Trojan.Siggen23.39789

Technical Information

Modifies file system

Creates the following files

%TEMP%\etilqs_9keupf1g4ggoaqf
%TEMP%\etilqs_zcyqbxxt3n0pcbf
%TEMP%\665f.tmp
%TEMP%\664d.tmp
%ProgramFiles(x86)%\securityhealthsystray\msvcr100.dll
%ProgramFiles(x86)%\securityhealthsystray\msvcp100.dll
%ProgramFiles(x86)%\securityhealthsystray\memurt.dll
%ProgramFiles(x86)%\securityhealthsystray\memuddu.dll
%ProgramFiles(x86)%\securityhealthsystray\libssl-1_1-x64.dll
%ProgramFiles(x86)%\securityhealthsystray\libcurl.dll
%TEMP%\etilqs_u7ve97pxbknngyb
%ProgramFiles(x86)%\securityhealthsystray\libcrypto-1_1-x64.dll
%TEMP%\etilqs_07bt1j7fwtribpd
%ProgramFiles(x86)%\securityhealthsystray\fontcrvhost.exe
C:\users\public\pictures\temp.tmp
%TEMP%\etilqs_hwe2wywagznhvml
%TEMP%\etilqs_pxzx0te6davagkk
%TEMP%\etilqs_6nuy2hg5ecgendy
%TEMP%\etilqs_hk1lzjianocqvsc
%TEMP%\etilqs_qwvwvt2utb3ezib
%TEMP%\etilqs_xuwcb0id4amtbl0
%TEMP%\etilqs_rubwfnaqpx1kkvz
%HOMEPATH%\.memuhyperv\memusvc.log
%TEMP%\8l5q2481haopb29\spower.exe

Deletes the following files

%TEMP%\664d.tmp
%TEMP%\665f.tmp

Moves the following files

from C:\users\public\pictures\temp.tmp to %TEMP%\1024240\....\temporaryfile
from %TEMP%\8l5q2481haopb29\spower.exe to %TEMP%\1057421\....\temporaryfile

Network activity

Connects to

'k1##########.oss-cn-hongkong.aliyuncs.com':443
'fa###ook.com':443
'sd#####es.operacdn.com':443
'do#####d3.operacdn.com':443
'd.###ge.i4.cn':80
's.###on.360.cn':443
'fx####.baidu.com':443
's2#.#nzz.com':443
'en.###ipedia.org':80
'st####.xx.fbcdn.net':443
'nl.##hoo.com':80
'ro###.ebay.com':80
'bo##ing.com':80
'tw##ter.com':80
'tw##ter.com':443
'fa###ook.com':80
'i4.cn':443
'ya###.opera.com':80
'si#####ck2.opera.com':443
're###.opera.com':80
'si#####ck2.opera.com':80
'en.###ipedia.org':443
'am##on.com':443
'se####.yahoo.com':443
'hm.##idu.com':443
'au######te.geo.opera.com':443
'bing.com':80
'am##on.com':80
'du###uckgo.com':443
'se####.yahoo.com':80
'au######te.geo.opera.com':80
'google.com':80
'bo##ing.com':443
'ro###.ebay.com':443

TCP

HTTP GET requests

http://www.google.com/favicon.ico
http://ro###.ebay.com/rover/1/711-53200-19255-0/1?ic###########################################################################################################################
http://nl.##hoo.com/?il#####
http://www.op##a.com/follow?ut###############################################################################################
http://www.am##on.com/?ta#########################
http://d.###ge.i4.cn/image/icon/2023/06/09/17/414478124/z1686304741957_592102.jpg
http://re###.opera.com/speeddials/partner/wikipedia_org_us
http://re###.opera.com/speeddials/partner/youtube
http://re###.opera.com/speeddials/partner/product
http://re###.opera.com/speeddials/partner/booking_com_us
http://re###.opera.com/speeddials/partner/twitter_us
http://re###.opera.com/speeddials/partner/yahoo
http://www.bo##ing.com/index.html?ai##########################################################################################
http://re###.opera.com/speeddials/partner/ebay_us
http://www.fa###ook.com/
http://re###.opera.com/speeddials/partner/facebook
http://ya###.opera.com/favicon.ico
http://re###.opera.com/favicon.ico
http://re###.opera.com/www.opera.com/firstrun/
http://si#####ck2.opera.com/?ho###################################################
http://en.###ipedia.org/favicon.ico
http://www.bing.com/s/a/bing_p.ico
http://www.am##on.com/favicon.ico
http://se####.yahoo.com/favicon.ico
http://au######te.geo.opera.com/geolocation/
http://re###.opera.com/speeddials/partner/amazon_us
http://www.tw##ter.com/?pa################

Other

'k1##########.oss-cn-hongkong.aliyuncs.com':443
'ya##o.com':443
'st####.xx.fbcdn.net':443
'm.###ebook.com':443
's2#.#nzz.com':443
'hm.##idu.com':443
'fx####.baidu.com':443
's.###on.360.cn':443
'do#####d3.operacdn.com':443
'bing.com':443
'fa###ook.com':443
'i4.cn':443
'op##a.com':443
'ya###.opera.com':443
'si#####ck2.opera.com':443
'en.###ipedia.org':443
'am##on.com':443
'se####.yahoo.com':443
'au######te.geo.opera.com':443
'du###uckgo.com':443
'tw##ter.com':443
'bo##ing.com':443

UDP

DNS ASK k1##########.oss-cn-hongkong.aliyuncs.com
DNS ASK bo##ing.com
DNS ASK ro###.ebay.com
DNS ASK nl.##hoo.com
DNS ASK st####.xx.fbcdn.net
DNS ASK m.###ebook.com
DNS ASK s2#.#nzz.com
DNS ASK hm.##idu.com
DNS ASK s.###on.360.cn
DNS ASK d.###ge.i4.cn
DNS ASK fx####.baidu.com
DNS ASK d-###ge.i4.cn
DNS ASK do#####d3.operacdn.com
DNS ASK sd#####es.operacdn.com
DNS ASK fa###ook.com
DNS ASK i4.cn
DNS ASK op##a.com
DNS ASK ya###.opera.com
DNS ASK re###.opera.com
DNS ASK si#####ck2.opera.com
DNS ASK en.###ipedia.org
DNS ASK bi##.#ikimedia.org
DNS ASK bing.com
DNS ASK am##on.com
DNS ASK du###uckgo.com
DNS ASK se####.yahoo.com
DNS ASK au######te.geo.opera.com
DNS ASK google.com
DNS ASK tw##ter.com
DNS ASK ya##o.com

Miscellaneous

Searches for the following windows

ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'
ClassName: 'TrayNotifyWnd' WindowName: ''
ClassName: 'SysPager' WindowName: ''
ClassName: 'ToolbarWindow32' WindowName: ''

Creates and executes the following

'%ProgramFiles(x86)%\securityhealthsystray\fontcrvhost.exe'
'%TEMP%\8l5q2481haopb29\spower.exe'
'%TEMP%\8l5q2481haopb29\spower.exe' ' (with hidden window)

Executes the following

'%WINDIR%\syswow64\rundll32.exe' url.dll,FileProtocolHandler https://www.i4.cn/
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1796.16.479994603\111246492" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1796.12.326444676\244719084" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1796.11.525857193\1734241651" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1796.10.1659181694\1629139964" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1796.9.1493961333\1783244360" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1796.8.1816736891\221187225" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1796.7.1936821070\1903030926" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="1796.4.608475701\2135834647" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=636
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1796.6.621806392\1594311088" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1796.5.985800230\1932658872" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1796.4.608475701\2135834647" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="1796.0.2057070425\1062849085" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gp...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.i4.cn/ /crash-reporter-parent-id=1796
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://www.i4.cn/
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://www.i4.cn/"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1796.17.58672135\1571128536" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1796.18.1731842163\1724551575" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней