Trojan.Siggen9.55250

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\z-6-3-98-1250991851-1020904103-1123752573-6289\{hmp2d5dz-8mqk-86c1-rqg8-coe1h8ckf4ff}

Malicious functions

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\web data
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\lisp_success.doc

Modifies file system

Creates the following files

%PROGRAMDATA%\meth.exe
%APPDATA%\amd64_wsynth3dvsp.inf\abc\steam\config\config.vdf
%APPDATA%\amd64_wsynth3dvsp.inf\abc\steam\инструкция по установке.txt
%APPDATA%\amd64_wsynth3dvsp.inf\abc\steam\config\dialogconfig.vdf
%APPDATA%\amd64_wsynth3dvsp.inf\abc\telegram\d877f783d5d3ef8c\map0
%APPDATA%\amd64_wsynth3dvsp.inf\abc\telegram\инструкция по установке.txt
%APPDATA%\amd64_wsynth3dvsp.inf\abc\telegram\d877f783d5d3ef8c1
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%TEMP%\_mei7242\select.pyd
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\5y20irbf\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\yav3it2i\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\yslfomz5\desktop.ini
%APPDATA%\microsoft\windows\cookies\low\index.dat
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
%APPDATA%\amd64_wsynth3dvsp.inf\abc\information.txt
%TEMP%\aut378c.tmp
%APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.module.exe.9
%APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.module.exe
%APPDATA%\amd64_wsynth3dvsp.inf\enu_684687fe972656442535.7z
%APPDATA%\amd64_wsynth3dvsp.inf\abc\desktop txt files\applicantform_en.doc
%APPDATA%\amd64_wsynth3dvsp.inf\abc\desktop txt files\lisp_success.doc
%APPDATA%\amd64_wsynth3dvsp.inf\abc\screen.jpg
%TEMP%\~bkzpayk.tmp
%TEMP%\aute64c.tmp
%TEMP%\_mei7242\123.exe.manifest
%TEMP%\_mei7242\vcruntime140.dll
%TEMP%\_mei7242\_bz2.pyd
%TEMP%\_mei7242\_ctypes.pyd
%TEMP%\_mei7242\_hashlib.pyd
%TEMP%\_mei7242\_lzma.pyd
%TEMP%\_mei7242\_socket.pyd
%TEMP%\_mei7242\_sqlite3.pyd
%TEMP%\_mei7242\_ssl.pyd
%TEMP%\_mei7242\pyexpat.pyd
%APPDATA%\amd64_wsynth3dvsp.inf\shortinformation.txt
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\v15lm85b\desktop.ini
%TEMP%\_mei7242\python36.dll
%TEMP%\_mei7242\unicodedata.pyd
%TEMP%\_mei7242\base_library.zip
%TEMP%\_mei7242\certifi\cacert.pem
%TEMP%\token\firefox\webappsstore.sqlite
%TEMP%\token\firefox\webappsstore.sqlite-shm
%TEMP%\ca2eadcd-e183-4f76-bc83-a2095416449d.log
%APPDATA%\amd64_wsynth3dvsp.inf\enu_684687fe972656442535
%TEMP%\aute4b5.tmp
%APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.sqlite3.module.dll.9
%APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.sqlite3.module.dll
%PROGRAMDATA%\best.exe
%TEMP%\_mei7242\sqlite3.dll
%APPDATA%\amd64_wsynth3dvsp.inf\e

Sets the 'hidden' attribute to the following files

%PROGRAMDATA%\meth.exe
%PROGRAMDATA%\best.exe
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\v15lm85b\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\5y20irbf\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\yav3it2i\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\yslfomz5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini

