Trojan.Siggen24.40299

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\TVTunerClassic61] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\TVTunerClassic61] 'ImagePath' = '%ALLUSERSPROFILE%\TVTunerClassic61\TVTunerClassic61.exe'

Creates the following services

'TVTunerClassic61' %ALLUSERSPROFILE%\TVTunerClassic61\TVTunerClassic61.exe

Modifies file system

Creates the following files

%TEMP%\is-4iucv.tmp\<File name>.tmp
%LOCALAPPDATA%\xapp market module\microsoft.vc90.crt\is-rab8d.tmp
%LOCALAPPDATA%\xapp market module\microsoft.vc90.crt\is-2849t.tmp
%LOCALAPPDATA%\xapp market module\microsoft.vc90.crt\is-oelpl.tmp
%LOCALAPPDATA%\xapp market module\microsoft.vc90.crt\is-9nqhl.tmp
%LOCALAPPDATA%\xapp market module\pf\common audio\is-m0snu.tmp
%LOCALAPPDATA%\xapp market module\pf\common audio\is-td3uj.tmp
%LOCALAPPDATA%\xapp market module\pf\common audio\is-bjt43.tmp
%LOCALAPPDATA%\xapp market module\pf\common audio\is-uickt.tmp
%LOCALAPPDATA%\xapp market module\pf\common audio\is-jmqj7.tmp
%LOCALAPPDATA%\xapp market module\pf\common audio\is-rr9u3.tmp
%LOCALAPPDATA%\xapp market module\pf\common audio\is-dkekm.tmp
%LOCALAPPDATA%\xapp market module\pf\common audio\is-g866s.tmp
%LOCALAPPDATA%\xapp market module\pf\common audio\is-32482.tmp
%LOCALAPPDATA%\xapp market module\pf\common audio\is-g6bd6.tmp
%LOCALAPPDATA%\xapp market module\pf\common audio\is-1fc35.tmp
%LOCALAPPDATA%\xapp market module\pf\common audio\is-347u9.tmp
%LOCALAPPDATA%\xapp market module\pf\common audio\is-t8l84.tmp
%LOCALAPPDATA%\xapp market module\pf\common audio\is-1la4k.tmp
%LOCALAPPDATA%\xapp market module\pf\common audio\is-homb9.tmp
%LOCALAPPDATA%\xapp market module\pf\common audio\is-4ue5t.tmp
%LOCALAPPDATA%\xapp market module\pf\common audio\is-q4j98.tmp
%LOCALAPPDATA%\xapp market module\pf\common audio\is-uoqh4.tmp
%LOCALAPPDATA%\xapp market module\lang\is-k8bcq.tmp
%LOCALAPPDATA%\xapp market module\lang\is-s66sf.tmp
%LOCALAPPDATA%\xapp market module\lang\is-ips53.tmp
%LOCALAPPDATA%\xapp market module\lang\is-om9jf.tmp
%LOCALAPPDATA%\xapp market module\lang\is-oi4bf.tmp
%LOCALAPPDATA%\xapp market module\is-fq7ko.tmp
%LOCALAPPDATA%\xapp market module\unins000.dat
%LOCALAPPDATA%\xapp market module\lang\is-ackqb.tmp
%LOCALAPPDATA%\xapp market module\xappmarketmodule.exe
%LOCALAPPDATA%\xapp market module\lang\is-94o1j.tmp
%LOCALAPPDATA%\xapp market module\lang\is-m9kqs.tmp
%TEMP%\is-bld6s.tmp\_isetup\_regdll.tmp
%TEMP%\is-bld6s.tmp\_isetup\_setup64.tmp
%TEMP%\is-bld6s.tmp\_isetup\_shfoldr.dll
%TEMP%\is-bld6s.tmp\_isetup\_isdecmp.dll
%TEMP%\is-bld6s.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\xapp market module\is-r59a2.tmp
%LOCALAPPDATA%\xapp market module\is-ntf18.tmp
%LOCALAPPDATA%\xapp market module\is-8hhpd.tmp
%LOCALAPPDATA%\xapp market module\is-ea67g.tmp
%LOCALAPPDATA%\xapp market module\is-o7lo8.tmp
%LOCALAPPDATA%\xapp market module\is-2opv4.tmp
%LOCALAPPDATA%\xapp market module\is-hu81s.tmp
%LOCALAPPDATA%\xapp market module\is-vgjgr.tmp
%LOCALAPPDATA%\xapp market module\is-69e1u.tmp
%LOCALAPPDATA%\xapp market module\is-250mk.tmp
%LOCALAPPDATA%\xapp market module\is-gjbq8.tmp
%LOCALAPPDATA%\xapp market module\is-mlgpl.tmp
%LOCALAPPDATA%\xapp market module\is-opkot.tmp
%LOCALAPPDATA%\xapp market module\is-7n80d.tmp
%LOCALAPPDATA%\xapp market module\is-6bcu8.tmp
%LOCALAPPDATA%\xapp market module\is-4h5ck.tmp
%LOCALAPPDATA%\xapp market module\is-1k6is.tmp
%LOCALAPPDATA%\xapp market module\is-r8n99.tmp
%LOCALAPPDATA%\xapp market module\is-q98dk.tmp
%LOCALAPPDATA%\xapp market module\is-59q8j.tmp
%LOCALAPPDATA%\xapp market module\is-1f89k.tmp
%LOCALAPPDATA%\xapp market module\is-qpui0.tmp
%LOCALAPPDATA%\xapp market module\is-v86c5.tmp
%LOCALAPPDATA%\xapp market module\lang\is-v3g08.tmp
%LOCALAPPDATA%\xapp market module\lang\is-gqsf9.tmp
%ALLUSERSPROFILE%\tvtunerclassic61\tvtunerclassic61.exe

Deletes the following files

%LOCALAPPDATA%\xapp market module\lang\audioconverterripper.dat
%LOCALAPPDATA%\xapp market module\lang\audioconverterripper.txt
%LOCALAPPDATA%\xapp market module\lang\feedback.dat
%LOCALAPPDATA%\xapp market module\lang\musictype.txt
%LOCALAPPDATA%\xapp market module\lang\update.log

Moves the following files

from %LOCALAPPDATA%\xapp market module\is-r59a2.tmp to %LOCALAPPDATA%\xapp market module\unins000.exe
from %LOCALAPPDATA%\xapp market module\lang\is-ackqb.tmp to %LOCALAPPDATA%\xapp market module\lang\update.log
from %LOCALAPPDATA%\xapp market module\microsoft.vc90.crt\is-rab8d.tmp to %LOCALAPPDATA%\xapp market module\microsoft.vc90.crt\microsoft.vc90.crt.manifest
from %LOCALAPPDATA%\xapp market module\microsoft.vc90.crt\is-2849t.tmp to %LOCALAPPDATA%\xapp market module\microsoft.vc90.crt\msvcm90.dll
from %LOCALAPPDATA%\xapp market module\microsoft.vc90.crt\is-oelpl.tmp to %LOCALAPPDATA%\xapp market module\microsoft.vc90.crt\msvcp90.dll
from %LOCALAPPDATA%\xapp market module\microsoft.vc90.crt\is-9nqhl.tmp to %LOCALAPPDATA%\xapp market module\microsoft.vc90.crt\msvcr90.dll
from %LOCALAPPDATA%\xapp market module\pf\common audio\is-m0snu.tmp to %LOCALAPPDATA%\xapp market module\pf\common audio\aac.pf
from %LOCALAPPDATA%\xapp market module\pf\common audio\is-td3uj.tmp to %LOCALAPPDATA%\xapp market module\pf\common audio\ac3.pf
from %LOCALAPPDATA%\xapp market module\pf\common audio\is-bjt43.tmp to %LOCALAPPDATA%\xapp market module\pf\common audio\aiff.pf
from %LOCALAPPDATA%\xapp market module\pf\common audio\is-uickt.tmp to %LOCALAPPDATA%\xapp market module\pf\common audio\amr.pf
from %LOCALAPPDATA%\xapp market module\pf\common audio\is-jmqj7.tmp to %LOCALAPPDATA%\xapp market module\pf\common audio\ape.pf
from %LOCALAPPDATA%\xapp market module\pf\common audio\is-dkekm.tmp to %LOCALAPPDATA%\xapp market module\pf\common audio\flac.pf
from %LOCALAPPDATA%\xapp market module\pf\common audio\is-uoqh4.tmp to %LOCALAPPDATA%\xapp market module\pf\common audio\wma.pf
from %LOCALAPPDATA%\xapp market module\pf\common audio\is-g866s.tmp to %LOCALAPPDATA%\xapp market module\pf\common audio\m4a.pf
from %LOCALAPPDATA%\xapp market module\pf\common audio\is-32482.tmp to %LOCALAPPDATA%\xapp market module\pf\common audio\m4b.pf
from %LOCALAPPDATA%\xapp market module\pf\common audio\is-g6bd6.tmp to %LOCALAPPDATA%\xapp market module\pf\common audio\m4r.pf
from %LOCALAPPDATA%\xapp market module\pf\common audio\is-1fc35.tmp to %LOCALAPPDATA%\xapp market module\pf\common audio\mka.pf
from %LOCALAPPDATA%\xapp market module\pf\common audio\is-347u9.tmp to %LOCALAPPDATA%\xapp market module\pf\common audio\mp2.pf
from %LOCALAPPDATA%\xapp market module\pf\common audio\is-t8l84.tmp to %LOCALAPPDATA%\xapp market module\pf\common audio\mp3.pf
from %LOCALAPPDATA%\xapp market module\pf\common audio\is-1la4k.tmp to %LOCALAPPDATA%\xapp market module\pf\common audio\ogg.pf
from %LOCALAPPDATA%\xapp market module\pf\common audio\is-homb9.tmp to %LOCALAPPDATA%\xapp market module\pf\common audio\ra.pf
from %LOCALAPPDATA%\xapp market module\pf\common audio\is-4ue5t.tmp to %LOCALAPPDATA%\xapp market module\pf\common audio\voc.pf
from %LOCALAPPDATA%\xapp market module\pf\common audio\is-q4j98.tmp to %LOCALAPPDATA%\xapp market module\pf\common audio\wav.pf
from %LOCALAPPDATA%\xapp market module\lang\is-94o1j.tmp to %LOCALAPPDATA%\xapp market module\lang\musictype.txt
from %LOCALAPPDATA%\xapp market module\pf\common audio\is-rr9u3.tmp to %LOCALAPPDATA%\xapp market module\pf\common audio\au.pf
from %LOCALAPPDATA%\xapp market module\lang\is-gqsf9.tmp to %LOCALAPPDATA%\xapp market module\lang\feedback.dat
from %LOCALAPPDATA%\xapp market module\is-mlgpl.tmp to %LOCALAPPDATA%\xapp market module\rmvbencode.dll
from %LOCALAPPDATA%\xapp market module\is-ntf18.tmp to %LOCALAPPDATA%\xapp market module\msvcp60.dll
from %LOCALAPPDATA%\xapp market module\is-8hhpd.tmp to %LOCALAPPDATA%\xapp market module\msvcr71.dll
from %LOCALAPPDATA%\xapp market module\is-ea67g.tmp to %LOCALAPPDATA%\xapp market module\musiccd.exe
from %LOCALAPPDATA%\xapp market module\is-o7lo8.tmp to %LOCALAPPDATA%\xapp market module\nvencoderkernel.dll
from %LOCALAPPDATA%\xapp market module\is-2opv4.tmp to %LOCALAPPDATA%\xapp market module\ocxhelper.exe
from %LOCALAPPDATA%\xapp market module\is-hu81s.tmp to %LOCALAPPDATA%\xapp market module\postproc-52.dll
from %LOCALAPPDATA%\xapp market module\is-vgjgr.tmp to %LOCALAPPDATA%\xapp market module\productcontrol.dll
from %LOCALAPPDATA%\xapp market module\is-69e1u.tmp to %LOCALAPPDATA%\xapp market module\pthreadgc2.dll
from %LOCALAPPDATA%\xapp market module\is-250mk.tmp to %LOCALAPPDATA%\xapp market module\pthreadvc2.dll
