Trojan.PWS.Siggen1.28640

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '广告神盾' = '%PROGRAM_FILES%\广告神盾\AdShield.exe tray'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wjplay2_20140422164645' = '"%PROGRAM_FILES%\wjplay2\20140422164645\wjplay.exe" -mini'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wjplay2_News_20140422164645' = '"%PROGRAM_FILES%\wjplay2\20140422164645\WJSpeed.exe" -mini'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Txssvr Service] 'Start' = '00000002'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Your Product\woayavc_30309.exe' = '%PROGRAM_FILES%\Your Product\woayavc_30309.exe:*:Enabled:百度杀毒在线安装程序'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Your Product\woayavc_30309.exe' = '%PROGRAM_FILES%\Your Product\woayavc_30309.exe:*:Enabled:百度杀毒在线安装程序'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\meinvying\meinvying.exe' = '%PROGRAM_FILES%\meinvying\meinvying.exe:*:Enabled:ГАЕ®УЄ'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\nsn3.tmp\meinvying.exe' = '%TEMP%\nsn3.tmp\meinvying.exe:*:Enabled:ГАЕ®УЄ'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Your Product\qrgxdr_70739.exe' = '%PROGRAM_FILES%\Your Product\qrgxdr_70739.exe:*:Enabled:百度卫士在线安装程序'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Your Product\qrgxdr_70739.exe' = '%PROGRAM_FILES%\Your Product\qrgxdr_70739.exe:*:Enabled:百度卫士在线安装程序'

Creates and executes the following:

'%PROGRAM_FILES%\wjplay2\20140422164645\WJSpeed.exe'
'%TEMP%\nsj6.tmp\nsD.tmp' sc create "Txssvr Service" binPath= "%PROGRAM_FILES%\aiqngz3.8\Txsvr.exe" start= auto
'%PROGRAM_FILES%\meinvying\meinvying.exe' /A
'%PROGRAM_FILES%\wjplay2\20140422164645\wjplay.exe' -mini
'%TEMP%\nsj6.tmp\nsE.tmp' sc description "Txssvr Service" "Txssvr Service"
'%PROGRAM_FILES%\广告神盾\AdShield.exe' tray
'%PROGRAM_FILES%\广告神盾\server\AdShieldServer.exe' proxy.js -a
'%PROGRAM_FILES%\aiqngz3.8\Aiqngz3.8.exe'
'%PROGRAM_FILES%\aiqngz3.8\fastlo.exe' /s
'%PROGRAM_FILES%\Your Product\setup_open_4705-2508.exe'
'%PROGRAM_FILES%\Your Product\-8670_2508_mny.exe'
'%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:674338 "__IRAFN:<Full path to virus>" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-2052111302-484763869-725345543-1003"
'%PROGRAM_FILES%\Your Product\22222221.exe'
'%PROGRAM_FILES%\Your Product\pczh_107_2508.exe'
'%PROGRAM_FILES%\Your Product\setup_194a_p.exe'
'%TEMP%\nsn3.tmp\meinvying.exe' /fix
'%PROGRAM_FILES%\Your Product\qrgxdr_70739.exe'
'%PROGRAM_FILES%\Your Product\woayavc_30309.exe'

Executes the following:

'<SYSTEM32>\sc.exe' description "Txssvr Service" "Txssvr Service"
'<SYSTEM32>\cmd.exe' /c ""%PROGRAM_FILES%\广告神盾\adclear.bat" "
'<SYSTEM32>\taskkill.exe' /F /im mvhd.exe
'<SYSTEM32>\sc.exe' create "Txssvr Service" binPath= "%PROGRAM_FILES%\aiqngz3.8\Txsvr.exe" start= auto

Searches for registry branches where third party applications store passwords:

[<HKCU>\Software\FlashFXP]

