Trojan.Siggen31.38223

Technical Information

Malicious functions

Searches for registry branches where third party applications store passwords

[HKLM\SOFTWARE\Wow6432Node\Ghisler\Windows Commander]
[HKLM\SOFTWARE\Wow6432Node\Ghisler\Total Commander]
[HKCU\SOFTWARE\Ghisler\Total Commander]
[HKCU\SOFTWARE\Ghisler\Windows Commander]
[HKLM\SOFTWARE\Ghisler\Total Commander]

Modifies file system

Creates the following files

%TEMP%\autc2b2.tmp
%WINDIR%\temp\temp_1\restfiles\vidbanner.mp4
%TEMP%\auted8a.tmp
%WINDIR%\temp\temp_1\restfiles\setup.exe
%TEMP%\autf5a6.tmp
%WINDIR%\temp\temp_1\restfiles\license.txt
%TEMP%\autf5f5.tmp
%WINDIR%\temp\temp_1\restfiles\wincmd.ini
%TEMP%\autf615.tmp
%WINDIR%\temp\temp_1\restfiles\tcnag.dll
%TEMP%\autf6c1.tmp
%WINDIR%\temp\temp_1\restfiles\tcnag64.dll
%TEMP%\autf720.tmp
%WINDIR%\temp\temp_1\restfiles\tcrun.cfg
%TEMP%\autf750.tmp
%WINDIR%\temp\temp_1\restfiles\tcrun.exe
%TEMP%\autf7ae.tmp
%WINDIR%\temp\temp_1\restfiles\tcrun64.cfg
%TEMP%\autf80d.tmp
%WINDIR%\temp\temp_1\restfiles\tcrun64.exe
%APPDATA%\ghisler\wincmd.ini
%ProgramFiles%\totalcmd\keyboard.txt
%ProgramFiles%\totalcmd\totalcmd.chm
%ProgramFiles%\totalcmd\language\wcmd_cz.lng
%ProgramFiles%\totalcmd\language\wcmd_cz.mnu
%ProgramFiles%\totalcmd\language\wcmd_cz.inc
%ProgramFiles%\totalcmd\language\wcmd_dan.lng
%ProgramFiles%\totalcmd\language\wcmd_dan.mnu
%ProgramFiles%\totalcmd\language\wcmd_dan.inc
%ProgramFiles%\totalcmd\language\wcmd_deu.lng
%ProgramFiles%\totalcmd\language\wcmd_deu.mnu
%ProgramFiles%\totalcmd\language\wcmd_deu.inc
%ProgramFiles%\totalcmd\language\wcmd_dut.lng
%ProgramFiles%\totalcmd\language\wcmd_dut.mnu
%ProgramFiles%\totalcmd\language\wcmd_dut.inc
%ProgramFiles%\totalcmd\language\wcmd_eng.mnu
%ProgramFiles%\totalcmd\language\wcmd_esp.lng
%ProgramFiles%\totalcmd\language\wcmd_esp.mnu
%ProgramFiles%\totalcmd\language\wcmd_esp.inc
%ProgramFiles%\totalcmd\language\wcmd_fra.lng
%ProgramFiles%\totalcmd\language\wcmd_fra.mnu
%ProgramFiles%\totalcmd\language\wcmd_fra.inc
%ProgramFiles%\totalcmd\language\wcmd_hun.lng
%ProgramFiles%\totalcmd\language\wcmd_hun.mnu
%ProgramFiles%\totalcmd\language\wcmd_hun.inc
%ProgramFiles%\totalcmd\language\wcmd_rom.lng
%ProgramFiles%\totalcmd\language\wcmd_rom.mnu
%ProgramFiles%\totalcmd\language\wcmd_rom.inc
%ProgramFiles%\totalcmd\language\wcmd_ita.lng
%ProgramFiles%\totalcmd\language\wcmd_ita.mnu
%ProgramFiles%\totalcmd\language\wcmd_ita.inc
%ProgramFiles%\totalcmd\language\wcmd_nor.lng
%ProgramFiles%\totalcmd\language\wcmd_nor.mnu
%ProgramFiles%\totalcmd\language\wcmd_pol.lng
%ProgramFiles%\totalcmd\language\wcmd_pol.mnu
%ProgramFiles%\totalcmd\language\wcmd_pol.inc
%ProgramFiles%\totalcmd\language\wcmd_sk.lng
%ProgramFiles%\totalcmd\language\wcmd_sk.mnu
%ProgramFiles%\totalcmd\language\wcmd_svn.lng
%ProgramFiles%\totalcmd\language\wcmd_svn.mnu
%ProgramFiles%\totalcmd\language\wcmd_svn.inc
%ProgramFiles%\totalcmd\language\wcmd_swe.lng
%ProgramFiles%\totalcmd\language\wcmd_swe.mnu
%ProgramFiles%\totalcmd\language\wcmd_swe.inc
%ProgramFiles%\totalcmd\language\wcmd_kor.lng
%ProgramFiles%\totalcmd\language\wcmd_kor.mnu
%ProgramFiles%\totalcmd\language\wcmd_kor.inc
%ProgramFiles%\totalcmd\language\wcmd_chn.lng
%ProgramFiles%\totalcmd\language\wcmd_chn.mnu
%ProgramFiles%\totalcmd\language\wcmd_chn.inc
%ProgramFiles%\totalcmd\language\wcmd_rus.lng
%ProgramFiles%\totalcmd\language\wcmd_rus.mnu
%ProgramFiles%\totalcmd\language\wcmd_rus.inc
%ProgramFiles%\totalcmd\language\wcmd_ukr.lng
%ProgramFiles%\totalcmd\language\wcmd_ukr.mnu
%ProgramFiles%\totalcmd\language\wcmd_ukr.inc
%ProgramFiles%\totalcmd\filter32\autopitch.dll
%ProgramFiles%\totalcmd\filter32\soundtouchdll.dll
%ProgramFiles%\totalcmd\filter32\soundtouchdll_license.txt
%ProgramFiles%\totalcmd\filter32\vmr9rotator.dll
%ProgramFiles%\totalcmd\filter64\autopitch.dll
%ProgramFiles%\totalcmd\filter64\soundtouchdll_x64.dll
%ProgramFiles%\totalcmd\filter64\soundtouchdll_license.txt
%ProgramFiles%\totalcmd\filter64\vmr9rotator.dll
%ProgramFiles%\totalcmd\descript.ion
%ProgramFiles%\totalcmd\history.txt
%ProgramFiles%\totalcmd\default.bar
%ProgramFiles%\totalcmd\no.bar
%ProgramFiles%\totalcmd\vertical.bar
%ProgramFiles%\totalcmd\tcunin64.wul
%ProgramFiles%\totalcmd\tcuninst.wul
%ProgramFiles%\totalcmd\wcuninst.wul
%ProgramFiles%\totalcmd\totalcmd.inc
%ProgramFiles%\totalcmd\unrar64.dll
%ProgramFiles%\totalcmd\wcmicons.dll
%ProgramFiles%\totalcmd\wcmicon2.dll
%ProgramFiles%\totalcmd\wcmicons.inc
%ProgramFiles%\totalcmd\wcmzip64.dll
%ProgramFiles%\totalcmd\tcunzl64.dll
%ProgramFiles%\totalcmd\tclzma64.dll
%ProgramFiles%\totalcmd\tc7z64.dll
%ProgramFiles%\totalcmd\tcbit7z64.dll
%ProgramFiles%\totalcmd\blakex64.dll
%ProgramFiles%\totalcmd\tczstd64.dll
%ProgramFiles%\totalcmd\libdeflate64.dll
%ProgramFiles%\totalcmd\tcsharewin10x64.dll
%ProgramFiles%\totalcmd\sfxhead.sfx
%ProgramFiles%\totalcmd\tc7z.sfx
%ProgramFiles%\totalcmd\tcmadm64.exe
%ProgramFiles%\totalcmd\tcunin64.exe
%ProgramFiles%\totalcmd\tcmdx32.exe
%ProgramFiles%\totalcmd\noclose64.exe
%ProgramFiles%\totalcmd\cglpt64.sys
%ProgramFiles%\totalcmd\tcusbrun.exe
%ProgramFiles%\totalcmd\cglpt9x.vxd
%ProgramFiles%\totalcmd\cglptnt.sys
%ProgramFiles%\totalcmd\tcunzlib.dll
%ProgramFiles%\totalcmd\tcmdlzma.dll
%ProgramFiles%\totalcmd\wc32to16.exe
%ProgramFiles%\totalcmd\wcmzip32.dll
%ProgramFiles%\totalcmd\freres32.dll
%ProgramFiles%\totalcmd\cabrk.dll
%ProgramFiles%\totalcmd\unacev2.dll
%ProgramFiles%\totalcmd\unrar.dll
%ProgramFiles%\totalcmd\unrar9x.dll
%ProgramFiles%\totalcmd\blakex32.dll
%ProgramFiles%\totalcmd\tc7zipif.dll
%ProgramFiles%\totalcmd\tcbit7z.dll
%ProgramFiles%\totalcmd\tc7z.dll
%ProgramFiles%\totalcmd\tczstd32.dll
%ProgramFiles%\totalcmd\libdeflate.dll
%ProgramFiles%\totalcmd\share_nt.exe
%ProgramFiles%\totalcmd\tcmdx64.exe
%ProgramFiles%\totalcmd\tcmadmin.exe
%ProgramFiles%\totalcmd\noclose.exe
%ProgramFiles%\totalcmd\totalcmd.exe
%ProgramFiles%\totalcmd\totalcmd.exe.manifest
%ProgramFiles%\totalcmd\tcuninst.exe
%ProgramFiles%\totalcmd\tcsharewin10.dll
%ProgramFiles%\totalcmd\totalcmd64.exe
%ProgramFiles%\totalcmd\totalcmd64.exe.manifest
%APPDATA%\microsoft\windows\start menu\programs\total commander\total commander 64 bit.lnk
%APPDATA%\microsoft\windows\start menu\programs\total commander\total commander.lnk
%APPDATA%\microsoft\windows\start menu\programs\total commander\total commander help.lnk
%APPDATA%\microsoft\windows\start menu\programs\total commander\uninstall or repair total commander.lnk
%HOMEPATH%\desktop\total commander 64 bit.lnk
%HOMEPATH%\desktop\total commander.lnk
%ProgramFiles%\totalcmd\license.txt
%ProgramFiles%\totalcmd\tcnag.dll
%ProgramFiles%\totalcmd\tcnag64.dll
%ProgramFiles%\totalcmd\tcrun.cfg
%ProgramFiles%\totalcmd\tcrun.exe
%ProgramFiles%\totalcmd\tcrun64.cfg
%ProgramFiles%\totalcmd\tcrun64.exe

Deletes the following files

%TEMP%\autc2b2.tmp
%TEMP%\auted8a.tmp
%TEMP%\autf5a6.tmp
%TEMP%\autf5f5.tmp
%TEMP%\autf615.tmp
%TEMP%\autf6c1.tmp
%TEMP%\autf720.tmp
%TEMP%\autf750.tmp
%TEMP%\autf7ae.tmp
%TEMP%\autf80d.tmp
%HOMEPATH%\desktop\total commander.lnk
%APPDATA%\ghisler\wincmd.ini
%WINDIR%\temp\temp_1\restfiles\license.txt
%WINDIR%\temp\temp_1\restfiles\setup.exe
%WINDIR%\temp\temp_1\restfiles\tcnag.dll
%WINDIR%\temp\temp_1\restfiles\tcnag64.dll
%WINDIR%\temp\temp_1\restfiles\tcrun.cfg
%WINDIR%\temp\temp_1\restfiles\tcrun.exe
%WINDIR%\temp\temp_1\restfiles\tcrun64.cfg
%WINDIR%\temp\temp_1\restfiles\tcrun64.exe
%WINDIR%\temp\temp_1\restfiles\vidbanner.mp4
%WINDIR%\temp\temp_1\restfiles\wincmd.ini

Modifies the following files

%LOCALAPPDATA%\microsoft\media player\currentdatabase_372.wmdb

Substitutes the following files

%APPDATA%\ghisler\wincmd.ini

Network activity

UDP

DNS ASK co##############e-chains.prod.autograph.services.mozaws.net

Miscellaneous

Searches for the following windows

ClassName: 'WMPlayerApp' WindowName: ''
ClassName: 'BUTTON' WindowName: ''

Creates and executes the following

'%WINDIR%\temp\temp_1\restfiles\setup.exe' /AHMGDU

Executes the following

'%WINDIR%\temp\temp_1\restfiles\setup.exe' /AHMGDU' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial