Trojan.Siggen19.47344

Technical Information

Modifies file system

Creates the following files

%TEMP%\7zipsfx.000\arabic.lg
%TEMP%\7zipsfx.000\ripcserver.dll
%TEMP%\7zipsfx.000\vp8decoder.dll
%TEMP%\7zipsfx.000\webmmux.dll
%TEMP%\7zipsfx.000\webmvorbisdecoder.dll
%TEMP%\7zipsfx.000\rwln.dll
%TEMP%\7zipsfx.000\webmvorbisencoder.dll
%TEMP%\7zipsfx.000\vp8encoder.dll
%TEMP%\7zipsfx.000\rfusclient.exe
%TEMP%\7zipsfx.000\rutserv.exe
%APPDATA%\rut-agent\68001\044c9d1109\rfusclient.exe
%APPDATA%\rut_settings\logs\rms_log_2023-02.html
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\2659c1a560ab92c9c29d4b2b25815ae8
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\2659c1a560ab92c9c29d4b2b25815ae8
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\8890a77645b73478f5b1ded18acbf795_c090a8c88b266c6ff99a97210e92b44d
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\8890a77645b73478f5b1ded18acbf795_c090a8c88b266c6ff99a97210e92b44d
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\0270780f846f08befe0dd8112d932fef
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\0270780f846f08befe0dd8112d932fef
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\da3b6e45325d5fff28cf6bad6065c907_6d5b8e0d46046fc4c98a958d41a4cfb6
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\da3b6e45325d5fff28cf6bad6065c907_6d5b8e0d46046fc4c98a958d41a4cfb6
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\782ac1f7d5b160b0f71f6f92b0912799
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\782ac1f7d5b160b0f71f6f92b0912799
%TEMP%\7zipsfx.000\logo.png
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\6e47dc54834f661fe77b461d2df73d9d
%TEMP%\7zipsfx.000\branding.ini
%TEMP%\7zipsfx.000\config.txt
%TEMP%\7zipsfx.000\chinese simplified.lg
%TEMP%\7zipsfx.000\chinese traditional.lg
%TEMP%\7zipsfx.000\czech.lg
%TEMP%\7zipsfx.000\danish.lg
%TEMP%\7zipsfx.000\dutch.lg
%TEMP%\7zipsfx.000\english.lg
%TEMP%\7zipsfx.000\eula.rtf
%TEMP%\7zipsfx.000\french.lg
%TEMP%\7zipsfx.000\german.lg
%TEMP%\7zipsfx.000\hebrew.lg
%TEMP%\7zipsfx.000\italian.lg
%TEMP%\7zipsfx.000\japanese.lg
%TEMP%\7zipsfx.000\korean.lg
%TEMP%\7zipsfx.000\norwegian.lg
%TEMP%\7zipsfx.000\polish.lg
%TEMP%\7zipsfx.000\portuguese, brazilian.lg
%TEMP%\7zipsfx.000\portuguese.lg
%TEMP%\7zipsfx.000\spanish.lg
%TEMP%\7zipsfx.000\swedish.lg
%TEMP%\7zipsfx.000\turkish.lg
%TEMP%\7zipsfx.000\install.cmd
%TEMP%\7zipsfx.000\settings.dat
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\6e47dc54834f661fe77b461d2df73d9d

Deletes the following files

%TEMP%\7zipsfx.000\rfusclient.exe

Moves the following files

from %TEMP%\7zipsfx.000\arabic.lg to %APPDATA%\rut-agent\68001\044c9d1109\arabic.lg
from %TEMP%\7zipsfx.000\norwegian.lg to %APPDATA%\rut-agent\68001\044c9d1109\norwegian.lg
from %TEMP%\7zipsfx.000\polish.lg to %APPDATA%\rut-agent\68001\044c9d1109\polish.lg
from %TEMP%\7zipsfx.000\portuguese, brazilian.lg to %APPDATA%\rut-agent\68001\044c9d1109\portuguese, brazilian.lg
from %TEMP%\7zipsfx.000\portuguese.lg to %APPDATA%\rut-agent\68001\044c9d1109\portuguese.lg
from %TEMP%\7zipsfx.000\ripcserver.dll to %APPDATA%\rut-agent\68001\044c9d1109\ripcserver.dll
from %TEMP%\7zipsfx.000\rutserv.exe to %APPDATA%\rut-agent\68001\044c9d1109\rutserv.exe
from %TEMP%\7zipsfx.000\settings.dat to %APPDATA%\rut-agent\68001\044c9d1109\settings.dat
from %TEMP%\7zipsfx.000\english.lg to %APPDATA%\rut-agent\68001\044c9d1109\english.lg
from %TEMP%\7zipsfx.000\spanish.lg to %APPDATA%\rut-agent\68001\044c9d1109\spanish.lg
from %TEMP%\7zipsfx.000\swedish.lg to %APPDATA%\rut-agent\68001\044c9d1109\swedish.lg
from %TEMP%\7zipsfx.000\turkish.lg to %APPDATA%\rut-agent\68001\044c9d1109\turkish.lg
from %TEMP%\7zipsfx.000\vp8decoder.dll to %APPDATA%\rut-agent\68001\044c9d1109\vp8decoder.dll
from %TEMP%\7zipsfx.000\vp8encoder.dll to %APPDATA%\rut-agent\68001\044c9d1109\vp8encoder.dll
from %TEMP%\7zipsfx.000\webmmux.dll to %APPDATA%\rut-agent\68001\044c9d1109\webmmux.dll
from %TEMP%\7zipsfx.000\logo.png to %APPDATA%\rut-agent\68001\044c9d1109\logo.png
from %TEMP%\7zipsfx.000\korean.lg to %APPDATA%\rut-agent\68001\044c9d1109\korean.lg
from %TEMP%\7zipsfx.000\japanese.lg to %APPDATA%\rut-agent\68001\044c9d1109\japanese.lg
from %TEMP%\7zipsfx.000\italian.lg to %APPDATA%\rut-agent\68001\044c9d1109\italian.lg
from %TEMP%\7zipsfx.000\install.cmd to %APPDATA%\rut-agent\68001\044c9d1109\install.cmd
from %TEMP%\7zipsfx.000\hebrew.lg to %APPDATA%\rut-agent\68001\044c9d1109\hebrew.lg
from %TEMP%\7zipsfx.000\german.lg to %APPDATA%\rut-agent\68001\044c9d1109\german.lg
from %TEMP%\7zipsfx.000\french.lg to %APPDATA%\rut-agent\68001\044c9d1109\french.lg
from %TEMP%\7zipsfx.000\eula.rtf to %APPDATA%\rut-agent\68001\044c9d1109\eula.rtf
from %TEMP%\7zipsfx.000\rwln.dll to %APPDATA%\rut-agent\68001\044c9d1109\rwln.dll
from %TEMP%\7zipsfx.000\dutch.lg to %APPDATA%\rut-agent\68001\044c9d1109\dutch.lg
from %TEMP%\7zipsfx.000\danish.lg to %APPDATA%\rut-agent\68001\044c9d1109\danish.lg
from %TEMP%\7zipsfx.000\czech.lg to %APPDATA%\rut-agent\68001\044c9d1109\czech.lg
from %TEMP%\7zipsfx.000\config.txt to %APPDATA%\rut-agent\68001\044c9d1109\config.txt
from %TEMP%\7zipsfx.000\chinese traditional.lg to %APPDATA%\rut-agent\68001\044c9d1109\chinese traditional.lg
from %TEMP%\7zipsfx.000\chinese simplified.lg to %APPDATA%\rut-agent\68001\044c9d1109\chinese simplified.lg
from %TEMP%\7zipsfx.000\branding.ini to %APPDATA%\rut-agent\68001\044c9d1109\branding.ini
from %TEMP%\7zipsfx.000\webmvorbisdecoder.dll to %APPDATA%\rut-agent\68001\044c9d1109\webmvorbisdecoder.dll
from %TEMP%\7zipsfx.000\webmvorbisencoder.dll to %APPDATA%\rut-agent\68001\044c9d1109\webmvorbisencoder.dll

Network activity

Connects to

'id.####teutilities.com':5655

TCP

Other

'id.####teutilities.com':5655

UDP

DNS ASK id.####teutilities.com

Miscellaneous

Creates and executes the following

'%TEMP%\7zipsfx.000\rfusclient.exe' -deploy
'%APPDATA%\rut-agent\68001\044c9d1109\rfusclient.exe' -run_agent
'%APPDATA%\rut-agent\68001\044c9d1109\rutserv.exe'
'%APPDATA%\rut-agent\68001\044c9d1109\rutserv.exe' -second
'%APPDATA%\rut-agent\68001\044c9d1109\rfusclient.exe' /tray /user
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZipSfx.000\install.cmd" "' (with hidden window)

Executes the following