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\广告神盾\res\img\_0020_ѿ.png
%PROGRAM_FILES%\广告神盾\res\img\yun.png
%PROGRAM_FILES%\广告神盾\res\img\ykai.png
%PROGRAM_FILES%\广告神盾\res\img\_0028_׵.png
%PROGRAM_FILES%\广告神盾\res\img\_0025_.png
%PROGRAM_FILES%\广告神盾\res\img\_0024_ȫ.png
%PROGRAM_FILES%\广告神盾\res\img\top1.png
%PROGRAM_FILES%\广告神盾\res\img\t3_1_1.png
%PROGRAM_FILES%\广告神盾\res\img\t3_1.png
%PROGRAM_FILES%\广告神盾\res\img\yguan.png
%PROGRAM_FILES%\广告神盾\res\img\x.png
%PROGRAM_FILES%\广告神盾\res\img\top2.png
%PROGRAM_FILES%\广告神盾\res\js\settings.js
%PROGRAM_FILES%\广告神盾\res\js\progress.js
%PROGRAM_FILES%\广告神盾\res\js\json2.js
%PROGRAM_FILES%\广告神盾\res\sound\tip.wav
%PROGRAM_FILES%\广告神盾\res\settings.html
%PROGRAM_FILES%\广告神盾\res\msgbox.html
%PROGRAM_FILES%\广告神盾\res\InterceptedTip.html
%PROGRAM_FILES%\广告神盾\res\index.html
%PROGRAM_FILES%\广告神盾\res\img\.jpg
%PROGRAM_FILES%\广告神盾\res\js\jquery-1.10.2.min.js
%PROGRAM_FILES%\广告神盾\res\js\index.js
%PROGRAM_FILES%\广告神盾\res\js\common.js
%PROGRAM_FILES%\广告神盾\res\img\con3.png
%PROGRAM_FILES%\广告神盾\res\img\con2.png
%PROGRAM_FILES%\广告神盾\res\img\con1.png
%PROGRAM_FILES%\广告神盾\res\img\guan.png
%PROGRAM_FILES%\广告神盾\res\img\foot.png
%HOMEPATH%\Templates\2220144164642390\YYM_955WD30.gif
%HOMEPATH%\Favorites\Гв·СЙПНшµјєЅ.url
%PROGRAM_FILES%\广告神盾\res\img\0007.gif
%PROGRAM_FILES%\广告神盾\res\img\0006.gif
%PROGRAM_FILES%\广告神盾\res\img\2.png
%PROGRAM_FILES%\广告神盾\res\img\1.png
%HOMEPATH%\Favorites\МмТнѕьКВНш.url
%PROGRAM_FILES%\广告神盾\res\img\t2.png
%PROGRAM_FILES%\广告神盾\res\img\t1_1_1.png
%PROGRAM_FILES%\广告神盾\res\img\t1_1.png
%PROGRAM_FILES%\广告神盾\res\img\t3.png
%PROGRAM_FILES%\广告神盾\res\img\t2_1_1.png
%PROGRAM_FILES%\广告神盾\res\img\t2_1.png
%PROGRAM_FILES%\广告神盾\res\img\logo.png
%PROGRAM_FILES%\广告神盾\res\img\kai.png
%PROGRAM_FILES%\广告神盾\res\img\icon2.gif
%PROGRAM_FILES%\广告神盾\res\img\t1.png
%PROGRAM_FILES%\广告神盾\res\img\t.png
%PROGRAM_FILES%\广告神盾\res\img\logo36.png
%PROGRAM_FILES%\广告神盾\res\tip.htm
%HOMEPATH%\Start Menu\Programs\°®Зй.ЦЗ»Ы.3.8\°®Зй.ЦЗ»Ы.3.8.lnk
%HOMEPATH%\Start Menu\Programs\°®Зй.ЦЗ»Ы.3.8\Р¶ФШ.lnk
%PROGRAM_FILES%\aiqngz3.8\Txsvr.exe
%HOMEPATH%\AppData\LocalLow\MeiNvYing\Fav9.dat
%TEMP%\nsj6.tmp\nsD.tmp
%TEMP%\nsj6.tmp\nsExec.dll
%PROGRAM_FILES%\广告神盾\Update.exe
%PROGRAM_FILES%\广告神盾\uninstall.ico
%PROGRAM_FILES%\广告神盾\UnInstall.exe
%PROGRAM_FILES%\aiqngz3.8\fastlo.exe
%PROGRAM_FILES%\aiqngz3.8\uninstall.exe
%PROGRAM_FILES%\aiqngz3.8\Aiqngz3.8.exe
%TEMP%\nsj6.tmp\md5dll.dll
%APPDATA%\zn2220144\set.ini
%APPDATA%\zn2220144\min.ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\status[1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\status[1]
%TEMP%\nsj6.tmp\Inetc.dll
%TEMP%\nsj6.tmp\Math.dll
%HOMEPATH%\Desktop\°®Зй.ЦЗ»Ы.3.8.lnk
%TEMP%\nsj6.tmp\nsE.tmp
%ALLUSERSPROFILE%\Desktop\广告神盾.lnk
%HOMEPATH%\Start Menu\广告神盾\卸载广告神盾.lnk
%HOMEPATH%\Start Menu\广告神盾\广告神盾.lnk
%PROGRAM_FILES%\广告神盾\server\node_modules\colors\package.json
%PROGRAM_FILES%\广告神盾\server\node_modules\colors\MIT-LICENSE.txt
%PROGRAM_FILES%\广告神盾\server\node_modules\colors\example.js
%PROGRAM_FILES%\广告神盾\server\node_modules\colors\themes\winston-dark.js
%PROGRAM_FILES%\广告神盾\server\node_modules\colors\test.js
%PROGRAM_FILES%\广告神盾\server\node_modules\colors\ReadMe.md
%PROGRAM_FILES%\广告神盾\res\window.html
%PROGRAM_FILES%\广告神盾\res\TrunOnRunTip.html
%PROGRAM_FILES%\广告神盾\res\tip.html
%PROGRAM_FILES%\广告神盾\server\node_modules\colors\example.html
%PROGRAM_FILES%\广告神盾\server\node_modules\colors\colors.js
%PROGRAM_FILES%\广告神盾\server\AdShieldServer.exe
%PROGRAM_FILES%\广告神盾\server\rules\custom.rul
%PROGRAM_FILES%\广告神盾\server\rules\adblock.txt
%PROGRAM_FILES%\广告神盾\server\rules\ad.rul
%PROGRAM_FILES%\广告神盾\server\start.bat
%PROGRAM_FILES%\广告神盾\server\rules\vid.rul
%PROGRAM_FILES%\广告神盾\server\rules\free.txt
%PROGRAM_FILES%\广告神盾\server\res\blank.gif
%PROGRAM_FILES%\广告神盾\server\proxy.js
%PROGRAM_FILES%\广告神盾\server\node_modules\colors\themes\winston-light.js
%PROGRAM_FILES%\广告神盾\server\rules\1.txt
%PROGRAM_FILES%\广告神盾\server\res\v.js
%PROGRAM_FILES%\广告神盾\server\res\rule.pac
%PROGRAM_FILES%\广告神盾\res\css\window.css
%TEMP%\nsp9.tmp\res\onlineWnd.zip
%TEMP%\nsvB.tmp
%TEMP%\nsj6.tmp\Base64.dll
%APPDATA%\FwNetwork\广告神盾\data.zip
%TEMP%\nswC.tmp\res\onlineWnd.zip
%TEMP%\nsj6.tmp\System.dll
%TEMP%\nsn3.tmp\System.dll
%HOMEPATH%\Start Menu\Programs\Your Product\Uninstall Your Product.lnk
%PROGRAM_FILES%\Your Product\Uninstall\IRIMG2.JPG
%TEMP%\nsz8.tmp
%TEMP%\nsn3.tmp\meinvying.exe
%TEMP%\nsj5.tmp
%TEMP%\nswC.tmp\dl.dll
%TEMP%\nsj6.tmp\NSISdl.dll
%TEMP%\nsp9.tmp\dl.dll
%PROGRAM_FILES%\wjplay2\20140422164645\bottom.xml
%PROGRAM_FILES%\广告神盾\adhkdll.dll
%PROGRAM_FILES%\广告神盾\adclear.bat
%TEMP%\nsp9.tmp\BDMSkin.dll
%APPDATA%\FwNetwork\广告神盾\uninstall.exe
%APPDATA%\FwNetwork\广告神盾\setup.ini
%TEMP%\nswC.tmp\BDMDownload.dll
%TEMP%\nsp9.tmp\BDMDownload.dll
%TEMP%\nswC.tmp\BDMSkin.dll
%PROGRAM_FILES%\Your Product\Uninstall\uninstall.xml
%PROGRAM_FILES%\Your Product\uninstall.exe
%PROGRAM_FILES%\Your Product\Uninstall\uninstall.dat
%PROGRAM_FILES%\Your Product\qrgxdr_70739.exe
%PROGRAM_FILES%\Your Product\-8670_2508_mny.exe
%PROGRAM_FILES%\Your Product\setup_open_4705-2508.exe
%TEMP%\_ir_sf_temp_0\IRIMG1.JPG
%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\_ir_sf_temp_0\irsetup.exe
%PROGRAM_FILES%\Your Product\Uninstall\uni1.tmp
%TEMP%\Your Product Setup Log.txt
%TEMP%\_ir_sf_temp_0\IRIMG2.JPG
%HOMEPATH%\Start Menu\Programs\Your Product\№гёжЙс¶Ь°ІЧ°іМРт.lnk
%HOMEPATH%\Start Menu\Programs\Your Product\woayavc_30309.lnk
%HOMEPATH%\Start Menu\Programs\Your Product\qrgxdr_70739.lnk
%PROGRAM_FILES%\Your Product\Uninstall\IRIMG1.JPG
%HOMEPATH%\Start Menu\Programs\Your Product\loveyou.lnk
%HOMEPATH%\Start Menu\Programs\Your Product\pczh_107_2508.lnk
%PROGRAM_FILES%\Your Product\pczh_107_2508.exe
%PROGRAM_FILES%\Your Product\setup_194a_p.exe
%PROGRAM_FILES%\Your Product\woayavc_30309.exe
%HOMEPATH%\Start Menu\Programs\Your Product\-8670_2508_mny.lnk
%HOMEPATH%\Start Menu\Programs\Your Product\ОЮј«У°Тф°ІЧ°іМРт.lnk
%PROGRAM_FILES%\Your Product\22222221.exe
%PROGRAM_FILES%\wjplay2\20140422164645\client.ini
%PROGRAM_FILES%\广告神盾\res\BackgroundTip.html
%TEMP%\nsp9.tmp\tmpi7flio.dll
%TEMP%\nswC.tmp\BDLogicUtils.dll
%PROGRAM_FILES%\广告神盾\res\css\BackgroundTip.css
%ALLUSERSPROFILE%\Desktop\wjplay2.lnk
%TEMP%\nswC.tmp\BDMNetGetInfo.dll
%PROGRAM_FILES%\meinvying\mvyy.exe
%PROGRAM_FILES%\meinvying\meinvying.exe
%PROGRAM_FILES%\wjplay2\20140422164645\WJSpeed.exe
%PROGRAM_FILES%\广告神盾\cfg.ini
%TEMP%\nsp9.tmp\BDMNetGetInfo.dll
%PROGRAM_FILES%\meinvying\uninst.exe
%PROGRAM_FILES%\广告神盾\res\css\index.css
%ALLUSERSPROFILE%\Desktop\ГАЕ®УЄ.lnk
%HOMEPATH%\Start Menu\Programs\wjplay2\№Щ·ЅЦчТі.lnk
%PROGRAM_FILES%\广告神盾\res\css\TrunOnRunTip.css
%PROGRAM_FILES%\广告神盾\res\css\InterceptedTip.css
%HOMEPATH%\Start Menu\Programs\wjplay2\ЕдЦГ№¤ѕЯ\Р¶ФШwjplay2.lnk
%TEMP%\nswC.tmp\tmpndcodz.dll
%HOMEPATH%\Start Menu\Programs\wjplay2\wjplay2.lnk
%PROGRAM_FILES%\meinvying\ГАЕ®УЄ.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\ГАЕ®УЄ\Р¶ФШГАЕ®УЄ.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\ГАЕ®УЄ\ГАЕ®УЄ.lnk
%PROGRAM_FILES%\广告神盾\res\css\common.css
%PROGRAM_FILES%\wjplay2\20140422164645\Data\poptime_bg.png
%PROGRAM_FILES%\wjplay2\20140422164645\Data\loading.gif
%PROGRAM_FILES%\wjplay2\20140422164645\Data\err.jpg
%TEMP%\nsp9.tmp\BDLogicUtils.dll
%PROGRAM_FILES%\wjplay2\20140422164645\Data\User2.ini
%PROGRAM_FILES%\wjplay2\20140422164645\Data\tab_more.png
%TEMP%\nsp9.tmp\hu.dll
%PROGRAM_FILES%\wjplay2\20140422164645\Data\def.jpg
%PROGRAM_FILES%\wjplay2\20140422164645\Data\Def.html
%PROGRAM_FILES%\wjplay2\20140422164645\Data\Err.html
%PROGRAM_FILES%\广告神盾\AdShield.exe
%PROGRAM_FILES%\wjplay2\20140422164645\Data\EKanR.dat
%PROGRAM_FILES%\wjplay2\20140422164645\Unins.exe
%PROGRAM_FILES%\wjplay2\20140422164645\SysConfig.ini
%PROGRAM_FILES%\wjplay2\20140422164645\stat.ini
%TEMP%\nswC.tmp\hu.dll
%PROGRAM_FILES%\wjplay2\20140422164645\wjplay.exe
%PROGRAM_FILES%\广告神盾\BugReport.dll
%PROGRAM_FILES%\wjplay2\20140422164645\locallist.xml
%PROGRAM_FILES%\wjplay2\20140422164645\DuiLib.dll
%PROGRAM_FILES%\wjplay2\20140422164645\Data\wj.ico
%PROGRAM_FILES%\wjplay2\20140422164645\server.ini
%PROGRAM_FILES%\wjplay2\20140422164645\playlist.xml
%PROGRAM_FILES%\wjplay2\20140422164645\PlayerUpdate.exe

Deletes the following files:

%TEMP%\nsj6.tmp\nsE.tmp
%TEMP%\nsj6.tmp\nsD.tmp
%APPDATA%\FwNetwork\广告神盾\data.zip
%APPDATA%\FwNetwork\广告神盾\setup.ini
%HOMEPATH%\Templates\2220144164642390\YYM_955WD30.gif
%PROGRAM_FILES%\Your Product\Uninstall\uni1.tmp
%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\nsn3.tmp\System.dll
%TEMP%\nsn3.tmp\meinvying.exe

Network activity:

Connects to:

'localhost':1058
'localhost':1056
'localhost':8585
'localhost':1059
'localhost':1038
'<Private IP address>':445
'localhost':1050
'xu#.###ogin2.tenpay.com':443

UDP:

DNS ASK up###e.wuji.com
DNS ASK we####.baidu.com
DNS ASK we#.##invying.net
DNS ASK sh###.baidu.com
DNS ASK www.ad###ndun.com
DNS ASK tv.###ingzhihui.com
DNS ASK tj.###ingzhihui.com
DNS ASK tj#.##invying.net
DNS ASK www.go#####analytics.com
DNS ASK up####.aiqingzhihui.com
DNS ASK xu#.###ogin2.tenpay.com
DNS ASK rp.#v.cc
DNS ASK wj.#uji.com
DNS ASK tj.#uji.com
DNS ASK p.#.#aidu.com

Miscellaneous:

Searches for the following windows:

ClassName: 'TFormLoginTips' WindowName: '(null)'
ClassName: 'TFormHuodongMini' WindowName: '(null)'
ClassName: 'TFormMini' WindowName: '(null)'
ClassName: 'TFormTips' WindowName: '(null)'
ClassName: 'WujiPlayer' WindowName: '????????'
ClassName: 'MS_WINHELP' WindowName: '(null)'
ClassName: '(null)' WindowName: '(null)'
ClassName: '#32770' WindowName: '(null)'
ClassName: 'OnLineWnd' WindowName: '(null)'
ClassName: '#32770' WindowName: '????'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'BDMOnLineWnd' WindowName: '(null)'
ClassName: 'TMeiNvYMainForm' WindowName: '(null)'
ClassName: 'THtmFormShow' WindowName: '(null)'
ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial