Trojan.Siggen12.38357

Technical Information

Malicious functions

Reads files which store third party applications passwords

%ProgramFiles(x86)%\steam\config\config.vdf
%ProgramFiles(x86)%\steam\config\dialogconfig.vdf
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\web data
%APPDATA%\opera software\opera stable\login data
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\ovp25012015.doc

Searches for windows to

detect analytical utilities:

ClassName: 'RegmonClass', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''

Modifies file system

Creates the following files

%TEMP%\tmp6c39.tmp
%TEMP%\tmp6e36.tmp
%TEMP%\tmp6e26.tmp
%TEMP%\tmp6e25.tmp
%TEMP%\tmp6e24.tmp
%TEMP%\tmp6e23.tmp
%TEMP%\tmp6e22.tmp
%TEMP%\tmp6e21.tmp
%TEMP%\tmp6e10.tmp
%TEMP%\tmp6e0f.tmp
%TEMP%\tmp6e0e.tmp
%TEMP%\tmp6dfd.tmp
%TEMP%\tmp6dfc.tmp
%TEMP%\tmp6dfb.tmp
%TEMP%\tmp6deb.tmp
%TEMP%\tmp6dea.tmp
%TEMP%\tmp6dd9.tmp
%TEMP%\tmp6dd8.tmp
%TEMP%\tmp6da8.tmp
%TEMP%\tmp6da7.tmp
%TEMP%\tmp6da6.tmp
%TEMP%\tmp6da5.tmp
%TEMP%\tmp6e37.tmp
%TEMP%\tmp6e38.tmp
%TEMP%\tmp6e39.tmp
%TEMP%\tmp6e3a.tmp
%TEMP%\tmp6ebd.tmp
%TEMP%\tmp6ead.tmp
%TEMP%\tmp6e9c.tmp
%TEMP%\tmp6e8c.tmp
%TEMP%\tmp6e8b.tmp
%TEMP%\tmp6e8a.tmp
%TEMP%\tmp6e89.tmp
%TEMP%\tmp6e78.tmp
%TEMP%\tmp6e77.tmp
%TEMP%\tmp6e76.tmp
%TEMP%\tmp6e74.tmp
%TEMP%\tmp6e75.tmp
%TEMP%\tmp6e63.tmp
%TEMP%\tmp6e62.tmp
%TEMP%\tmp6e61.tmp
%TEMP%\tmp6e60.tmp
%TEMP%\tmp6e5f.tmp
%TEMP%\tmp6e4f.tmp
%TEMP%\tmp6e4e.tmp
%TEMP%\tmp6e4d.tmp
%TEMP%\tmp6e4c.tmp
%TEMP%\tmp6e3b.tmp
%TEMP%\tmp6ece.tmp
%TEMP%\tmp6da4.tmp
%TEMP%\tmp6d94.tmp
%TEMP%\tmp6d93.tmp
%TEMP%\tmp6cfa.tmp
%TEMP%\tmp6ce9.tmp
%TEMP%\tmp6ce8.tmp
%TEMP%\tmp6ce7.tmp
%TEMP%\tmp6ce6.tmp
%TEMP%\tmp6cd6.tmp
%TEMP%\tmp6cd5.tmp
%TEMP%\tmp6cd4.tmp
%TEMP%\tmp6cc3.tmp
%TEMP%\tmp6cc2.tmp
%TEMP%\tmp6cb2.tmp
%TEMP%\tmp6cb1.tmp
%TEMP%\tmp6cb0.tmp
%TEMP%\tmp6caf.tmp
%TEMP%\tmp6c9e.tmp
%TEMP%\tmp6c9d.tmp
%TEMP%\tmp6c8c.tmp
%TEMP%\tmp6c8b.tmp
%TEMP%\tmp6c8a.tmp
%TEMP%\tmp6c7a.tmp
%TEMP%\tmp6c3a.tmp
%TEMP%\tmp6cfb.tmp
%TEMP%\tmp6cfc.tmp
%TEMP%\tmp6cfd.tmp
%TEMP%\tmp6d0e.tmp
%TEMP%\tmp6d81.tmp
%TEMP%\tmp6d80.tmp
%TEMP%\tmp6d7f.tmp
%TEMP%\tmp6d6f.tmp
%TEMP%\tmp6d6e.tmp
%TEMP%\tmp6d6d.tmp
%TEMP%\tmp6d6c.tmp
%TEMP%\tmp6d5b.tmp
%TEMP%\tmp6d5a.tmp
%TEMP%\tmp6d59.tmp
%TEMP%\tmp6d47.tmp
%TEMP%\tmp6d48.tmp
%TEMP%\tmp6d46.tmp
%TEMP%\tmp6d36.tmp
%TEMP%\tmp6d35.tmp
%TEMP%\tmp6d34.tmp
%TEMP%\tmp6d33.tmp
%TEMP%\tmp6d32.tmp
%TEMP%\tmp6d21.tmp
%TEMP%\tmp6d20.tmp
%TEMP%\tmp6d1f.tmp
%TEMP%\tmp6d1e.tmp
%TEMP%\tmp6d92.tmp
%APPDATA%\bld.exe

Deletes the following files

%TEMP%\tmp6c3a.tmp
%TEMP%\tmp6deb.tmp
%TEMP%\tmp6dfc.tmp
%TEMP%\tmp6e0e.tmp
%TEMP%\tmp6e10.tmp
%TEMP%\tmp6e22.tmp
%TEMP%\tmp6e24.tmp
%TEMP%\tmp6e26.tmp
%TEMP%\tmp6e37.tmp
%TEMP%\tmp6e39.tmp
%TEMP%\tmp6da8.tmp
%TEMP%\tmp6dd9.tmp
%TEMP%\tmp6e3b.tmp
%TEMP%\tmp6e60.tmp
%TEMP%\tmp6e62.tmp
%TEMP%\tmp6e74.tmp
%TEMP%\tmp6e76.tmp
%TEMP%\tmp6e78.tmp
%TEMP%\tmp6e8a.tmp
%TEMP%\tmp6e8c.tmp
%TEMP%\tmp6e9c.tmp
%TEMP%\tmp6ead.tmp
%TEMP%\tmp6e4d.tmp
%TEMP%\tmp6e4f.tmp
%TEMP%\tmp6da6.tmp
%TEMP%\tmp6da4.tmp
%TEMP%\tmp6d93.tmp
%TEMP%\tmp6c8c.tmp
%TEMP%\tmp6c9e.tmp
%TEMP%\tmp6cb0.tmp
%TEMP%\tmp6cb2.tmp
%TEMP%\tmp6cc3.tmp
%TEMP%\tmp6cd5.tmp
%TEMP%\tmp6ce6.tmp
%TEMP%\tmp6ce8.tmp
%TEMP%\tmp6cfa.tmp
%TEMP%\tmp6cfc.tmp
%TEMP%\tmp6c8a.tmp
%TEMP%\tmp6d0e.tmp
%TEMP%\tmp6d21.tmp
%TEMP%\tmp6d33.tmp
%TEMP%\tmp6d35.tmp
%TEMP%\tmp6d46.tmp
%TEMP%\tmp6d48.tmp
%TEMP%\tmp6d5a.tmp
%TEMP%\tmp6d6c.tmp
%TEMP%\tmp6d6e.tmp
%TEMP%\tmp6d7f.tmp
%TEMP%\tmp6d81.tmp
%TEMP%\tmp6d1f.tmp
%TEMP%\tmp6ebd.tmp
%TEMP%\tmp6ece.tmp

Network activity

Connects to

'18#.#80.231.94':50215
'ap#.ip.sb':443
'13#.#81.241.53':7766
'ic###azip.com':80

TCP

HTTP POST requests

http://18#.###.231.94:50215/ via 18#.#80.231.94

'ap#.ip.sb':443

UDP

DNS ASK ap#.ip.sb
DNS ASK ic###azip.com

Miscellaneous

Searches for the following windows

ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: '18467-41' WindowName: ''
ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''

Creates and executes the following