Trojan.Siggen9.50762

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\iexplore
<SYSTEM32>\tasks\dwm
<SYSTEM32>\tasks\svchost
<SYSTEM32>\tasks\lsass
<SYSTEM32>\tasks\winlogon
<SYSTEM32>\tasks\smss
<SYSTEM32>\tasks\downswapy

Malicious functions

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%APPDATA%\opera software\opera stable\login data
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data

Modifies file system

Creates the following files

%APPDATA%\winperf\ariefknacn89i194a7ok.exe
<Current directory>\gxrire3dsq
<Current directory>\dbex8r0mjx
<Current directory>\3ux1wi6mkt
<Current directory>\tlz79zs5k5
<Current directory>\pktt5cjjpu
<Current directory>\ytl7ewa0mt
<Current directory>\ird8w2mgyi
<Current directory>\94cnhsad5t
<Current directory>\zx7pfaz2dm
<Current directory>\zbtbxyrv6d
<Current directory>\v642uutncw
<Current directory>\om4evmlrgi
<Current directory>\thlbzsbph1
<Current directory>\hdee2klfa8
<Current directory>\mxrzjgufzd
<Current directory>\z8h2s0nbr5
<Current directory>\vaav4wogxh
<Current directory>\q74oog4t25
<Current directory>\6vddbifmlc
<Current directory>\wjoenwww5m
<Current directory>\cnsswbdtnl
<Current directory>\63jv9zwh3v
<Current directory>\0bvvkqtabb
<Current directory>\uhypdscvr9
<Current directory>\n9ecajol9y
<Current directory>\dn7nmo6uuy
<Current directory>\w4qn8p5jwg
<Current directory>\rvfkwh6xpz
<Current directory>\9jrq6yladm
%APPDATA%\winperf\94miemopod8ppdeskdlxoen5rma3mg.bat
%APPDATA%\winperf\xsani4qgnmcyak5zjmejsheaqjkqxk.bat
%APPDATA%\winperf\downswapy.exe
%APPDATA%\winperf\vyndqtgweks9hx0ijzpkzt7fw7vfq8.vbe
C:\perflogs\admin\iexplore.exe
%TEMP%\4b64654a844494ae8a678a34941db990
%ProgramFiles(x86)%\msbuild\microsoft\dwm.exe
C:\perflogs\admin\svchost.exe
C:\msocache\all users\lsass.exe
%ProgramFiles(x86)%\microsoft visual studio 8\common7\packages\debugger\winlogon.exe
C:\totalcmd\language\smss.exe
<Current directory>\eli9gda2ex
<Current directory>\dvmb4mjbcr
<Current directory>\downswapy.exe
<Current directory>\uvrdi3mupm
<Current directory>\nvnefi6cpb
<Current directory>\xzgrx4e4bb
<Current directory>\c8hbu95hjm
<Current directory>\66eajznonj
<Current directory>\2eadfupzpn
<Current directory>\yrsnkpylkg
<Current directory>\nytdeavfi8
<Current directory>\raq2j87dg9
<Current directory>\tf26xoobz4
<Current directory>\abehgdu78e
%APPDATA%\winperf\o9bpkacmu53ddquvcy9ouwbi2v7orh.vbs
<Current directory>\krjsrzhqf2
<Current directory>\apcjwa2hhf

Deletes the following files

<Current directory>\om4evmlrgi
<Current directory>\94cnhsad5t
<Current directory>\zx7pfaz2dm
<Current directory>\zbtbxyrv6d
<Current directory>\v642uutncw
<Current directory>\thlbzsbph1
<Current directory>\dvmb4mjbcr
<Current directory>\hdee2klfa8
<Current directory>\ytl7ewa0mt
<Current directory>\ird8w2mgyi
<Current directory>\mxrzjgufzd
<Current directory>\q74oog4t25
<Current directory>\6vddbifmlc
<Current directory>\wjoenwww5m
<Current directory>\cnsswbdtnl
<Current directory>\63jv9zwh3v
<Current directory>\0bvvkqtabb
<Current directory>\uhypdscvr9
<Current directory>\z8h2s0nbr5
<Current directory>\vaav4wogxh
<Current directory>\pktt5cjjpu
<Current directory>\tlz79zs5k5
<Current directory>\3ux1wi6mkt
<Current directory>\uvrdi3mupm
<Current directory>\nvnefi6cpb
<Current directory>\xzgrx4e4bb
<Current directory>\c8hbu95hjm
<Current directory>\66eajznonj
<Current directory>\2eadfupzpn
<Current directory>\yrsnkpylkg
<Current directory>\nytdeavfi8
<Current directory>\krjsrzhqf2
<Current directory>\raq2j87dg9
<Current directory>\abehgdu78e
<Current directory>\9jrq6yladm
<Current directory>\rvfkwh6xpz
<Current directory>\w4qn8p5jwg
<Current directory>\n9ecajol9y
<Current directory>\dn7nmo6uuy
<Current directory>\gxrire3dsq
<Current directory>\dbex8r0mjx
<Current directory>\tf26xoobz4
<Current directory>\eli9gda2ex
<Current directory>\apcjwa2hhf

Network activity

TCP

HTTP GET requests

http://18#.#20.249.212/wrlk9s52rlnyuch9i8kh8bzax9g3fw1y6h1pwv7p5jtvnxt6ohilbm0u6qu359vdwe0imqqqet6ra0x174ylzf4y/54w1htd5snhc9bbi491f90xg8zsf2l/220e9c9680ea922ea1b9fa5155de3ad62bcaf07d.php?4d###...
http://18#.#20.249.212/wrlk9s52rlnyuch9i8kh8bzax9g3fw1y6h1pwv7p5jtvnxt6ohilbm0u6qu359vdwe0imqqqet6ra0x174ylzf4y/54w1htd5snhc9bbi491f90xg8zsf2l/220e9c9680ea922ea1b9fa5155de3ad62bcaf07d.php?2b###...
http://18#.#20.249.212/wrlk9s52rlnyuch9i8kh8bzax9g3fw1y6h1pwv7p5jtvnxt6ohilbm0u6qu359vdwe0imqqqet6ra0x174ylzf4y/54w1htd5snhc9bbi491f90xg8zsf2l/3jgnhx9smjezbsfvuzo5envtm7nqj8a8/0e8fb847918e4228f...

'ip##fo.io':443

UDP

DNS ASK ip##fo.io

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\wscript.exe' "%APPDATA%\winperf\o9BpkaCMu53DDQuvcy9oUwbi2v7orH.vbs"
'%APPDATA%\winperf\ariefknacn89i194a7ok.exe' -pf0d0dd7f6ebcfebef8377ad27a7484582c5f5b88
'%WINDIR%\syswow64\wscript.exe' "%APPDATA%\winperf\VyNDqTGweKs9HX0IJzPkZT7Fw7vFQ8.vbe"
'%APPDATA%\winperf\downswapy.exe'
'<Current directory>\downswapy.exe'
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\winperf\94mIEmOpOD8pPDeSKDlXOEn5RMA3Mg.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\winperf\XSani4qGNMCyak5ZjmeJsheAqjKqXK.bat" "' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\winperf\94mIEmOpOD8pPDeSKDlXOEn5RMA3Mg.bat" "
'%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\winperf\XSani4qGNMCyak5ZjmeJsheAqjKqXK.bat" "
'%WINDIR%\syswow64\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\PerfLogs\Admin\iexplore.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'%ProgramFiles(x86)%\MSBuild\Microsoft\dwm.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "svchost" /sc ONLOGON /tr "'C:\PerfLogs\Admin\svchost.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\lsass.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Microsoft Visual Studio 8\Common7\Packages\Debugger\winlogon.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\smss.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "downswapy" /sc ONLOGON /tr "'<Current directory>\downswapy.exe'" /rl HIGHEST /f

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта

Скачать с Google Play

Завантажте
Dr.Web для Android

Безкоштовно на 3 місяці
Всі компоненти захисту
Подовження демо в
AppGallery/Google Pay

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней