Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.Siggen18.52555

Added to the Dr.Web virus database: 2022-09-29

Virus description added:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,%LOCALAPPDATA%\koecdksm\suvoqndo.exe'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SuvOqndo' = '%LOCALAPPDATA%\koecdksm\suvoqndo.exe'
Creates or modifies the following files
  • %APPDATA%\microsoft\windows\start menu\programs\startup\suvoqndo.exe
Sets the following service settings
  • [<HKLM>\System\CurrentControlSet\Services\Micorsoft Windows Service] 'ImagePath' = '%TEMP%\ajtvqkyb.sys'
Creates the following services
  • 'Micorsoft Windows Service' %TEMP%\ajtvqkyb.sys
Malicious functions
To bypass firewall, removes or modifies the following registry keys
  • [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
  • [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
  • [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
  • Windows Firewall
  • Windows Update
  • Windows Security Center
  • Windows Defender
blocks the following features:
  • User Account Control (UAC)
  • Windows Security Center
Injects code into
the following system processes:
  • %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
  • %TEMP%\kaqmspfu.exe
  • %ALLUSERSPROFILE%\hcqfhbcj.log
  • %LOCALAPPDATA%\tbigxkwc.log
  • %LOCALAPPDATA%\koecdksm\suvoqndo.exe
  • %TEMP%\ajtvqkyb.sys
  • %WINDIR%\temp\uddfc87.tmp
Sets the 'hidden' attribute to the following files
  • %APPDATA%\microsoft\windows\start menu\programs\startup\suvoqndo.exe
Deletes the following files
  • %WINDIR%\temp\uddfc87.tmp
  • %TEMP%\ajtvqkyb.sys
Network activity
Connects to
  • 'google.com':80
  • 'uk####gdbdkd.com':443
  • 'ht#####rhtchwlhwklf.com':443
  • 'tf###oingy.com':443
  • 'sn#####gcwgaafbtqkt.com':443
  • 'ou###vkvn.com':443
  • 'kh#####kbwhfdiufhaj.com':443
  • 'ub####qslhqyy.com':443
  • 'vw####yyutodtr.com':443
  • 'go#####vwvgqlretxd.com':443
  • 'mu####pvxvrq.com':443
  • 'vo###yqdinl.com':443
  • 'nc#####piawmchfylsy.com':443
  • 'an####ojndegpnm.com':443
TCP
Other
  • 'uk####gdbdkd.com':443
  • 'tf###oingy.com':443
  • 'ou###vkvn.com':443
  • 'sn#####gcwgaafbtqkt.com':443
  • 'kh#####kbwhfdiufhaj.com':443
  • 'ht#####rhtchwlhwklf.com':443
  • 'ub####qslhqyy.com':443
UDP
  • DNS ASK google.com
  • DNS ASK xs###qxa.com
  • DNS ASK ec#####djcyhggfk.com
  • DNS ASK yb#####txtycjemmqng.com
  • DNS ASK vq#####ppvllwxuk.com
  • DNS ASK ms###pvvs.com
  • DNS ASK tu####qmbadaaht.com
  • DNS ASK ux#####flohlhskeyi.com
  • DNS ASK ii###afng.com
  • DNS ASK rc####xjlsypet.com
  • DNS ASK xf###ibvjqd.com
  • DNS ASK mm####glxtdtor.com
  • DNS ASK pr###bwwjvw.com
  • DNS ASK nv###jhivvn.com
  • DNS ASK xo#####mdjwmfcpgsvq.com
  • DNS ASK gn#####vumfclqyug.com
  • DNS ASK yk###vxj.com
  • DNS ASK ib###hye.com
  • DNS ASK jd#####rebamtbcqa.com
  • DNS ASK ll####xrxoqk.com
  • DNS ASK nf####jmdfvqpj.com
  • DNS ASK oq####fyglxye.com
  • DNS ASK gp#####qrjmfydxckai.com
  • DNS ASK fm#####siqsporrgw.com
  • DNS ASK jl###rurxa.com
  • DNS ASK pq#####ftjalqahlo.com
  • DNS ASK ud###oed.com
  • DNS ASK qf###qnr.com
  • DNS ASK uu###cksfo.com
  • DNS ASK fj####jsqreelq.com
  • DNS ASK yy###npgo.com
  • DNS ASK ow#####artmagudc.com
  • DNS ASK bf####dypijthjh.com
  • DNS ASK lv###wthsn.com
  • DNS ASK fy###auygyk.com
  • DNS ASK at#####eqdholwyafo.com
  • DNS ASK lh####gojmdtq.com
  • DNS ASK pb####byxfajxlr.com
  • DNS ASK wb#####qnqsbmhcdcfs.com
  • DNS ASK ij####cfabvpqh.com
  • DNS ASK mr####hohkbsju.com
  • DNS ASK iu#####heehbvhpkp.com
  • DNS ASK hg###appdn.com
  • DNS ASK wp###hff.com
  • DNS ASK xs#####tdkvikelygk.com
  • DNS ASK om###oghcqw.com
  • DNS ASK ie####ccgyvca.com
  • DNS ASK lk#####syhvlugcap.com
  • DNS ASK uo###xvy.com
  • DNS ASK ee####yaxxjqhdo.com
  • DNS ASK rx###yykg.com
  • DNS ASK dc###ewhb.com
  • DNS ASK ha###olwc.com
  • DNS ASK yv#####nppwkfcfvyhj.com
  • DNS ASK yn#####nfeuapbkkjm.com
  • DNS ASK ei#####rvhynghfx.com
  • DNS ASK vo#####umbypgiqba.com
  • DNS ASK gg####vskphnets.com
  • DNS ASK xy###lxriaj.com
  • DNS ASK iv###cjj.com
  • DNS ASK lj####vyyqjch.com
  • DNS ASK uq#####utorxwgums.com
  • DNS ASK kf#####lowsaypemxe.com
  • DNS ASK dt#####wgawuoswof.com
  • DNS ASK hv####dwyoypxkk.com
  • DNS ASK uh###yhafk.com
  • DNS ASK ny####vffift.com
  • DNS ASK gl#####irqjdybfy.com
  • DNS ASK tr####vaoaqol.com
  • DNS ASK xl###lng.com
  • DNS ASK qq###bps.com
  • DNS ASK hj####ieibafwv.com
  • DNS ASK cw###jtgqtt.com
  • DNS ASK ds#####nljlwfpmewvm.com
  • DNS ASK xj#####uufmlirsmgjx.com
  • DNS ASK ks###cnjo.com
  • DNS ASK yr####qkxujrvv.com
  • DNS ASK lt#####qukixovfdaoi.com
  • DNS ASK mm###hrh.com
  • DNS ASK vq#####fhvxttpjr.com
  • DNS ASK bu#####rhaighfcfl.com
  • DNS ASK lv####rmkpdll.com
  • DNS ASK pt#####jjxhdnekeh.com
  • DNS ASK cb#####dlyfkdeeasmu.com
  • DNS ASK xq####idxspuqvi.com
  • DNS ASK os####wmmhjp.com
  • DNS ASK ci#####keaojdxcxu.com
  • DNS ASK qd#####sieseoqlm.com
  • DNS ASK ga###ehqjs.com
  • DNS ASK lr###ktouq.com
  • DNS ASK so#####fxvlmfguite.com
  • DNS ASK hp#####mvccxmimedi.com
  • DNS ASK ec####raikwrwki.com
  • DNS ASK ky####yryembre.com
  • DNS ASK nu#####mgxmhndsob.com
  • DNS ASK cd#####mafnomwyeny.com
  • DNS ASK fa####cctgxdl.com
  • DNS ASK vc#####swogrbmqgfyf.com
  • DNS ASK nu#####grjvwqokbic.com
  • DNS ASK ox###dxd.com
  • DNS ASK hh###gap.com
  • DNS ASK fj###qbvoae.com
  • DNS ASK pg###yurf.com
  • DNS ASK ya###fejdxs.com
  • DNS ASK ye#####bbprvybwqn.com
  • DNS ASK oc###ffwnj.com
  • DNS ASK pu#####fuxgquhguye.com
  • DNS ASK cp#####hyrueqcyxnvo.com
  • DNS ASK bx###oxw.com
  • DNS ASK gv###sip.com
  • DNS ASK ga###slj.com
  • DNS ASK jp####bipilmwsc.com
  • DNS ASK mf###hnjp.com
  • DNS ASK sj###aml.com
  • DNS ASK sp####davslss.com
  • DNS ASK hc###nlr.com
  • DNS ASK de###mdyvt.com
  • DNS ASK hn#####vhxvuoeuap.com
  • DNS ASK fx###tgx.com
  • DNS ASK rx###xbkc.com
  • DNS ASK ku###xnntsk.com
  • DNS ASK ld####dyyxacm.com
  • DNS ASK wa#####mnswdmbuhcn.com
  • DNS ASK tf####kcgigiey.com
  • DNS ASK mv#####wfkayjrqfni.com
  • DNS ASK pp####dwufrb.com
  • DNS ASK nc#####piawmchfylsy.com
  • DNS ASK ti####axvmhsxtk.com
  • DNS ASK cx#####efolgkokdqy.com
  • DNS ASK kh#####kbwhfdiufhaj.com
  • DNS ASK sn#####gcwgaafbtqkt.com
  • DNS ASK tf###oingy.com
  • DNS ASK uk####gdbdkd.com
  • DNS ASK sw###olov.com
  • DNS ASK ub####qslhqyy.com
  • DNS ASK ca###lnlrou.com
  • DNS ASK qb###pyyooh.com
  • DNS ASK vr####jxorlyen.com
  • DNS ASK nv###npx.com
  • DNS ASK vw####yyutodtr.com
  • DNS ASK go#####vwvgqlretxd.com
  • DNS ASK mu####pvxvrq.com
  • DNS ASK em#####wjuvvsvrwj.com
  • DNS ASK du#####abkuappgqxhp.com
  • DNS ASK vo###yqdinl.com
  • DNS ASK xw####iqjdsxk.com
  • DNS ASK ht#####rhtchwlhwklf.com
  • DNS ASK gy####siciis.com
  • DNS ASK ot####jwjvcno.com
  • DNS ASK ta#####luhhediie.com
  • DNS ASK nd#####nkplaavqsfa.com
  • DNS ASK pv###jpvih.com
  • DNS ASK xp#####pcgatgypiepg.com
  • DNS ASK hr####isqjtadka.com
  • DNS ASK xt#####qjrckayml.com
  • DNS ASK ri####rjqsnw.com
  • DNS ASK jm#####clkxellkxgn.com
  • DNS ASK gg#####urkffvsfxxdh.com
  • DNS ASK gj####rakldhem.com
  • DNS ASK ls#####qxvmogvxifm.com
  • DNS ASK ia####mfylemjyq.com
  • DNS ASK me#####cqxdvseeesd.com
  • DNS ASK hb###hxcf.com
  • DNS ASK xh###wpga.com
  • DNS ASK yp###sqx.com
  • DNS ASK ga###ccnb.com
  • DNS ASK le####tmbnofr.com
  • DNS ASK wg###ijomue.com
  • DNS ASK ri####ielwbe.com
  • DNS ASK ex#####uxrdvhijan.com
  • DNS ASK ln###rnhb.com
  • DNS ASK gm###efkqm.com
  • DNS ASK cl#####ixpqmyspofp.com
  • DNS ASK xj#####hxpfekmlcwv.com
  • DNS ASK ku#####xrlyrbffu.com
  • DNS ASK nj####isfxnxw.com
  • DNS ASK ry####smekfu.com
  • DNS ASK ft####jkomqdw.com
  • DNS ASK sh####mbrgcqoeh.com
  • DNS ASK da#####mpfufkvaa.com
  • DNS ASK tt####oohhkrhl.com
  • DNS ASK yb###abknhn.com
  • DNS ASK rb#####qgsmmnnvfv.com
  • DNS ASK mi####cwjddy.com
  • DNS ASK jk####ytlxvytl.com
  • DNS ASK an####ojndegpnm.com
  • DNS ASK ap###ackpqd.com
  • DNS ASK ou###vkvn.com
  • DNS ASK kb###dsc.com
  • DNS ASK qx####scxhradd.com
  • DNS ASK ld###wwwgw.com
  • DNS ASK eo####abjwow.com
  • DNS ASK rr###trt.com
  • DNS ASK ks####hbmctx.com
  • DNS ASK nw#####ynypuhbpkpx.com
  • DNS ASK nk###xbt.com
  • DNS ASK kt###ueyc.com
  • DNS ASK nh####gxtgrnk.com
  • DNS ASK ka#####swjvqgdso.com
  • DNS ASK jp#####akusewlaqfdt.com
  • DNS ASK ji####yxjibyd.com
  • 'localhost':58894
  • 'localhost':60074
Miscellaneous
Creates and executes the following
  • '%TEMP%\kaqmspfu.exe' elevate
  • '%TEMP%\kaqmspfu.exe' admin
  • '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\kaqmspfu.exe"" admin' (with hidden window)
Executes the following
  • '%WINDIR%\syswow64\svchost.exe'
  • '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\kaqmspfu.exe"" admin

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

© Doctor Web
2003 — 2022

Doctor Web is a cybersecurity company focused on threat detection, prevention and response technologies