Trojan.Siggen15.19501

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\firefox default browser agent 95711f7cf63bd6ef

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /F -Im "Fri1434b74af36.exe"
'<SYSTEM32>\taskkill.exe' /im "Fri14e8398503.exe" /f

Injects code into

the following user processes:

fri1484990fee93c2f8e.exe

Modifies file system

Creates the following files

%TEMP%\nsa1d7f.tmp
%APPDATA%\euwsuew
%APPDATA%\6321309.scr
%TEMP%\r6f7se.i
%TEMP%\scmeap.su
%TEMP%\chrome 5.exe
%TEMP%\lzmwaqmv.exe
%TEMP%\ykifdqa.1
%TEMP%\7tcinejp.0
%TEMP%\guvil5.sch
%TEMP%\20l2vno.2
%TEMP%\09xu.exe
%TEMP%\7zscfbef41e\setup_install.exe
%TEMP%\7zscfbef41e\libwinpthread-1.dll
%TEMP%\7zscfbef41e\libstdc++-6.dll
%APPDATA%\4890914.scr
%TEMP%\7zscfbef41e\libgcc_s_dw2-1.dll
%TEMP%\7zscfbef41e\libcurl.dll
%TEMP%\7zscfbef41e\fri14fc548bbfdb093c.exe
%TEMP%\7zscfbef41e\fri14e8398503.exe
%TEMP%\7zscfbef41e\fri14af1adda7.exe
%TEMP%\7zscfbef41e\fri14a6f32b92b4d905.exe
%TEMP%\7zscfbef41e\fri148ab4e7c687c2e61.exe
%TEMP%\7zscfbef41e\fri148a7b41dd4e434.exe
%TEMP%\7zscfbef41e\fri14869fa338025f0fc.exe
%TEMP%\7zscfbef41e\fri1484990fee93c2f8e.exe
%TEMP%\7zscfbef41e\fri1465a48b4eaed.exe
%TEMP%\7zscfbef41e\fri1434b74af36.exe
%TEMP%\7zscfbef41e\fri1428082e2a9.exe
%TEMP%\7zscfbef41e\fri140015c14bc2a843b.exe
%TEMP%\setup_installer.exe
%TEMP%\7zscfbef41e\libcurlpp.dll
%APPDATA%\6605949.scr

Sets the 'hidden' attribute to the following files

%APPDATA%\euwsuew

Deletes the following files

%TEMP%\7zscfbef41e\fri140015c14bc2a843b.exe
%TEMP%\7zscfbef41e\fri14e8398503.exe

Network activity

Connects to

'localhost':49164
'im###n.online':80
'ni###nnbest.me':443
'91.##1.67.60':2151
'13#.#81.129.119':4805
't.###amec.com':443
'ma#.to':443
'im##in.club':80
'li###ncode.com':443
'cd#.##scordapp.com':80
'gg##cl.biz':80
'37.#.8.119':80
'45.##3.1.182':80
'hs##ns.xyz':80
'localhost':49166
'cd#.##scordapp.com':443
'ip###ger.org':443

TCP

HTTP GET requests

http://hs##ns.xyz/addInstall.php?ke##############################################################################################################################################################...
http://45.##3.1.182/proxies.txt
http://37.#.8.119/base/api/statistics.php
http://gg##cl.biz/stats/1.php?pu#########
http://gg##cl.biz/check.php?pu########
http://im###n.online/
http://im##in.club/

Other

'localhost':49164
'localhost':49166
'localhost':49167
'cd#.##scordapp.com':80
'cd#.##scordapp.com':443
'ma#.to':443
'li###ncode.com':443
't.###amec.com':443
'91.##1.67.60':2151
'13#.#81.129.119':4805
'ni###nnbest.me':443
'ip###ger.org':443

UDP

DNS ASK hs##ns.xyz
DNS ASK gg##cl.biz
DNS ASK cd#.##scordapp.com
DNS ASK li###ncode.com
DNS ASK ma#.to
DNS ASK t.###amec.com
DNS ASK to#####annpickshop.cc
DNS ASK ni###nnbest.me
DNS ASK im###n.online
DNS ASK im##in.club
DNS ASK gm###ple.com
DNS ASK ip###ger.org

Miscellaneous

Searches for the following windows

ClassName: 'ConsoleWindowClass' WindowName: ''
ClassName: 'EDIT' WindowName: ''
ClassName: '' WindowName: ''

Creates and executes the following

'%TEMP%\setup_installer.exe'
'%TEMP%\7zscfbef41e\fri1434b74af36.exe'
'%TEMP%\lzmwaqmv.exe'
'%APPDATA%\4890914.scr' /S
'%APPDATA%\6605949.scr' /S
'%TEMP%\7zscfbef41e\fri1465a48b4eaed.exe'
'%TEMP%\7zscfbef41e\fri140015c14bc2a843b.exe'
'%TEMP%\7zscfbef41e\fri14af1adda7.exe'
'%TEMP%\7zscfbef41e\fri14fc548bbfdb093c.exe'
'%TEMP%\09xu.exe' -pPtzyIkqLZoCarb5ew
'%TEMP%\7zscfbef41e\fri14a6f32b92b4d905.exe'
'%TEMP%\7zscfbef41e\fri148a7b41dd4e434.exe'
'%TEMP%\7zscfbef41e\fri14e8398503.exe' /mixone
'%TEMP%\7zscfbef41e\fri148ab4e7c687c2e61.exe'
'%TEMP%\7zscfbef41e\setup_install.exe'
'%TEMP%\7zscfbef41e\fri1428082e2a9.exe'
'%APPDATA%\6321309.scr' /S
'%TEMP%\7zscfbef41e\fri1484990fee93c2f8e.exe'
'<SYSTEM32>\rundll32.exe' Shell32.dll,Control_RunDLL .\R6f7sE.I' (with hidden window)
'%APPDATA%\6605949.scr' /S' (with hidden window)
'%APPDATA%\4890914.scr' /S' (with hidden window)
'%APPDATA%\6321309.scr' /S' (with hidden window)
'%APPDATA%\8868826.scr' /S' (with hidden window)
'<SYSTEM32>\cmd.exe' /c copy /y "%TEMP%\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "%TEMP%\09xU.exE") do ...' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /im "Fri14e8398503.exe" /f & erase "%TEMP%\7zSCFBEF41E\Fri14e8398503.exe" & exit' (with hidden window)
'<SYSTEM32>\cmd.exe' /c copy /y "%TEMP%\7zSCFBEF41E\Fri1434b74af36.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "%TEMP%\7zSCFBEF41E\Fri1434b7...' (with hidden window)
'<SYSTEM32>\cmd.exe' /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART con...' (with hidden window)
'%APPDATA%\5919139.scr' /S' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Temp"
'<SYSTEM32>\cmd.exe' /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
'<SYSTEM32>\cmd.exe' /S /D /c" eCHO "
'<SYSTEM32>\cmd.exe' /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART con...
'<SYSTEM32>\mshta.exe' vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & Co...
'<SYSTEM32>\cmd.exe' /c copy /y "%TEMP%\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "%TEMP%\09xU.exE") do ...
'<SYSTEM32>\mshta.exe' VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""%TEMP%\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew ...
'<SYSTEM32>\cmd.exe' /c taskkill /im "Fri14e8398503.exe" /f & erase "%TEMP%\7zSCFBEF41E\Fri14e8398503.exe" & exit
'<SYSTEM32>\cmd.exe' /c copy /y "%TEMP%\7zSCFBEF41E\Fri1434b74af36.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "%TEMP%\7zSCFBEF41E\Fri1434b7...
'<SYSTEM32>\mshta.exe' VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""%TEMP%\7zSCFBEF41E\Fri1434b74af36.exe"" 09xU.exE && STarT 09xU.EXE ...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Temp"
'<SYSTEM32>\control.exe' .\R6f7sE.I
'<SYSTEM32>\cmd.exe' /c Fri140015c14bc2a843b.exe
'<SYSTEM32>\cmd.exe' /c Fri14af1adda7.exe
'<SYSTEM32>\cmd.exe' /c Fri14869fa338025f0fc.exe
'<SYSTEM32>\cmd.exe' /c Fri1428082e2a9.exe
'<SYSTEM32>\cmd.exe' /c Fri1465a48b4eaed.exe
'<SYSTEM32>\cmd.exe' /c Fri1484990fee93c2f8e.exe
'<SYSTEM32>\cmd.exe' /c Fri14a6f32b92b4d905.exe
'<SYSTEM32>\cmd.exe' /c Fri148a7b41dd4e434.exe
'<SYSTEM32>\cmd.exe' /c Fri14e8398503.exe /mixone
'<SYSTEM32>\cmd.exe' /c Fri14fc548bbfdb093c.exe
'<SYSTEM32>\cmd.exe' /c Fri148ab4e7c687c2e61.exe
'<SYSTEM32>\cmd.exe' /c Fri1434b74af36.exe
'<SYSTEM32>\rundll32.exe' Shell32.dll,Control_RunDLL .\R6f7sE.I

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial