Trojan.Siggen18.17398

Technical Information

Modifies file system

Creates the following files

%TEMP%\autc34e.tmp
%TEMP%\copytrading\gold.png
%TEMP%\aut91c7.tmp
%TEMP%\copytrading\copy\close.ico
%TEMP%\aut91e8.tmp
%TEMP%\copytrading\copy\minimize.ico
%TEMP%\aut92f2.tmp
%TEMP%\copytrading\red.png
%TEMP%\aut9198.tmp
%TEMP%\copytrading\copy\downline.png
%WINDIR%\fonts\digifacewide regular.ttf
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zl2snzrg\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\9csjn1id\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\nlyfyacu\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\df6b2ylj\desktop.ini
%APPDATA%\microsoft\windows\cookies\desktop.ini
%TEMP%\aut9302.tmp
%TEMP%\copytrading\copy\digifacewide regular.ttf
%TEMP%\aut9197.tmp
%TEMP%\copytrading\null.png
%TEMP%\aut9186.tmp
%HOMEPATH%\desktop\f.a.i.copytrading.lnk
<Current directory>\f.a.i.copytrading.lnk
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
<Current directory>\fai.ico
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hgewrmdn\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\auwih7hs\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\74xx60hi\desktop.ini
%APPDATA%\microsoft\windows\cookies\low\index.dat
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
<Full path to file>.tmp
%TEMP%\aut9175.tmp
%TEMP%\copytrading\green.png
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\80zelbv9\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022070220220703\index.dat
%APPDATA%\microsoft\windows\iecompatcache\index.dat

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hgewrmdn\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\80zelbv9\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\auwih7hs\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\74xx60hi\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zl2snzrg\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\9csjn1id\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\nlyfyacu\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\df6b2ylj\desktop.ini
%APPDATA%\microsoft\windows\cookies\desktop.ini

Deletes the following files

%TEMP%\autc34e.tmp
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\df6b2ylj\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\style[1].css
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\format[1].css
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bootstrap.min[1].css
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\9csjn1id\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022070220220703\index.dat
%APPDATA%\microsoft\windows\cookies\low\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\jquery-1.10.2[1].js
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\autobot_copytrade[1].txt
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\css[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\autobot_copytrading[1].vmp
%TEMP%\aut9302.tmp
%TEMP%\aut92f2.tmp
%TEMP%\aut91e8.tmp
%TEMP%\aut91c7.tmp
%TEMP%\aut9198.tmp
%TEMP%\aut9197.tmp
%TEMP%\aut9186.tmp
%TEMP%\aut9175.tmp
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\nlyfyacu\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zl2snzrg\desktop.ini

Modifies the following files

Substitutes the following executable files

<Full path to file>

Substitutes the following files

%LOCALAPPDATA%\Microsoft\Windows\<INETFILES>\Content.IE5\desktop.ini
%APPDATA%\microsoft\windows\cookies\low\index.dat
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022070220220703\index.dat

Moves itself

from <Full path to file> to <Current directory>\old_<File name>.exe

Deletes itself.

Network activity

Connects to

'10#.#2.25.90':80

TCP

HTTP GET requests

http://10#.#2.25.90/TOOL/AutoBot_CopyTrade.txt
http://10#.#2.25.90/TOOL/AutoBot_Copytrading.vmp
http://10#.#2.25.90/CopyTrading.html
http://10#.#2.25.90/CopyTrading/css
http://10#.#2.25.90/CopyTrading/bootstrap.min.css
http://10#.#2.25.90/CopyTrading/format.css
http://10#.#2.25.90/CopyTrading/style.css
http://10#.#2.25.90/CopyTrading/jquery-1.10.2.js
http://10#.#2.25.90/fonts/glyphicons-halflings-regular.eot?

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'<Full path to file>' /ErrorStdOut
'<SYSTEM32>\cmd.exe' /C RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255' (with hidden window)
'<SYSTEM32>\cmd.exe' /C RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1' (with hidden window)
'<SYSTEM32>\cmd.exe' /C RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8' (with hidden window)

Executes the following