Trojan.Siggen21.48820

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-octmd.tmp\<File name>.tmp
%ProgramFiles(x86)%\chroller\unins000.dat
%ProgramFiles(x86)%\chroller\is-pgh6v.tmp
%ProgramFiles(x86)%\chroller\is-avq6g.tmp
%ProgramFiles(x86)%\chroller\is-pva92.tmp
%ProgramFiles(x86)%\chroller\is-niq8q.tmp
%ProgramFiles(x86)%\chroller\is-2c8le.tmp
%ProgramFiles(x86)%\chroller\is-gfvcd.tmp
%ProgramFiles(x86)%\chroller\is-jjtar.tmp
%ProgramFiles(x86)%\chroller\is-r74nb.tmp
%ProgramFiles(x86)%\chroller\is-bkm66.tmp
%ProgramFiles(x86)%\chroller\is-knpq6.tmp
%ProgramFiles(x86)%\chroller\is-37c5e.tmp
%ProgramFiles(x86)%\chroller\is-8n3lu.tmp
%ProgramFiles(x86)%\chroller\is-alfs3.tmp
%ProgramFiles(x86)%\chroller\is-fv1ic.tmp
%ProgramFiles(x86)%\chroller\is-u1059.tmp
%ProgramFiles(x86)%\chroller\is-5cpeh.tmp
%ProgramFiles(x86)%\chroller\is-rueqd.tmp
%ProgramFiles(x86)%\chroller\is-s7d2l.tmp
%ProgramFiles(x86)%\chroller\is-utud5.tmp
%ProgramFiles(x86)%\chroller\is-eapi9.tmp
%TEMP%\is-3b8hc.tmp\_isetup\_iscrypt.dll
%TEMP%\is-3b8hc.tmp\_isetup\_shfoldr.dll
%TEMP%\is-3b8hc.tmp\_isetup\_setup64.tmp
%TEMP%\is-3b8hc.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\chroller\chroller.exe
%TEMP%\license.txt

Moves the following files

from %ProgramFiles(x86)%\chroller\is-eapi9.tmp to %ProgramFiles(x86)%\chroller\unins000.exe
from %ProgramFiles(x86)%\chroller\is-pva92.tmp to %ProgramFiles(x86)%\chroller\home_page.html
from %ProgramFiles(x86)%\chroller\is-niq8q.tmp to %ProgramFiles(x86)%\chroller\dvdimage._ex
from %ProgramFiles(x86)%\chroller\is-2c8le.tmp to %ProgramFiles(x86)%\chroller\splitter.dll
from %ProgramFiles(x86)%\chroller\is-gfvcd.tmp to %ProgramFiles(x86)%\chroller\quickref.txt
from %ProgramFiles(x86)%\chroller\is-jjtar.tmp to %ProgramFiles(x86)%\chroller\spare.exe
from %ProgramFiles(x86)%\chroller\is-r74nb.tmp to %ProgramFiles(x86)%\chroller\dcrawlib.dll
from %ProgramFiles(x86)%\chroller\is-bkm66.tmp to %ProgramFiles(x86)%\chroller\dvdlib.dll
from %ProgramFiles(x86)%\chroller\is-knpq6.tmp to %ProgramFiles(x86)%\chroller\starburn.dll
from %ProgramFiles(x86)%\chroller\is-37c5e.tmp to %ProgramFiles(x86)%\chroller\ident.dll
from %ProgramFiles(x86)%\chroller\is-8n3lu.tmp to %ProgramFiles(x86)%\chroller\aidex.dll
from %ProgramFiles(x86)%\chroller\is-alfs3.tmp to %ProgramFiles(x86)%\chroller\history.txt
from %ProgramFiles(x86)%\chroller\is-fv1ic.tmp to %ProgramFiles(x86)%\chroller\license.txt
from %ProgramFiles(x86)%\chroller\is-u1059.tmp to %ProgramFiles(x86)%\chroller\readme.txt
from %ProgramFiles(x86)%\chroller\is-5cpeh.tmp to %ProgramFiles(x86)%\chroller\cdroller.cfg
from %ProgramFiles(x86)%\chroller\is-rueqd.tmp to %ProgramFiles(x86)%\chroller\discs.ini
from %ProgramFiles(x86)%\chroller\is-s7d2l.tmp to %ProgramFiles(x86)%\chroller\drives.dat
from %ProgramFiles(x86)%\chroller\is-utud5.tmp to %ProgramFiles(x86)%\chroller\rawdiskinst.dll
from %ProgramFiles(x86)%\chroller\is-avq6g.tmp to %ProgramFiles(x86)%\chroller\order_now.html
from %ProgramFiles(x86)%\chroller\is-pgh6v.tmp to %ProgramFiles(x86)%\chroller\chroller.exe

Network activity

Connects to

'mi####njobs.works':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?43######

HTTP POST requests

http://mi####njobs.works/new/net_api

UDP

DNS ASK mi####njobs.works

Miscellaneous

Searches for the following windows

ClassName: 'jf4c7d_cgroller919Class_jf4c7d' WindowName: ''

Creates and executes the following

'%TEMP%\is-octmd.tmp\<File name>.tmp' /SL5="$1A023E,4471399,54272,<Full path to file>"
'%ProgramFiles(x86)%\chroller\chroller.exe'
'%ProgramFiles(x86)%\chroller\chroller.exe' 6dfb5012e38e906ee404659ad02b3e6d

Executes the following