Trojan.Siggen22.7062

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-7p9cc.tmp\<File name>.tmp
%ProgramFiles(x86)%\rmkradio\is-u8kvn.tmp
%ProgramFiles(x86)%\rmkradio\is-pbs32.tmp
%ProgramFiles(x86)%\rmkradio\is-9j0dv.tmp
%ProgramFiles(x86)%\rmkradio\is-5c27n.tmp
%ProgramFiles(x86)%\rmkradio\is-8vfoo.tmp
%ProgramFiles(x86)%\rmkradio\is-f7hv7.tmp
%ProgramFiles(x86)%\rmkradio\is-nbtln.tmp
%ProgramFiles(x86)%\rmkradio\is-ao30m.tmp
%ProgramFiles(x86)%\rmkradio\rmkradio.exe
%ProgramFiles(x86)%\rmkradio\is-dvelq.tmp
%ProgramFiles(x86)%\rmkradio\is-q2rho.tmp
%ProgramFiles(x86)%\rmkradio\is-b70ok.tmp
%ProgramFiles(x86)%\rmkradio\is-rur38.tmp
%ProgramFiles(x86)%\rmkradio\is-3l81k.tmp
%ProgramFiles(x86)%\rmkradio\is-kiv7p.tmp
%ProgramFiles(x86)%\rmkradio\unins000.dat
%ProgramFiles(x86)%\rmkradio\is-lu56g.tmp
%ProgramFiles(x86)%\rmkradio\is-7c3lg.tmp
%ProgramFiles(x86)%\rmkradio\is-trgon.tmp
%ProgramFiles(x86)%\rmkradio\is-jvh2r.tmp
%TEMP%\is-7fvcf.tmp\_isetup\_regdll.tmp
%TEMP%\is-7fvcf.tmp\_isetup\_setup64.tmp
%TEMP%\is-7fvcf.tmp\_isetup\_shfoldr.dll
%TEMP%\is-7fvcf.tmp\_isetup\_iscrypt.dll
%ProgramFiles(x86)%\rmkradio\is-5gahg.tmp
%ProgramFiles(x86)%\rmkradio\is-hf4vv.tmp
%ProgramFiles(x86)%\rmkradio\is-6nuij.tmp
%ProgramFiles(x86)%\rmkradio\is-uaikf.tmp
%ProgramFiles(x86)%\rmkradio\is-80ddr.tmp
%ProgramFiles(x86)%\rmkradio\is-43rdq.tmp
%ProgramFiles(x86)%\rmkradio\is-hlkip.tmp
%ProgramFiles(x86)%\rmkradio\is-vtsar.tmp
%ProgramFiles(x86)%\rmkradio\is-oqsvb.tmp
%ProgramFiles(x86)%\rmkradio\is-7j9j4.tmp
%ProgramFiles(x86)%\rmkradio\is-n6vo8.tmp
%ProgramFiles(x86)%\rmkradio\is-vk9t4.tmp
%ProgramFiles(x86)%\rmkradio\is-mcqqj.tmp
%TEMP%\license.txt

Moves the following files

from %ProgramFiles(x86)%\rmkradio\is-5gahg.tmp to %ProgramFiles(x86)%\rmkradio\unins000.exe
from %ProgramFiles(x86)%\rmkradio\is-rur38.tmp to %ProgramFiles(x86)%\rmkradio\rarmaradio_x32.vpl
from %ProgramFiles(x86)%\rmkradio\is-b70ok.tmp to %ProgramFiles(x86)%\rmkradio\audiogenie2.dll
from %ProgramFiles(x86)%\rmkradio\is-q2rho.tmp to %ProgramFiles(x86)%\rmkradio\sqlite3.dll
from %ProgramFiles(x86)%\rmkradio\is-dvelq.tmp to %ProgramFiles(x86)%\rmkradio\bass_wadsp.dll
from %ProgramFiles(x86)%\rmkradio\is-ao30m.tmp to %ProgramFiles(x86)%\rmkradio\bass_wa.dll
from %ProgramFiles(x86)%\rmkradio\is-7c3lg.tmp to %ProgramFiles(x86)%\rmkradio\bass_vis.dll
from %ProgramFiles(x86)%\rmkradio\is-nbtln.tmp to %ProgramFiles(x86)%\rmkradio\bass_old.dll
from %ProgramFiles(x86)%\rmkradio\is-f7hv7.tmp to %ProgramFiles(x86)%\rmkradio\bass_fx.dll
from %ProgramFiles(x86)%\rmkradio\is-8vfoo.tmp to %ProgramFiles(x86)%\rmkradio\bass_aac.dll
from %ProgramFiles(x86)%\rmkradio\is-5c27n.tmp to %ProgramFiles(x86)%\rmkradio\basswma.dll
from %ProgramFiles(x86)%\rmkradio\is-9j0dv.tmp to %ProgramFiles(x86)%\rmkradio\basswasapi.dll
from %ProgramFiles(x86)%\rmkradio\is-pbs32.tmp to %ProgramFiles(x86)%\rmkradio\bassopus.dll
from %ProgramFiles(x86)%\rmkradio\is-u8kvn.tmp to %ProgramFiles(x86)%\rmkradio\bassmix.dll
from %ProgramFiles(x86)%\rmkradio\is-3l81k.tmp to %ProgramFiles(x86)%\rmkradio\rarmaradio_x64.vpl
from %ProgramFiles(x86)%\rmkradio\is-lu56g.tmp to %ProgramFiles(x86)%\rmkradio\basshls.dll
from %ProgramFiles(x86)%\rmkradio\is-mcqqj.tmp to %ProgramFiles(x86)%\rmkradio\bassenc_opus.dll
from %ProgramFiles(x86)%\rmkradio\is-80ddr.tmp to %ProgramFiles(x86)%\rmkradio\bassenc_ogg.dll
from %ProgramFiles(x86)%\rmkradio\is-vk9t4.tmp to %ProgramFiles(x86)%\rmkradio\bassenc_mp3.dll
from %ProgramFiles(x86)%\rmkradio\is-n6vo8.tmp to %ProgramFiles(x86)%\rmkradio\bassenc_flac.dll
from %ProgramFiles(x86)%\rmkradio\is-7j9j4.tmp to %ProgramFiles(x86)%\rmkradio\bassenc23.dll
from %ProgramFiles(x86)%\rmkradio\is-oqsvb.tmp to %ProgramFiles(x86)%\rmkradio\bassenc.dll
from %ProgramFiles(x86)%\rmkradio\is-vtsar.tmp to %ProgramFiles(x86)%\rmkradio\basscd.dll
from %ProgramFiles(x86)%\rmkradio\is-hlkip.tmp to %ProgramFiles(x86)%\rmkradio\bassasio.dll
from %ProgramFiles(x86)%\rmkradio\is-43rdq.tmp to %ProgramFiles(x86)%\rmkradio\bass.dll
from %ProgramFiles(x86)%\rmkradio\is-uaikf.tmp to %ProgramFiles(x86)%\rmkradio\rarmaradio.chm
from %ProgramFiles(x86)%\rmkradio\is-jvh2r.tmp to %ProgramFiles(x86)%\rmkradio\crashreport.ini
from %ProgramFiles(x86)%\rmkradio\is-6nuij.tmp to %ProgramFiles(x86)%\rmkradio\crashreport.exe
from %ProgramFiles(x86)%\rmkradio\is-hf4vv.tmp to %ProgramFiles(x86)%\rmkradio\helmut.dll
from %ProgramFiles(x86)%\rmkradio\is-trgon.tmp to %ProgramFiles(x86)%\rmkradio\bassflac.dll
from %ProgramFiles(x86)%\rmkradio\is-kiv7p.tmp to %ProgramFiles(x86)%\rmkradio\rmkradio.exe

Network activity

Connects to

'mi####njobs.works':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?43######

HTTP POST requests

http://mi####njobs.works/new/net_api

UDP

DNS ASK mi####njobs.works

Miscellaneous

Searches for the following windows

ClassName: 'T273ad_rmk1012Class_T273ad' WindowName: ''

Creates and executes the following

'%TEMP%\is-7p9cc.tmp\<File name>.tmp' /SL5="$A0248,7892867,54272,<Full path to file>"
'%ProgramFiles(x86)%\rmkradio\rmkradio.exe'
'%ProgramFiles(x86)%\rmkradio\rmkradio.exe' f9118e94ca3c5be3221bcc80942e9b4c

Executes the following