709_0908214015110_0.sft
<Current directory>\guid_app0_1272691709_0908214015156_0.sft
<Current directory>\guid_app0_1272691709_0908214015203_0.sft
<Current directory>\guid_app0_1272691709_0908214015234_0.sft
<Current directory>\guid_app0_1272691709_0908214015266_0.sft
<Current directory>\guid_app0_1272691709_0908214015312_0.sft
<Current directory>\guid_app0_1272691709_0908214015359_0.sft
<Current directory>\guid_app0_1272691709_0908214015406_0.sft
<Current directory>\guid_app0_1272691709_0908214015593_0.sft
<Current directory>\guid_app0_1272691709_0908214015640_0.sft
<Current directory>\guid_app0_1272691709_0908214015718_0.sft
<Current directory>\guid_app0_1272691709_0908214015780_0.sft
<Current directory>\guid_app0_1272691709_0908214016701_0.sft
<Current directory>\guid_app0_1272691709_0908214016701_1.sft
<Current directory>\guid_app0_1272691709_0908214016841_0.sft
<Current directory>\guid_app0_1272691709_0908214016982_0.sft
<Current directory>\guid_app0_1272691709_0908214017013_0.sft
<Current directory>\guid_app0_1272691709_0908214017153_0.sft
<Current directory>\guid_app0_1272691709_0908214017153_1.sft
<Current directory>\guid_app0_1272691709_0908214017216_0.sft
<Current directory>\guid_app0_1272691709_0908214017387_0.sft
<Current directory>\guid_app0_1272691709_0908214017387_2.sft
<Current directory>\guid_app0_1272691709_0908214018479_0.sft

Sets the 'hidden' attribute to the following files

<Current directory>\guid_app0_1272691709_0908214014891_0.sft
<Current directory>\guid_app0_1272691709_0908214017387_6.sft
<Current directory>\guid_app0_1272691709_0908214017387_7.sft
<Current directory>\guid_app0_1272691709_0908214017387_8.sft
<Current directory>\guid_app0_1272691709_0908214017886_0.sft
<Current directory>\guid_app0_1272691709_0908214017886_1.sft
<Current directory>\guid_app0_1272691709_0908214017886_2.sft
<Current directory>\guid_app0_1272691709_0908214017886_3.sft
<Current directory>\guid_app0_1272691709_0908214017886_4.sft
<Current directory>\guid_app0_1272691709_0908214017886_5.sft
<Current directory>\guid_app0_1272691709_0908214017886_6.sft
<Current directory>\guid_app0_1272691709_0908214017886_7.sft
<Current directory>\guid_app0_1272691709_0908214017886_8.sft
<Current directory>\guid_app0_1272691709_0908214017886_10.sft
<Current directory>\guid_app0_1272691709_0908214018323_0.sft
<Current directory>\guid_app0_1272691709_0908214017886_11.sft
<Current directory>\guid_app0_1272691709_0908214017886_12.sft
<Current directory>\guid_app0_1272691709_0908214017886_13.sft
<Current directory>\guid_app0_1272691709_0908214017886_14.sft
<Current directory>\guid_app0_1272691709_0908214017886_15.sft
<Current directory>\guid_app0_1272691709_0908214017886_16.sft
<Current directory>\guid_app0_1272691709_0908214018089_0.sft
<Current directory>\guid_app0_1272691709_0908214018120_0.sft
<Current directory>\guid_app0_1272691709_0908214018230_0.sft
<Current directory>\guid_app0_1272691709_0908214018230_1.sft
<Current directory>\guid_app0_1272691709_0908214018230_2.sft
<Current directory>\guid_app0_1272691709_0908214018276_0.sft
<Current directory>\guid_app0_1272691709_0908214017387_5.sft
<Current directory>\guid_app0_1272691709_0908214017886_9.sft
<Current directory>\guid_app0_1272691709_0908214017387_4.sft
<Current directory>\guid_app0_1272691709_0908214015593_0.sft
<Current directory>\guid_app0_1272691709_0908214014954_0.sft
<Current directory>\guid_app0_1272691709_0908214014985_0.sft
<Current directory>\guid_app0_1272691709_0908214015032_0.sft
<Current directory>\guid_app0_1272691709_0908214015063_0.sft
<Current directory>\guid_app0_1272691709_0908214015110_0.sft
<Current directory>\guid_app0_1272691709_0908214015156_0.sft
<Current directory>\guid_app0_1272691709_0908214015203_0.sft
<Current directory>\guid_app0_1272691709_0908214015234_0.sft
<Current directory>\guid_app0_1272691709_0908214015266_0.sft
<Current directory>\guid_app0_1272691709_0908214015312_0.sft
<Current directory>\guid_app0_1272691709_0908214015359_0.sft
<Current directory>\guid_app0_1272691709_0908214015406_0.sft
<Current directory>\guid_app0_1272691709_0908214015640_0.sft
<Current directory>\guid_app0_1272691709_0908214017387_2.sft
<Current directory>\guid_app0_1272691709_0908214015718_0.sft
<Current directory>\guid_app0_1272691709_0908214015780_0.sft
<Current directory>\guid_app0_1272691709_0908214016701_0.sft
<Current directory>\guid_app0_1272691709_0908214016701_1.sft
<Current directory>\guid_app0_1272691709_0908214016841_0.sft
<Current directory>\guid_app0_1272691709_0908214016982_0.sft
<Current directory>\guid_app0_1272691709_0908214017013_0.sft
<Current directory>\guid_app0_1272691709_0908214017153_0.sft
<Current directory>\guid_app0_1272691709_0908214017153_1.sft
<Current directory>\guid_app0_1272691709_0908214017216_0.sft
<Current directory>\guid_app0_1272691709_0908214017387_0.sft
<Current directory>\guid_app0_1272691709_0908214017387_1.sft
<Current directory>\guid_app0_1272691709_0908214017387_3.sft
<Current directory>\guid_app0_1272691709_0908214018479_0.sft

Network activity

UDP

'localhost':51273
'localhost':52919

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней