Trojan.Siggen9.9817

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\8D8EoDbzN] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\8D8EoDbzN] 'ImagePath' = '%WINDIR%\SysWOW64\8D8EoDbzN.sys'

Malicious functions

To complicate detection of its presence in the operating system,

modifies the following system settings:

DNS server to '114.114.114.114'
DNS server to '<DNS_SERVER>'

Injects code into

the following user processes:

jaac06.exe

Modifies file system

Creates the following files

%HOMEPATH%\desktop\<File name>.lnk
<Current directory>\deccef4e10\cd6056596b97\j4904f7845\a8b6ab0qp.dll
<Current directory>\deccef4e10\cd6056596b97\h3fc444e0\6ae8kazyo.dll
<Current directory>\deccef4e10\df9ed0a1\49a5bb0po.dll
<Current directory>\deccef4e10\eac4476584\c2c47xwml.dll
<Current directory>\deccef4e10\a76b08\70b8lcb0q.dll
<Current directory>\deccef4e10\aa339d03c\2544ypodc.dll
<Current directory>\deccef4e10\g6b482ea0bda\9ad1xomcb.dll
<Current directory>\deccef4e10\df3dbaa64\5426lbayo.dll
%WINDIR%\syswow64\8d8eodbzn.sys
<Current directory>\deccef4e10\cd6056596b97\j4904f7845\f936d2srh.dll
<Current directory>\deccef4e10\cd6056596b97\eb89a0e\2fc23tshg.dll
<Current directory>\deccef4e10\cd6056596b97\e3259fc44\b387h6wvl.dll
<Current directory>\deccef4e10\cd6056596b97\f5e6080f656\3252jj8yx.dll
<Current directory>\deccef4e10\cd6056596b97\bb0fdc\b59atkj8y.dll
<Current directory>\deccef4e10\cd6056596b97\h3fc444e0\5725llbaz.dll
<Current directory>\deccef4e10\d86ba9d
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020020820200209\index.dat
%ProgramFiles(x86)%\qip 2012\jaac06.exe
<Current directory>\deccef4e10\cd6056596b97\j864802\746cxnaaz.dll
<DRIVERS>\1wfnn8nj.sys

Deletes the following files

%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020020820200209\index.dat
<Current directory>\deccef4e10\d86ba9d
<Current directory>\deccef4e10\cd6056596b97\h3fc444e0\5725llbaz.dll
<Current directory>\deccef4e10\cd6056596b97\j4904f7845\f936d2srh.dll
<DRIVERS>\etc\hosts

Substitutes the following files

%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020020820200209\index.dat
<Current directory>\deccef4e10\d86ba9d
<Current directory>\deccef4e10\cd6056596b97\h3fc444e0\5725llbaz.dll
<Current directory>\deccef4e10\cd6056596b97\j4904f7845\f936d2srh.dll

Network activity

Connects to

'1.##4.187.4':80

TCP

HTTP GET requests

http://www.ba##u.com/
http://os#.##iyungx.com/exeFeatureCode.rar
http://os#.##iyungx.com/md5exe.rar
http://os#.##iyungx.com/listh.rar
http://os#.##iyungx.com/xinlistj.rar
http://os#.##iyungx.com/data.php?t=#####
http://si###torage.cn/question/PrsProt64.rar
http://si###torage.cn/question/B64d.rar
http://si###loud.net/question/dpkf28109.rar
http://si###torage.com/question/pl13890.rar
http://jd##.########ite.cn-north-4.myhuaweicloud.com/favicon.ico
http://si###torage.com/question/vc8
http://co####.51yes.com/sa.htm?id################################################################################################################################################################...
http://co####.51yes.com/click.aspx?id#################
http://jd##.########ite.cn-north-4.myhuaweicloud.com/images/logo.png
http://jd##.########ite.cn-north-4.myhuaweicloud.com/images/banner.png
http://jd##.######-zhangjiakou.aliyuncs.com/no.png
http://jd##.########ite.cn-north-4.myhuaweicloud.com/images/a_logo.png
http://jd##.######-zhangjiakou.aliyuncs.com/index.html
http://jd##.########ite.cn-north-4.myhuaweicloud.com/
http://co####5.51yes.com/sa.htm?id###############################################################################################################################################################...
http://co####5.51yes.com/click.aspx?id##################
http://ji#####.yaotongji.com:8080/ via ji#####.yaotongji.com
http://bj##me.cn/nt.asp
http://si###torage.cn/question/dns.txt
http://si###torage.cn/question/jdgg.txt
http://si###torage.cn/question/jdhh.txt
http://si###torage.cn/question/xinjdtc.txt
http://si###torage.cn/question/data.txt
http://si###torage.cn/question/xinjdmfnx.txt
http://os#.##iyungx.com/updata64.php?t=#######
http://os#.##iyungx.com/updata64.rar