Trojan.Siggen21.42661

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-90bpq.tmp\<File name>.tmp
%ProgramFiles(x86)%\rmrradio\is-e0nai.tmp
%ProgramFiles(x86)%\rmrradio\is-sgonm.tmp
%ProgramFiles(x86)%\rmrradio\is-mokdk.tmp
%ProgramFiles(x86)%\rmrradio\is-vie0h.tmp
%ProgramFiles(x86)%\rmrradio\is-ft1pd.tmp
%ProgramFiles(x86)%\rmrradio\is-94fp1.tmp
%ProgramFiles(x86)%\rmrradio\is-0gu13.tmp
%ProgramFiles(x86)%\rmrradio\is-97eiv.tmp
%ProgramFiles(x86)%\rmrradio\is-fgl79.tmp
%ProgramFiles(x86)%\rmrradio\is-i3tku.tmp
%ProgramFiles(x86)%\rmrradio\is-goalq.tmp
%ProgramFiles(x86)%\rmrradio\is-r6hni.tmp
%ProgramFiles(x86)%\rmrradio\is-srqie.tmp
%ProgramFiles(x86)%\rmrradio\is-47ak5.tmp
%ProgramFiles(x86)%\rmrradio\unins000.dat
%ProgramFiles(x86)%\rmrradio\is-c8lvq.tmp
%ProgramFiles(x86)%\rmrradio\is-n1tgq.tmp
%ProgramFiles(x86)%\rmrradio\is-buks6.tmp
%ProgramFiles(x86)%\rmrradio\is-8s26e.tmp
%ProgramFiles(x86)%\rmrradio\is-3ja4b.tmp
%TEMP%\is-epp3f.tmp\_isetup\_setup64.tmp
%TEMP%\is-epp3f.tmp\_isetup\_shfoldr.dll
%TEMP%\is-epp3f.tmp\_isetup\_isdecmp.dll
%TEMP%\is-epp3f.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\rmrradio\is-3j52n.tmp
%ProgramFiles(x86)%\rmrradio\is-3sjd8.tmp
%ProgramFiles(x86)%\rmrradio\is-3mv95.tmp
%TEMP%\is-epp3f.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\rmrradio\is-q1not.tmp
%ProgramFiles(x86)%\rmrradio\is-j4orh.tmp
%ProgramFiles(x86)%\rmrradio\is-4jb7l.tmp
%ProgramFiles(x86)%\rmrradio\is-t874g.tmp
%ProgramFiles(x86)%\rmrradio\is-3kqlu.tmp
%ProgramFiles(x86)%\rmrradio\is-oicjc.tmp
%ProgramFiles(x86)%\rmrradio\is-4cv5o.tmp
%ProgramFiles(x86)%\rmrradio\is-rr0tv.tmp
%ProgramFiles(x86)%\rmrradio\is-36bsv.tmp
%ProgramFiles(x86)%\rmrradio\rmrradio.exe
%TEMP%\license.txt

Moves the following files

from %ProgramFiles(x86)%\rmrradio\is-3j52n.tmp to %ProgramFiles(x86)%\rmrradio\unins000.exe
from %ProgramFiles(x86)%\rmrradio\is-r6hni.tmp to %ProgramFiles(x86)%\rmrradio\rarmaradio_x32.vpl
from %ProgramFiles(x86)%\rmrradio\is-goalq.tmp to %ProgramFiles(x86)%\rmrradio\audiogenie2.dll
from %ProgramFiles(x86)%\rmrradio\is-i3tku.tmp to %ProgramFiles(x86)%\rmrradio\sqlite3.dll
from %ProgramFiles(x86)%\rmrradio\is-n1tgq.tmp to %ProgramFiles(x86)%\rmrradio\bass_wadsp.dll
from %ProgramFiles(x86)%\rmrradio\is-c8lvq.tmp to %ProgramFiles(x86)%\rmrradio\bass_wa.dll
from %ProgramFiles(x86)%\rmrradio\is-fgl79.tmp to %ProgramFiles(x86)%\rmrradio\bass_vis.dll
from %ProgramFiles(x86)%\rmrradio\is-94fp1.tmp to %ProgramFiles(x86)%\rmrradio\bass_old.dll
from %ProgramFiles(x86)%\rmrradio\is-ft1pd.tmp to %ProgramFiles(x86)%\rmrradio\bass_fx.dll
from %ProgramFiles(x86)%\rmrradio\is-vie0h.tmp to %ProgramFiles(x86)%\rmrradio\bass_aac.dll
from %ProgramFiles(x86)%\rmrradio\is-mokdk.tmp to %ProgramFiles(x86)%\rmrradio\basswma.dll
from %ProgramFiles(x86)%\rmrradio\is-sgonm.tmp to %ProgramFiles(x86)%\rmrradio\basswasapi.dll
from %ProgramFiles(x86)%\rmrradio\is-e0nai.tmp to %ProgramFiles(x86)%\rmrradio\bassopus.dll
from %ProgramFiles(x86)%\rmrradio\is-97eiv.tmp to %ProgramFiles(x86)%\rmrradio\bassmix.dll
from %ProgramFiles(x86)%\rmrradio\is-srqie.tmp to %ProgramFiles(x86)%\rmrradio\rarmaradio_x64.vpl
from %ProgramFiles(x86)%\rmrradio\is-0gu13.tmp to %ProgramFiles(x86)%\rmrradio\basshls.dll
from %ProgramFiles(x86)%\rmrradio\is-8s26e.tmp to %ProgramFiles(x86)%\rmrradio\bassenc_opus.dll
from %ProgramFiles(x86)%\rmrradio\is-3ja4b.tmp to %ProgramFiles(x86)%\rmrradio\bassenc_ogg.dll
from %ProgramFiles(x86)%\rmrradio\is-rr0tv.tmp to %ProgramFiles(x86)%\rmrradio\bassenc_mp3.dll
from %ProgramFiles(x86)%\rmrradio\is-4cv5o.tmp to %ProgramFiles(x86)%\rmrradio\bassenc_flac.dll
from %ProgramFiles(x86)%\rmrradio\is-oicjc.tmp to %ProgramFiles(x86)%\rmrradio\bassenc23.dll
from %ProgramFiles(x86)%\rmrradio\is-3kqlu.tmp to %ProgramFiles(x86)%\rmrradio\bassenc.dll
from %ProgramFiles(x86)%\rmrradio\is-t874g.tmp to %ProgramFiles(x86)%\rmrradio\basscd.dll
from %ProgramFiles(x86)%\rmrradio\is-4jb7l.tmp to %ProgramFiles(x86)%\rmrradio\bassasio.dll
from %ProgramFiles(x86)%\rmrradio\is-j4orh.tmp to %ProgramFiles(x86)%\rmrradio\bass.dll
from %ProgramFiles(x86)%\rmrradio\is-36bsv.tmp to %ProgramFiles(x86)%\rmrradio\rarmaradio.chm
from %ProgramFiles(x86)%\rmrradio\is-q1not.tmp to %ProgramFiles(x86)%\rmrradio\crashreport.ini
from %ProgramFiles(x86)%\rmrradio\is-3mv95.tmp to %ProgramFiles(x86)%\rmrradio\crashreport.exe
from %ProgramFiles(x86)%\rmrradio\is-3sjd8.tmp to %ProgramFiles(x86)%\rmrradio\helmut.dll
from %ProgramFiles(x86)%\rmrradio\is-buks6.tmp to %ProgramFiles(x86)%\rmrradio\bassflac.dll
from %ProgramFiles(x86)%\rmrradio\is-47ak5.tmp to %ProgramFiles(x86)%\rmrradio\rmrradio.exe

Network activity

Connects to

'mi####njobs.works':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?43######

HTTP POST requests

http://mi####njobs.works/new/net_api

UDP

DNS ASK mi####njobs.works

Miscellaneous

Searches for the following windows

ClassName: 'r9bd51_rmr1014Class_r9bd51' WindowName: ''

Creates and executes the following

'%TEMP%\is-90bpq.tmp\<File name>.tmp' /SL5="$50230,8309820,54272,<Full path to file>"
'%ProgramFiles(x86)%\rmrradio\rmrradio.exe'
'%ProgramFiles(x86)%\rmrradio\rmrradio.exe' 963f1a3cc1d19ee086d5786a334febde

Executes the following