Deletes the following files

%TEMP%\token\firefox\webappsstore.sqlite-shm
%APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.sqlite3.module.dll
%TEMP%\aut378c.tmp
%APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.module.exe.9
%APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.module.exe
%APPDATA%\amd64_wsynth3dvsp.inf\e
%TEMP%\aute64c.tmp
%TEMP%\~bkzpayk.tmp
%APPDATA%\amd64_wsynth3dvsp.inf\abc\information.txt
%APPDATA%\amd64_wsynth3dvsp.inf\abc\desktop txt files\lisp_success.doc
%APPDATA%\amd64_wsynth3dvsp.inf\abc\steam\инструкция по установке.txt
%APPDATA%\amd64_wsynth3dvsp.inf\abc\steam\config\config.vdf
%APPDATA%\amd64_wsynth3dvsp.inf\abc\steam\config\dialogconfig.vdf
%APPDATA%\amd64_wsynth3dvsp.inf\abc\telegram\d877f783d5d3ef8c1
%APPDATA%\amd64_wsynth3dvsp.inf\abc\screen.jpg
%APPDATA%\amd64_wsynth3dvsp.inf\abc\desktop txt files\applicantform_en.doc
%APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.sqlite3.module.dll.9
%TEMP%\aute4b5.tmp
%TEMP%\_mei7242\_ssl.pyd
%TEMP%\_mei7242\base_library.zip
%TEMP%\_mei7242\certifi\cacert.pem
%TEMP%\_mei7242\pyexpat.pyd
%TEMP%\_mei7242\python36.dll
%TEMP%\_mei7242\select.pyd
%TEMP%\_mei7242\sqlite3.dll
%TEMP%\_mei7242\123.exe.manifest
%TEMP%\_mei7242\unicodedata.pyd
%TEMP%\_mei7242\_bz2.pyd
%TEMP%\_mei7242\_ctypes.pyd
%TEMP%\_mei7242\_hashlib.pyd
%TEMP%\_mei7242\_lzma.pyd
%TEMP%\_mei7242\_socket.pyd
%TEMP%\_mei7242\_sqlite3.pyd
%TEMP%\_mei7242\vcruntime140.dll
%APPDATA%\amd64_wsynth3dvsp.inf\abc\telegram\инструкция по установке.txt
%APPDATA%\amd64_wsynth3dvsp.inf\abc\telegram\d877f783d5d3ef8c\map0

Moves the following files

from %PROGRAMDATA%\meth.exe to %APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.exe

Network activity

TCP

HTTP GET requests

http://f0####03.xsph.ru/1.exe
http://f0####03.xsph.ru/2.exe

'ap#.#pify.org':443

'ip##i.co':443

'ap#.##legram.org':443

UDP

DNS ASK f0####03.xsph.ru
DNS ASK ap#.#pify.org
DNS ASK ip##i.co
DNS ASK ap#.##legram.org

Miscellaneous

Creates and executes the following

'%PROGRAMDATA%\meth.exe'
'%PROGRAMDATA%\best.exe'
'%APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.exe'
'%APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.module.exe' a -y -mx9 -ssw "%APPDATA%\amd64_wsynth3dvsp.inf\ENU_684687FE972656442535.7z" "%APPDATA%\amd64_wsynth3dvsp.inf\ABC\*"
'%APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.module.exe' a -y -mx9 -ssw "%APPDATA%\amd64_wsynth3dvsp.inf\ENU_684687FE972656442535.7z" "%APPDATA%\amd64_wsynth3dvsp.inf\ABC\*"' (with hidden window)
'%APPDATA%\amd64_wsynth3dvsp.inf\mitigationconfiguration.exe' ' (with hidden window)
'%WINDIR%\syswow64\attrib.exe' +s +h "%APPDATA%\amd64_wsynth3dvsp.inf"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
'%WINDIR%\syswow64\attrib.exe' +s +h "%APPDATA%\amd64_wsynth3dvsp.inf"
'<SYSTEM32>\taskeng.exe' {2395FC8C-18CC-4995-A35E-D7C543D04A43} S-1-5-21-1960123792-2022915161-3775307078-1001:dtvefr\user:Interactive:[1]

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial