Trojan.Siggen11.59301

Technical Information

Modifies file system

Creates the following files

%TEMP%\nsg8121.tmp
%APPDATA%\gamehall_2345\update\2345gamehall.checkversion.data
%APPDATA%\gamehall_2345\userdata\sessions\1\cookies-journal
%TEMP%\etilqs_zjbsgcak81ftukv
%APPDATA%\gamehall_2345\userdata\sessions\1\cookies
%LOCALAPPDATA%\microsoft\internet explorer\domstore\w37zlxnl\game.2345[1].xml
%APPDATA%\gamehall_2345\onlinedata\temp\a0.data.tmp
%APPDATA%\gamehall_2345\onlinedata\temp\c.ini
%APPDATA%\gamehall_2345\onlinedata\temp\b0.data.tmp
%APPDATA%\gamehall_2345\onlinedata\temp\c0.data.tmp
%APPDATA%\gamehall_2345\onlinedata\temp\d0.data.tmp
%APPDATA%\gamehall_2345\onlinedata\c.ini
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\2345游戏大厅.lnk
%APPDATA%\gamehall_2345\userdata\games\history.dat
%APPDATA%\gamehall_2345\userdata\users\default\avatar.png.tmp
%APPDATA%\gamehall_2345\resource\gameicon\4241_697b6c28e7ef10531d2f0dffee10821a.png.tmp
%APPDATA%\gamehall_2345\resource\favicon\81230e2e2d54b75e876f07108bd7c470.ico.tmp
%APPDATA%\gamehall_2345\resource\gameicon\4330_9ce6fa30b688db810e09d657d8dc6060.png.tmp
%APPDATA%\gamehall_2345\update\download\0\2345gamehall.newversion.data
%APPDATA%\gamehall_2345\statistics\2345gamehall_statistics.lock
%APPDATA%\gamehall_2345\2345gamehall_signature.hzv
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\startmenu\Г¤В§ГіГІГіГ ВєГЈ.lnk
%TEMP%\nsw8132.tmp\system.dll
%TEMP%\nsw8132.tmp\fileinfo.dll
%APPDATA%\gamehall_2345\install.log
%APPDATA%\gamehall_2345\2345gamehall.exe
%APPDATA%\gamehall_2345\coral_extract.dll
%APPDATA%\gamehall_2345\uninstall.exe
%APPDATA%\gamehall_2345\application\2.3.0.977\gamehallmain.dll
%APPDATA%\gamehall_2345\config.ini
%APPDATA%\gamehall_2345\assistant\helpertool64.exe
%APPDATA%\gamehall_2345\resource\gameicon\Г¤В§ГіГІГіГ ВєГЈ.ico
%APPDATA%\gamehall_2345\install.data
%HOMEPATH%\desktop\2345游戏大厅.lnk
%APPDATA%\microsoft\windows\start menu\programs\2345游戏大厅\2345游戏大厅.lnk
%APPDATA%\microsoft\windows\start menu\programs\2345游戏大厅\卸载2345游戏大厅.lnk
%HOMEPATH%\desktop\Г¤В§ГіГІГіГ ВєГЈ.lnk
%APPDATA%\microsoft\windows\start menu\programs\2345游戏大厅\Г¤В§ГіГІГіГ ВєГЈ.lnk
%TEMP%\Г¤В§ГіГІГіГ ВєГЈ.lnk
%APPDATA%\gamehall_2345\statistics\2345gamehall.checkstat.data
%APPDATA%\gamehall_2345\statistics\2345gamehall_realtime_statistics

Deletes the following files

%TEMP%\Г¤В§ГіГІГіГ ВєГЈ.lnk
%TEMP%\nsw8132.tmp\fileinfo.dll
%TEMP%\nsw8132.tmp\system.dll
%APPDATA%\gamehall_2345\update\download\0\2345gamehall.newversion.data
%APPDATA%\gamehall_2345\onlinedata\temp\c.ini
%APPDATA%\gamehall_2345\statistics\2345gamehall_statistics.lock

Moves the following files

from %APPDATA%\gamehall_2345\onlinedata\temp\a0.data.tmp to %APPDATA%\gamehall_2345\onlinedata\temp\a0.data
from %APPDATA%\gamehall_2345\onlinedata\temp\b0.data.tmp to %APPDATA%\gamehall_2345\onlinedata\temp\b0.data
from %APPDATA%\gamehall_2345\onlinedata\temp\c0.data.tmp to %APPDATA%\gamehall_2345\onlinedata\temp\c0.data
from %APPDATA%\gamehall_2345\onlinedata\temp\d0.data.tmp to %APPDATA%\gamehall_2345\onlinedata\temp\d0.data
from %APPDATA%\gamehall_2345\onlinedata\temp\a0.data to %APPDATA%\gamehall_2345\onlinedata\a0.data
from %APPDATA%\gamehall_2345\onlinedata\temp\b0.data to %APPDATA%\gamehall_2345\onlinedata\b0.data
from %APPDATA%\gamehall_2345\onlinedata\temp\c0.data to %APPDATA%\gamehall_2345\onlinedata\c0.data
from %APPDATA%\gamehall_2345\onlinedata\temp\d0.data to %APPDATA%\gamehall_2345\onlinedata\d0.data
from %APPDATA%\gamehall_2345\userdata\users\default\avatar.png.tmp to %APPDATA%\gamehall_2345\userdata\users\default\avatar.png
from %APPDATA%\gamehall_2345\resource\gameicon\4241_697b6c28e7ef10531d2f0dffee10821a.png.tmp to %APPDATA%\gamehall_2345\resource\gameicon\4241_697b6c28e7ef10531d2f0dffee10821a.png
from %APPDATA%\gamehall_2345\resource\favicon\81230e2e2d54b75e876f07108bd7c470.ico.tmp to %APPDATA%\gamehall_2345\resource\favicon\81230e2e2d54b75e876f07108bd7c470.ico
from %APPDATA%\gamehall_2345\resource\gameicon\4330_9ce6fa30b688db810e09d657d8dc6060.png.tmp to %APPDATA%\gamehall_2345\resource\gameicon\4330_9ce6fa30b688db810e09d657d8dc6060.png

Substitutes the following files

%TEMP%\Г¤В§ГіГІГіГ ВєГЈ.lnk
%APPDATA%\gamehall_2345\update\download\0\2345gamehall.newversion.data

Network activity

TCP

HTTP GET requests

http://ga##.2345.com/server/gamebox/?m=###################
http://lo###.2345.com/images/v3/g-login.png
http://do####ad.2345.com/listnames/gamehall/D0/D0_v23.data
http://c.###.163.com/api/v2/getconf?re###########################################################################################################################################################...
http://ga##.2345.com/gameimg/images/37wan/weixin-close.png
http://im###5.2345.com/2345gamehall/touxianghb18091115.png
http://im###1.2345.com/2345gamehall/4241_697B6C28E7EF10531D2F0DFFEE10821A.png
http://cs####cdun.126.net/2.14.4/core.v2.14.4.min.js?v=#######
http://cs####cdun.126.net/2.14.4/light.v2.14.4.min.js?v=#######
http://ga##.2345.com/gameimg/images/37wan/v2/loginreg.png
http://cr#.#igicert.cn/DigiCertGlobalRootCA.crl
http://ga##.2345.com/gameimg/images/37wan/weixin-icon.png
http://c.###.163.com/api/v2/get?re###############################################################################################################################################################...
http://ga##.2345.com/favicon.ico
http://ac.##n.163.com/v2/config/js?pn############################################################
http://ac#####c-dun.126.net/2.7.1_7c08033d/watchman.min.js
http://im###3.2345.com/2345gamehall/4330_9CE6FA30B688DB810E09D657D8DC6060.png
http://ac.###.163yun.com/v3/d?cb#################################################################################################################################################################...
http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbJNRrm8KxusAb7DCqnMkE%3D
http://ga##.2345.com/server/wan/?c=####################################################################################################################################
http://ac#####c-dun.126.net/tool.min.js?v=########
http://do####ad.2345.com/listnames/gamehall/C0/C0_v4.data
http://pa####rt.2345.com/js/client/login_2020_04_17.js?_1###
http://ga##.2345.com/server/wan/?c=###################################################################################################################
http://do####ad.2345.com/listnames/gamehall/A0/A0_v7.data
http://ga##.2345.com/gameimg/css/37wan/v2/common.css
http://ga##.2345.com/gameimg/css/37wan/v2.1/login.css
http://ga##.2345.com/gameimg/js/jq.js
http://ga##.2345.com/gameimg/js/jquery.url.js
http://ga##.2345.com/gameimg/js/libs/jquery.cookie.js
http://ga##.2345.com/gameimg/js/37wan/comm.js
http://ga##.2345.com/gameimg/js/md5.js
http://do####ad.2345.com/listnames/gamehall/B0/B0_v28.data
http://ga##.2345.com/gameimg/js/37wan/login_v2.js?_1###
http://ga##.2345.com/gameimg/images/37wan/logo.png
http://pa####rt.2345.com/js/client/base.js
http://ga##.2345.com/gameimg/images/37wan/bg_bottom.png
http://cs####cdun.126.net/load.min.js?26######
http://pa####rt.2345.com/js/client/jquery.md5.js
http://ga##.2345.com/gameimg/images/37wan/v2/login_welcome.png
http://pa####rt.2345.com/webapi/NELogin/faction?in############################################################################
http://cs####cdun.126.net/plugins.min.js?v=########
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

HTTP POST requests

http://up####.#amehall.2345.com/index.php
http://up####.#amehall.2345.com/switch.php
http://up####.#amehall.2345.com/check_new_version.php

'ga##.2345.com':443

UDP

DNS ASK up####.#amehall.2345.com
DNS ASK ga##.2345.com
DNS ASK do####ad.2345.com
DNS ASK pa####rt.2345.com
DNS ASK cs####cdun.126.net
DNS ASK lo###.2345.com
DNS ASK c.###.163.com
DNS ASK im###5.2345.com
DNS ASK im###3.2345.com
DNS ASK im###1.2345.com
DNS ASK ac#####c-dun.126.net
DNS ASK ac.##n.163.com
DNS ASK ac.###.163yun.com
DNS ASK cr#.#igicert.cn
DNS ASK oc##.#igicert.cn
DNS ASK microsoft.com

Miscellaneous

Searches for the following windows

ClassName: '2345GameHall_MessageWindow' WindowName: 'com2345.gamehall.unique.running.title'
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%APPDATA%\gamehall_2345\assistant\helpertool64.exe' --link_path="%TEMP%\Г„В§Г“ГІГ“ГЂВєГЈ.lnk" --pin_operation=1
'%APPDATA%\gamehall_2345\2345gamehall.exe' --type=utility --action=install-stat
'%APPDATA%\gamehall_2345\2345gamehall.exe' --wd-name=Г„В§Г“ГІГ“ГЂВєГЈ http://ga##.2345.com/server/gamebox/?m=###################
'%APPDATA%\gamehall_2345\2345gamehall.exe' --action=upgrade --type=utility
'%APPDATA%\gamehall_2345\2345gamehall.exe' --mode=ie --pipe-name=1611368612/com2345-332369 --type=renderer
'%APPDATA%\gamehall_2345\2345gamehall.exe' --mode=ie --pipe-name=1611368615/com2345-499494 --type=renderer
'%APPDATA%\gamehall_2345\assistant\helpertool64.exe' --link_path="%TEMP%\Г„В§Г“ГІГ“ГЂВєГЈ.lnk" --pin_operation=1' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней