Trojan.Siggen18.13586

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\netdlx64] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\netdlx64] 'ImagePath' = '<DRIVERS>\netdlx64.sys'
[<HKLM>\SYSTEM\CurrentControlSet\Services\i8041par] 'ImagePath' = '%ALLUSERSPROFILE%\Microsoft\Network\i8041par.dat'
[<HKLM>\SYSTEM\CurrentControlSet\Services\i8041par] 'Start' = '00000001'
[<HKLM>\SYSTEM\ControlSet001\Services\i8041par] 'ImagePath' = '%ALLUSERSPROFILE%\Microsoft\Network\i8041par.dat'
[<HKLM>\SYSTEM\ControlSet001\Services\i8041par] 'Start' = '00000001'
[<HKLM>\SYSTEM\ControlSet002\Services\i8041par] 'ImagePath' = '%ALLUSERSPROFILE%\Microsoft\Network\i8041par.dat'
[<HKLM>\SYSTEM\ControlSet002\Services\i8041par] 'Start' = '00000001'
[<HKLM>\SYSTEM\CurrentControlSet\Services\65FE437EB224] 'ImagePath' = '%ALLUSERSPROFILE%\Microsoft\Windows\65FE437EB224.dat'
[<HKLM>\SYSTEM\CurrentControlSet\Services\65FE437EB224] 'Start' = '00000001'
[<HKLM>\SYSTEM\ControlSet001\Services\65FE437EB224] 'ImagePath' = '%ALLUSERSPROFILE%\Microsoft\Windows\65FE437EB224.dat'
[<HKLM>\SYSTEM\ControlSet001\Services\65FE437EB224] 'Start' = '00000001'
[<HKLM>\SYSTEM\ControlSet002\Services\65FE437EB224] 'ImagePath' = '%ALLUSERSPROFILE%\Microsoft\Windows\65FE437EB224.dat'
[<HKLM>\SYSTEM\ControlSet002\Services\65FE437EB224] 'Start' = '00000001'

Creates the following services

'netdlx64' <DRIVERS>\netdlx64.sys
'i8041par' %ALLUSERSPROFILE%\Microsoft\Network\i8041par.dat
'65FE437EB224' %ALLUSERSPROFILE%\Microsoft\Windows\65FE437EB224.dat

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

Modifies file system

Creates the following files

C:\180В»ВіВѕГ©ВёВґВ№ГҐ[В№Г№В·ВЅГµГЅВ°Г¦]v4.39\180В»ВіВѕГ©ВёВґВ№ГҐ[В№Г№В·ВЅГµГЅВ°Г¦]v4.39.exe
%ALLUSERSPROFILE%\microsoft\windows\gmredmea.log
%WINDIR%\temp\udde560.tmp
<Current directory>\delself.cmd
%ALLUSERSPROFILE%\microsoft\crypto\caac.crt
%ALLUSERSPROFILE%\microsoft\network\i8041par.dat
%WINDIR%\temp\udddb60.tmp
<DRIVERS>\netdlx64.sys
%ALLUSERSPROFILE%\playtomenu.exe
C:\180В»ВіВѕГ©ВёВґВ№ГҐ[В№Г№В·ВЅГµГЅВ°Г¦]v439.lnk
C:\180В»ВіВѕГ©ВёВґВ№ГҐ[В№Г№В·ВЅГµГЅВ°Г¦]v4.39\data\newopui.pak
C:\180В»ВіВѕГ©ВёВґВ№ГҐ[В№Г№В·ВЅГµГЅВ°Г¦]v4.39\wav\sound.lst
C:\180В»ВіВѕГ©ВёВґВ№ГҐ[В№Г№В·ВЅГµГЅВ°Г¦]v4.39\music\Г¶ГµВЅГЎ.mp3
C:\180В»ВіВѕГ©ВёВґВ№ГҐ[В№Г№В·ВЅГµГЅВ°Г¦]v4.39\music\7Г©В±.mp3
C:\180В»ВіВѕГ©ВёВґВ№ГҐ[В№Г№В·ВЅГµГЅВ°Г¦]v4.39\music\6Г©В±.mp3
C:\180В»ВіВѕГ©ВёВґВ№ГҐ[В№Г№В·ВЅГµГЅВ°Г¦]v4.39\music\5Г©В±.mp3
C:\180В»ВіВѕГ©ВёВґВ№ГҐ[В№Г№В·ВЅГµГЅВ°Г¦]v4.39\music\4Г©В±.mp3
C:\180В»ВіВѕГ©ВёВґВ№ГҐ[В№Г№В·ВЅГµГЅВ°Г¦]v4.39\music\3Г©В±.mp3
%ALLUSERSPROFILE%\playtomenu.jpg
C:\180В»ВіВѕГ©ВёВґВ№ГҐ[В№Г№В·ВЅГµГЅВ°Г¦]v4.39\music\2Г©В±.mp3
C:\180В»ВіВѕГ©ВёВґВ№ГҐ[В№Г№В·ВЅГµГЅВ°Г¦]v4.39\music\1Г©В±.mp3
C:\180В»ВіВѕГ©ВёВґВ№ГҐ[В№Г№В·ВЅГµГЅВ°Г¦]v4.39\lt180\data\ГЎВ¬Г©В±.pak
C:\180В»ВіВѕГ©ВёВґВ№ГҐ[В№Г№В·ВЅГµГЅВ°Г¦]v4.39\lt180\data\Г®ВўГ°ГҐГЈГјВ±ВЈ.pak
C:\180В»ВіВѕГ©ВёВґВ№ГҐ[В№Г№В·ВЅГµГЅВ°Г¦]v4.39\lt180\data\ts.pak
%TEMP%\ВІВ№В¶ВЎ.zip
%ALLUSERSPROFILE%\rr.exe
%ALLUSERSPROFILE%\microsoft\windows\65fe437eb224.dat
%ALLUSERSPROFILE%\microsoft\gmredmea.tmp

Deletes the following files

%TEMP%\ВІВ№В¶ВЎ.zip
%WINDIR%\temp\udddb60.tmp
%ALLUSERSPROFILE%\playtomenu.exe
%ALLUSERSPROFILE%\microsoft\crypto\caac.crt
<Current directory>\delself.cmd
%WINDIR%\temp\udde560.tmp
%ALLUSERSPROFILE%\rr.exe
%ALLUSERSPROFILE%\playtomenu.jpg

Moves the following files

from C:\180В»ВіВѕГ©ВёВґВ№ГҐ[В№Г№В·ВЅГµГЅВ°Г¦]v439.lnk to %HOMEPATH%\desktop\180В»ВіВѕГ©ВёВґВ№ГҐ[В№Г№В·ВЅГµГЅВ°Г¦]v439.lnk

Substitutes the following files

<Current directory>\delself.cmd

Deletes itself.

Network activity

Connects to

'tj#.##l1l1l1l1.com':888
'do###.#1l1l1l1l1.com':8888
'a.##sf.com':7000
'ai####jinaibj.xyz':20358
'ai####jinaibj.xyz':62453
'ai###ngzhou.top':6677
'localhost':443
'do###.#1l1l1l1l1.com':888
'microsoft.com':80
'co###ogood.com':34238
'47.##.144.232':38000
'ai###ngzhou.top':20358

TCP

HTTP GET requests

http://www.ba##u.com/shell/?pa############################################################################
http://do###.##l1l1l1l1.com:8888/R.jpg
http://do###.##l1l1l1l1.com:8888/playtomenu.jpg
http://ai#####zhou.top:6677/link.html
http://ai#####zhou.top:6677/link/images/new_sp.png
http://ai#####zhou.top:6677/link/images/new_a.png
http://ai#####zhou.top:6677/link/images/link01_bg.jpg
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://co###ogood.com/auth7.bin
http://47.##.144.232/txlsddlx64_7.dat

Other

'a.##sf.com':7000
'ai####jinaibj.xyz':20358
'ai####jinaibj.xyz':62453

UDP

DNS ASK tj#.##l1l1l1l1.com
DNS ASK do###.#1l1l1l1l1.com
DNS ASK a.##sf.com
DNS ASK ai####jinaibj.xyz
DNS ASK ai###ngzhou.top
DNS ASK tj.##pay.com
DNS ASK mi####rl.27tj.com
DNS ASK microsoft.com
DNS ASK co###ogood.com

Miscellaneous

Adds a root certificate

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%ALLUSERSPROFILE%\rr.exe' -y x -pF5C6X5S9W5D9C6X5C6S2D8 "%ALLUSERSPROFILE%\playtomenu.jpg" "%ALLUSERSPROFILE%\"
'%ALLUSERSPROFILE%\playtomenu.exe'
'%ALLUSERSPROFILE%\rr.exe' -y x -pF5C6X5S9W5D9C6X5C6S2D8 "%ALLUSERSPROFILE%\playtomenu.jpg" "%ALLUSERSPROFILE%\"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c delself.cmd' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c delself.cmd' (with hidden window)

Executes the following