Exploit.Siggen2.27048

Technical Information

Malicious functions

Creates and executes the following

'' (downloaded from the Internet)

Creates and executes the following (exploit)

'%APPDATA%\vbc.exe'

Injects code into

the following system processes:

%WINDIR%\syswow64\cmd.exe

Terminates or attempts to terminate

the following system processes:

%WINDIR%\syswow64\cmd.exe

Searches for registry branches where third party applications store passwords

[<HKCU>\Software\LinasFTP\Site Manager]
[<HKCU>\Software\FlashPeak\BlazeFtp\Settings]
[<HKCU>\Software\Ghisler\Total Commander]
[<HKCU>\Software\Far\Plugins\FTP\Hosts]
[<HKCU>\Software\Far2\Plugins\FTP\Hosts]
[<HKCU>\Software\VanDyke\SecureFX]
[<HKLM>\Software\Wow6432Node\NCH Software\Fling\Accounts]
[<HKCU>\Software\NCH Software\Fling\Accounts]
[<HKLM>\Software\Wow6432Node\NCH Software\ClassicFTP\FTPAccounts]
[<HKCU>\Software\NCH Software\ClassicFTP\FTPAccounts]
[<HKCU>\Software\SimonTatham\PuTTY\Sessions]
[<HKLM>\Software\Wow6432Node\SimonTatham\PuTTY\Sessions]
[<HKCU>\Software\Martin Prikryl]
[<HKLM>\Software\Wow6432Node\Martin Prikryl]
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]

Reads files which store third party applications passwords

%APPDATA%\mozilla\firefox\profiles.ini
%LOCALAPPDATA%\google\chrome\user data\default\login data
%APPDATA%\opera software\opera stable\login data
%APPDATA%\thunderbird\profiles.ini

Modifies file system

Creates the following files

%APPDATA%\vbc.exe
%APPDATA%\devs\logins\path\jblmp.exe
%APPDATA%\devs\logins\path\msdnmui.dll
%APPDATA%\devs\logins\path\sgen.exe
%APPDATA%\devs\logins\path\delegates.xml
%APPDATA%\devs\logins\path\interfaces.dll
%APPDATA%\logfile\divider\prv\annodex.xml
%APPDATA%\logfile\divider\prv\73.opends60.dll
%APPDATA%\logfile\divider\prv\x-changelog.xml
%APPDATA%\logfile\divider\prv\x-quattropro.xml
%APPDATA%\devs\logins\path\sbswminetutils.dll
%APPDATA%\devs\logins\path\sbssystemdata.dll
%APPDATA%\customize\serverlib.dll
%APPDATA%\gate\login_sendpass\gadgets\policyadd.xml
%TEMP%\subs\crtowordsit.dll
%TEMP%\hypoglycemia
%TEMP%\quandong.dll
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%APPDATA%\e6f983\35a09b.hdb
%APPDATA%\customize\x-microdvd.xml
%APPDATA%\bkup\permcalc.exe
%APPDATA%\devs\logins\path\bt.xml
%APPDATA%\atom\tail\jp2.xml
%APPDATA%\atom\tail\xdcmake.exe
%TEMP%\edge\zoom\webaccess\pgoui.dll
%TEMP%\edge\zoom\webaccess\hangul-combination-full.xml
%TEMP%\edge\zoom\webaccess\python.xml
%TEMP%\edge\zoom\webaccess\6.opends60.dll
%TEMP%\edge\zoom\webaccess\org.freedesktop.avahi.servicebrowser.xml
%TEMP%\edge\zoom\webaccess\crdbadoplusresen.dll
%TEMP%\edge\zoom\webaccess\connector.xml
%TEMP%\edge\zoom\webaccess\sbsiehost.dll
%TEMP%\edge\zoom\webaccess\microsoftvsa.dll
%APPDATA%\atom\tail\sentenceexceptlist.xml
%TEMP%\nsd6e82.tmp
%APPDATA%\atom\tail\almap.dll
%APPDATA%\atom\tail\download.xml
%APPDATA%\atom\tail\pgoui.dll
%APPDATA%\atom\tail\desktopdma.dll
%APPDATA%\atom\tail\vjupgradepackageui.dll
%APPDATA%\atom\tail\photogen4.xml
%APPDATA%\atom\tail\tridsnui.dll
%APPDATA%\atom\tail\graffilterbar.xml
%APPDATA%\atom\tail\tcprops.dll
%APPDATA%\atom\tail\cpconnectionc.dll
%APPDATA%\atom\tail\samplesharedcontent.xml
%APPDATA%\atom\tail\x-voc.xml
%APPDATA%\e6f983\35a09b.lck
%APPDATA%\e6f983\35a09b.exe