from %LOCALAPPDATA%\xapp market module\is-gjbq8.tmp to %LOCALAPPDATA%\xapp market module\realquickjoin.dll
from %LOCALAPPDATA%\xapp market module\is-opkot.tmp to %LOCALAPPDATA%\xapp market module\rmvbencodesync.dll
from %LOCALAPPDATA%\xapp market module\lang\is-v3g08.tmp to %LOCALAPPDATA%\xapp market module\lang\audioconverterripper.dat
from %LOCALAPPDATA%\xapp market module\is-7n80d.tmp to %LOCALAPPDATA%\xapp market module\simage.dll
from %LOCALAPPDATA%\xapp market module\is-6bcu8.tmp to %LOCALAPPDATA%\xapp market module\soundtouch.dll
from %LOCALAPPDATA%\xapp market module\is-4h5ck.tmp to %LOCALAPPDATA%\xapp market module\ssleay32.dll
from %LOCALAPPDATA%\xapp market module\is-1k6is.tmp to %LOCALAPPDATA%\xapp market module\swresample-0.dll
from %LOCALAPPDATA%\xapp market module\is-r8n99.tmp to %LOCALAPPDATA%\xapp market module\uitoolkit.dll.intermediate.manifest
from %LOCALAPPDATA%\xapp market module\is-q98dk.tmp to %LOCALAPPDATA%\xapp market module\ve32.dll
from %LOCALAPPDATA%\xapp market module\is-59q8j.tmp to %LOCALAPPDATA%\xapp market module\ve64.dll
from %LOCALAPPDATA%\xapp market module\is-1f89k.tmp to %LOCALAPPDATA%\xapp market module\wait.gif
from %LOCALAPPDATA%\xapp market module\is-qpui0.tmp to %LOCALAPPDATA%\xapp market module\webrtc.dll
from %LOCALAPPDATA%\xapp market module\is-v86c5.tmp to %LOCALAPPDATA%\xapp market module\wmadecode.dll
from %LOCALAPPDATA%\xapp market module\lang\is-m9kqs.tmp to %LOCALAPPDATA%\xapp market module\lang\audioconverterripper.txt
from %LOCALAPPDATA%\xapp market module\is-fq7ko.tmp to %LOCALAPPDATA%\xapp market module\xappmarketmodule.exe

Substitutes the following files

%LOCALAPPDATA%\xapp market module\lang\audioconverterripper.dat
%LOCALAPPDATA%\xapp market module\lang\audioconverterripper.txt
%LOCALAPPDATA%\xapp market module\lang\feedback.dat
%LOCALAPPDATA%\xapp market module\lang\musictype.txt
%LOCALAPPDATA%\xapp market module\lang\update.log

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'Hf12e1_XAMM1222FlashFixClass_Hf12e1'

Creates and executes the following

'%TEMP%\is-4iucv.tmp\<File name>.tmp' /SL5="$C0180,5016935,864768,<Full path to file>"
'%LOCALAPPDATA%\xapp market module\xappmarketmodule.exe' -i
'%LOCALAPPDATA%\xapp market module\xappmarketmodule.exe' -s

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "XAMM1222"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней