Trojan.Siggen18.59748

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\<File name>i
<SYSTEM32>\tasks\firefox
<SYSTEM32>\tasks\dwm
<SYSTEM32>\tasks\lsm
<SYSTEM32>\tasks\firefoxf
<SYSTEM32>\tasks\dwmd
<SYSTEM32>\tasks\wininit
<SYSTEM32>\tasks\lsml
<SYSTEM32>\tasks\winlogonw
<SYSTEM32>\tasks\mdm
<SYSTEM32>\tasks\wininitw
<SYSTEM32>\tasks\winlogon
<SYSTEM32>\tasks\mdmm
<SYSTEM32>\tasks\csrss
<SYSTEM32>\tasks\csrssc
<SYSTEM32>\tasks\spoolsvs
<SYSTEM32>\tasks\spoolsv
<SYSTEM32>\tasks\iexplore
<SYSTEM32>\tasks\audiodga
<SYSTEM32>\tasks\audiodg
<SYSTEM32>\tasks\<File name>
<SYSTEM32>\tasks\iexplorei
<SYSTEM32>\tasks\lsassl
<SYSTEM32>\tasks\lsass

Creates the following files on removable media

<Drive name for removable media>:\1ef8f05b62ba2fbb43b54ba097882e11.exe
<Drive name for removable media>:\winmine.lnk
<Drive name for removable media>:\dotnetfx45_full_setup.lnk
<Drive name for removable media>:\notepad.lnk
<Drive name for removable media>:\calc.lnk
<Drive name for removable media>:\skypesetup.lnk
<Drive name for removable media>:\glidescope_review_rev_010.lnk
<Drive name for removable media>:\holycrosschurchinstructions.lnk
<Drive name for removable media>:\hadac_newsletter_july_2010_final.lnk
<Drive name for removable media>:\issi2013_template_for_posters.lnk
<Drive name for removable media>:\file_p_00000000_1371597592.lnk
<Drive name for removable media>:\thlps_keeper_mayer_1965.lnk
<Drive name for removable media>:\sdszfo.lnk
<Drive name for removable media>:\applicantform_en.lnk
<Drive name for removable media>:\fi51.lnk
<Drive name for removable media>:\hanni_umami_chapter.lnk
<Drive name for removable media>:\weeklysheet1215.lnk
<Drive name for removable media>:\lisp_success.lnk
<Drive name for removable media>:\508softwareandos.lnk
<Drive name for removable media>:\testcertificate.lnk
<Drive name for removable media>:\contoso.lnk
<Drive name for removable media>:\contoso_1.lnk
<Drive name for removable media>:\sdksampleunprivdeveloper.lnk
<Drive name for removable media>:\dashborder_192.lnk
<Drive name for removable media>:\dashborder_96.lnk
<Drive name for removable media>:\default.lnk
<Drive name for removable media>:\delete.lnk
<Drive name for removable media>:\archer.lnk
<Drive name for removable media>:\chromesetup.lnk
<Drive name for removable media>:\jre-7u75-windows-i586-iftw.lnk

Malicious functions

Searches for windows to

detect analytical utilities:

ClassName: 'OLLYDBG', WindowName: ''
ClassName: 'GBDYLLO', WindowName: ''
ClassName: 'pediy06', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'RegmonClass', WindowName: ''
ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\mntemp
<Current directory>\42af1c969fbb7b
<Current directory>\audiodg.exe
%WINDIR%\livekernelreports\0fc223bdacedc3
%WINDIR%\livekernelreports\firefox.exe
%ProgramFiles(x86)%\reference assemblies\microsoft\6cb0b6c459d5d3
%ProgramFiles(x86)%\reference assemblies\microsoft\dwm.exe
%ProgramFiles%\gw\101b941d020240
%ProgramFiles%\gw\lsm.exe
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\56085415360792
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\wininit.exe
%ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\packages\cc11b995f2a76d
%ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\packages\winlogon.exe
C:\totalcmd\language\lsass.exe
C:\far2\encyclopedia\tap\559fba5f8e4410
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\886983d96e3d3e
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\csrss.exe
C:\totalcmd\language\9db6e019d4f04e
C:\totalcmd\language\iexplore.exe
<Current directory>\f3b6ecef712a24
<Current directory>\spoolsv.exe
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\42af1c969fbb7b
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\audiodg.exe
C:\users\public\pictures\sample pictures\9db6e019d4f04e
C:\users\public\pictures\sample pictures\iexplore.exe
%ProgramFiles(x86)%\microsoft visual studio 8\common7\packages\debugger\3a1e524a69f0d2
%ProgramFiles(x86)%\microsoft visual studio 8\common7\packages\debugger\<File name>.exe
C:\far2\encyclopedia\tap\mdm.exe
C:\totalcmd\language\6203df4a6bafc7

Sets the 'hidden' attribute to the following files

<Drive name for removable media>:\1ef8f05b62ba2fbb43b54ba097882e11.exe

Network activity

Connects to

'ac####.samp-loader.ru':80
'ip##fo.io':443

TCP

HTTP GET requests

http://ac####.samp-loader.ru/access.php?CM#######################################################################################################################################################...
http://ac####.samp-loader.ru/access.php?RY#######################################################################################################################################################...

Other

'ip##fo.io':443

UDP

DNS ASK ac####.samp-loader.ru
DNS ASK ip##fo.io

Miscellaneous

Searches for the following windows

ClassName: '18467-41' WindowName: ''

Creates and executes the following

'%ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\packages\winlogon.exe'
'%ProgramFiles(x86)%\microsoft visual studio .net 2003\common7\packages\winlogon.exe' ' (with hidden window)

Executes the following

'<SYSTEM32>\schtasks.exe' /create /tn "<File name>i" /sc MINUTE /mo 5 /tr "'%ProgramFiles(x86)%\Microsoft Visual Studio 8\Common7\Packages\Debugger\<File name>.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\wininit.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 5 /tr "'%ProgramFiles%\gw\lsm.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'%ProgramFiles%\gw\lsm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 9 /tr "'%ProgramFiles%\gw\lsm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'%ProgramFiles(x86)%\Reference Assemblies\Microsoft\dwm.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'<Current directory>\spoolsv.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Reference Assemblies\Microsoft\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 10 /tr "'%WINDIR%\LiveKernelReports\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%WINDIR%\LiveKernelReports\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 6 /tr "'%WINDIR%\LiveKernelReports\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'<Current directory>\audiodg.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'<Current directory>\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'<Current directory>\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\totalcmd\LANGUAGE\lsass.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Microsoft Visual Studio .NET 2003\Common7\Packages\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'%ProgramFiles(x86)%\Microsoft Visual Studio .NET 2003\Common7\Packages\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'%ProgramFiles(x86)%\Microsoft Visual Studio .NET 2003\Common7\Packages\winlogon.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 7 /tr "'C:\Far2\Encyclopedia\tap\mdm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'C:\Far2\Encyclopedia\tap\mdm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "<File name>i" /sc MINUTE /mo 8 /tr "'%ProgramFiles(x86)%\Microsoft Visual Studio 8\Common7\Packages\Debugger\<File name>.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Pictures\Sample Pictures\iexplore.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Pictures\Sample Pictures\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\audiodg.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\audiodg.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\lsass.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'%ProgramFiles(x86)%\Reference Assemblies\Microsoft\dwm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'<Current directory>\spoolsv.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 13 /tr "'C:\totalcmd\LANGUAGE\iexplore.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 9 /tr "'C:\totalcmd\LANGUAGE\iexplore.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\csrss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 6 /tr "'C:\Far2\Encyclopedia\tap\mdm.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Microsoft Visual Studio 8\Common7\Packages\Debugger\<File name>.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'<Current directory>\spoolsv.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\totalcmd\LANGUAGE\lsass.exe'" /rl HIGHEST /f

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial