Trojan.Siggen10.47848

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\software\microsoft\windows\currentversion\run] 'wIMAUcoU.exe' = '%HOMEPATH%\fGsAggQE\wIMAUcoU.exe'
[<HKLM>\software\Wow6432Node\microsoft\windows\currentversion\run] 'YKAIocwM.exe' = '%ALLUSERSPROFILE%\bgsUswsQ\YKAIocwM.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\bgsUswsQ\YKAIocwM.exe,'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,%ALLUSERSPROFILE%\bgsUswsQ\YKAIocwM.exe,'

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\acswEYtU] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\acswEYtU] 'ImagePath' = '%ALLUSERSPROFILE%\RMskQoQk\ZoocUkYE.exe'

Creates the following services

'acswEYtU' %ALLUSERSPROFILE%\RMskQoQk\ZoocUkYE.exe

Malicious functions

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

User Account Control (UAC)

Modifies file system

Creates the following files

%HOMEPATH%\fgsaggqe\wimaucou
<Current directory>\cimu.exe
<Current directory>\euge.exe
<Current directory>\zegu.exe
<Current directory>\vsqg.exe
<Current directory>\lqyi.exe
<Current directory>\smqc.exe
<Current directory>\kiue.exe
<Current directory>\iaqg.exe
<Current directory>\lkwg.exe
<Current directory>\ogei.exe
<Current directory>\zuwc.exe
<Current directory>\smsm.exe
<Current directory>\hsmu.exe
<Current directory>\bmoy.exe
<Current directory>\feqw.exe
<Current directory>\lssw.exe
<Current directory>\mwam.exe
<Current directory>\cesa.exe
<Current directory>\mkyy.exe
<Current directory>\ocyo.exe
<Current directory>\oaok.exe
<Current directory>\kaau.exe
<Current directory>\dwou.exe
<Current directory>\qwco.exe
<Current directory>\layw.exe
<Current directory>\zwau.exe
<Current directory>\jkoc.exe
<Current directory>\rqyy.exe
<Current directory>\cqky.exe
<Current directory>\ccsi.exe
%ALLUSERSPROFILE%\bgsuswsq\ykaiocwm
%HOMEPATH%\fgsaggqe\wimaucou.exe
%ALLUSERSPROFILE%\bgsuswsq\ykaiocwm.exe
%ALLUSERSPROFILE%\rmskqoqk\zoocukye.exe
%WINDIR%\syswow64\config\systemprofile\fgsaggqe\wimaucou
%TEMP%\fuuueqqk.bat
%TEMP%\adobearmhelper.exe
%TEMP%\armui.ini
%ALLUSERSPROFILE%\pauo.txt
<Current directory>\huyy.ico
<Current directory>\iscm.ico
<Current directory>\zqie.exe
<Current directory>\vuia.exe
<Current directory>\yocq.exe
<Current directory>\osys.exe
<Current directory>\aymo.exe
<Current directory>\ooac.exe
<Current directory>\gski.exe
<Current directory>\pqai.exe
<Current directory>\tuks.exe
<Current directory>\vyya.exe
<Current directory>\tuwk.exe
<Current directory>\akew.exe
<Current directory>\lwwc.exe
<Current directory>\eway.exe
<Current directory>\rkkm.exe
<Current directory>\gmyw.exe
<Current directory>\oouk.exe

Deletes the following files

%TEMP%\fuuueqqk.bat
<Current directory>\smqc.exe
<Current directory>\kiue.exe
<Current directory>\iaqg.exe
<Current directory>\lkwg.exe
<Current directory>\ogei.exe
<Current directory>\zuwc.exe
<Current directory>\smsm.exe
<Current directory>\rqyy.exe
<Current directory>\hsmu.exe
<Current directory>\feqw.exe
<Current directory>\lssw.exe
<Current directory>\mwam.exe
<Current directory>\cesa.exe
<Current directory>\mkyy.exe
<Current directory>\ocyo.exe
<Current directory>\oaok.exe
<Current directory>\kaau.exe
<Current directory>\dwou.exe
<Current directory>\qwco.exe
<Current directory>\layw.exe
<Current directory>\zwau.exe
<Current directory>\lqyi.exe
<Current directory>\bmoy.exe
<Current directory>\vsqg.exe
<Current directory>\euge.exe
%TEMP%\armui.ini
<Current directory>\zqie.exe
<Current directory>\ccsi.exe
<Current directory>\vuia.exe
<Current directory>\osys.exe
<Current directory>\aymo.exe
<Current directory>\ooac.exe
<Current directory>\gski.exe
<Current directory>\pqai.exe
<Current directory>\tuks.exe
<Current directory>\vyya.exe
<Current directory>\tuwk.exe
<Current directory>\akew.exe
<Current directory>\lwwc.exe
<Current directory>\eway.exe
<Current directory>\rkkm.exe
<Current directory>\yocq.exe
<Current directory>\gmyw.exe
<Current directory>\cqky.exe
<Current directory>\jkoc.exe
<Current directory>\cimu.exe
<Current directory>\zegu.exe
<Current directory>\oouk.exe

Network activity

TCP

HTTP GET requests

http://google.com/

'bl##k.io':443

UDP

DNS ASK bl##k.io
DNS ASK google.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'YKAIocwM.exe'
ClassName: '' WindowName: 'Microsoft Windows'
ClassName: '' WindowName: 'wIMAUcoU.exe'
ClassName: 'AcrobatSDIWindow' WindowName: ''
ClassName: 'AdobeAcrobat' WindowName: ''

Creates and executes the following

'%HOMEPATH%\fgsaggqe\wimaucou.exe'
'%ALLUSERSPROFILE%\bgsuswsq\ykaiocwm.exe'
'%ALLUSERSPROFILE%\rmskqoqk\zoocukye.exe'
'%TEMP%\adobearmhelper.exe'
'%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1' (with hidden window)
'%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2' (with hidden window)
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\AdobeARMHelper.exe
'%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
'%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
'%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
'%CommonProgramFiles(x86)%\adobe\arm\1.0\adobearm.exe'
'%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\reader_sl.exe'

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта

Скачать с Google Play

Завантажте
Dr.Web для Android

Безкоштовно на 3 місяці
Всі компоненти захисту
Подовження демо в
AppGallery/Google Pay

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней