Trojan.Siggen32.6016

Technical Information

Malicious functions

Injects code into

the following user processes:

free cursοr.exe

Modifies file system

Creates the following files

%TEMP%\nsaa9b.tmp\system.dll
%TEMP%\nsaa9b.tmp\app-64.7z
%TEMP%\nsaa9b.tmp\nsis7z.dll
%TEMP%\nsaa9b.tmp\7z-out\license.electron.txt
%TEMP%\nsaa9b.tmp\7z-out\licenses.chromium.html
%TEMP%\nsaa9b.tmp\7z-out\chrome_100_percent.pak
%TEMP%\nsaa9b.tmp\7z-out\chrome_200_percent.pak
%TEMP%\nsaa9b.tmp\7z-out\icudtl.dat
%TEMP%\nsaa9b.tmp\7z-out\locales\af.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\am.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\ar.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\bg.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\bn.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\ca.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\cs.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\da.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\de.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\el.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\en-gb.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\en-us.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\es-419.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\es.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\et.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\fa.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\fi.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\fil.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\fr.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\gu.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\he.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\hi.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\hr.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\hu.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\id.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\it.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\ja.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\kn.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\ko.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\lt.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\lv.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\ml.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\mr.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\ms.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\nb.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\nl.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\pl.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\pt-br.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\pt-pt.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\ro.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\ru.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\sk.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\sl.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\sr.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\sv.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\sw.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\ta.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\te.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\th.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\tr.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\uk.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\ur.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\vi.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\zh-cn.pak
%TEMP%\nsaa9b.tmp\7z-out\locales\zh-tw.pak
%TEMP%\nsaa9b.tmp\7z-out\resources.pak
%TEMP%\nsaa9b.tmp\7z-out\resources\app.asar
%TEMP%\nsaa9b.tmp\7z-out\snapshot_blob.bin
%TEMP%\nsaa9b.tmp\7z-out\v8_context_snapshot.bin
%TEMP%\nsaa9b.tmp\7z-out\vk_swiftshader_icd.json
%TEMP%\nsaa9b.tmp\7z-out\free cursοr.exe
%TEMP%\nsaa9b.tmp\7z-out\d3dcompiler_47.dll
%TEMP%\nsaa9b.tmp\7z-out\ffmpeg.dll
%TEMP%\nsaa9b.tmp\7z-out\libegl.dll
%TEMP%\nsaa9b.tmp\7z-out\libglesv2.dll
%TEMP%\nsaa9b.tmp\7z-out\resources\bin\cursor_patch.exe
%TEMP%\nsaa9b.tmp\7z-out\resources\bin\cursor_tools.exe
%TEMP%\nsaa9b.tmp\7z-out\resources\bin\win_fix_cursor_apply.exe
%TEMP%\nsaa9b.tmp\7z-out\resources\elevate.exe
%TEMP%\nsaa9b.tmp\7z-out\vk_swiftshader.dll
%TEMP%\nsaa9b.tmp\7z-out\vulkan-1.dll
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\chrome_100_percent.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\chrome_200_percent.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\d3dcompiler_47.dll
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\ffmpeg.dll
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\free cursοr.exe
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\icudtl.dat
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\libegl.dll
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\libglesv2.dll
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\license.electron.txt
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\licenses.chromium.html
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\resources.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\snapshot_blob.bin
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\v8_context_snapshot.bin
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\vk_swiftshader.dll
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\vk_swiftshader_icd.json
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\vulkan-1.dll
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\af.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\am.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\ar.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\bg.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\bn.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\ca.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\cs.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\da.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\de.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\el.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\en-gb.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\en-us.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\es-419.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\es.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\et.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\fa.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\fi.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\fil.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\fr.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\gu.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\he.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\hi.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\hr.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\hu.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\id.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\it.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\ja.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\kn.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\ko.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\lt.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\lv.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\ml.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\mr.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\ms.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\nb.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\nl.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\pl.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\pt-br.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\pt-pt.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\ro.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\ru.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\sk.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\sl.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\sr.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\sv.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\sw.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\ta.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\te.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\th.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\tr.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\uk.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\ur.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\vi.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\zh-cn.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\locales\zh-tw.pak
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\resources\app.asar
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\resources\elevate.exe
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\resources\bin\cursor_patch.exe
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\resources\bin\cursor_tools.exe
%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\resources\bin\win_fix_cursor_apply.exe
%TEMP%\nsaa9b.tmp\stdutils.dll
%APPDATA%\free-cursor\local storage\leveldb\log
%APPDATA%\free-cursor\local storage\leveldb\manifest-000001
%APPDATA%\free-cursor\local storage\leveldb\000001.dbtmp
%APPDATA%\free-cursor\code cache\js\index
%APPDATA%\free-cursor\code cache\js\index-dir\temp-index
%APPDATA%\free-cursor\code cache\wasm\index
%APPDATA%\free-cursor\code cache\wasm\index-dir\temp-index
%APPDATA%\free-cursor\gpucache\index
%APPDATA%\free-cursor\gpucache\data_0
%APPDATA%\free-cursor\gpucache\data_1
%APPDATA%\free-cursor\gpucache\data_2
%APPDATA%\free-cursor\gpucache\data_3
%APPDATA%\free-cursor\dawncache\index
%APPDATA%\free-cursor\dawncache\data_0
%APPDATA%\free-cursor\dawncache\data_1
%APPDATA%\free-cursor\dawncache\data_2
%APPDATA%\free-cursor\dawncache\data_3
%APPDATA%\microsoft\spelling\en-us\default.dic
%APPDATA%\microsoft\spelling\en-us\default.exc
%APPDATA%\microsoft\spelling\en-us\default.acl
%APPDATA%\free-cursor\config.json.tmp-23568485487969d0
%APPDATA%\free-cursor\cache\cache_data\index
%APPDATA%\free-cursor\cache\cache_data\data_0
%APPDATA%\free-cursor\cache\cache_data\data_1
%APPDATA%\free-cursor\cache\cache_data\data_2
%APPDATA%\free-cursor\cache\cache_data\data_3
%APPDATA%\free-cursor\local storage\leveldb\000003.log
%APPDATA%\free-cursor\359fd9b5-d63e-4f71-99cf-2e79772c4a1d.tmp
%APPDATA%\free-cursor\2699af7a-04a0-45d3-8521-8b5bcab7c789.tmp
%APPDATA%\free-cursor\network\f84b0d0c-7369-4c01-b124-6a9cd709ef01.tmp
%APPDATA%\free-cursor\network\6b820b3e-813f-4510-92c4-7a41165a7c3d.tmp
%TEMP%\d3d43554-141e-4b43-a1e0-3784fcf514a6.tmp
%APPDATA%\free-cursor\network\be6ae802-6925-4efd-9176-34d67e6c9c4f.tmp

Moves the following files

from %APPDATA%\free-cursor\local storage\leveldb\000001.dbtmp to %APPDATA%\free-cursor\local storage\leveldb\current
from %APPDATA%\free-cursor\code cache\js\index-dir\temp-index to %APPDATA%\free-cursor\code cache\js\index-dir\the-real-index
from %APPDATA%\free-cursor\code cache\wasm\index-dir\temp-index to %APPDATA%\free-cursor\code cache\wasm\index-dir\the-real-index
from %APPDATA%\free-cursor\config.json.tmp-23568485487969d0 to %APPDATA%\free-cursor\config.json
from %APPDATA%\free-cursor\359fd9b5-d63e-4f71-99cf-2e79772c4a1d.tmp to %APPDATA%\free-cursor\local state
from %APPDATA%\free-cursor\2699af7a-04a0-45d3-8521-8b5bcab7c789.tmp to %APPDATA%\free-cursor\preferences
from %APPDATA%\free-cursor\network\f84b0d0c-7369-4c01-b124-6a9cd709ef01.tmp to %APPDATA%\free-cursor\network\network persistent state
from %APPDATA%\free-cursor\network\6b820b3e-813f-4510-92c4-7a41165a7c3d.tmp to %APPDATA%\free-cursor\network\transportsecurity

Network activity

Connects to

'up####.freecursor.fun':443
'dn#.google':443

TCP

Other

'up####.freecursor.fun':443
'dn#.google':443

UDP

DNS ASK up####.freecursor.fun
DNS ASK dn#.google

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''

Creates and executes the following

'%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\free cursοr.exe'
'%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\free cursοr.exe' --type=gpu-process --user-data-dir="%APPDATA%\free-cursor" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAA...
'%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\free cursοr.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\free-cursor" --mojo-platform-channel-handle=1952 --field-trial...
'%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\free cursοr.exe' --type=renderer --user-data-dir="%APPDATA%\free-cursor" --app-path="%TEMP%\34mHMMIa8LVmzlVWwIJhOkbtGfY\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-...
'%TEMP%\34mhmmia8lvmzlvwwijhokbtgfy\free cursοr.exe' --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="%...

Executes the following

'<SYSTEM32>\cmd.exe' /d /s /c "getmac"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command " try { # 确保临时文件不存在 if (Test-Path \"C:\\Users\\user\\AppData\\Local\\Temp\\cursor_path_output.txt\") { Remove-Item \"C:\\Users\\user\\AppData\\L...
'<SYSTEM32>\getmac.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "Get-Process -Name Cursor -ErrorAction SilentlyContinue | Select-Object -First 1 -ExpandProperty Path | Out-File -FilePath 'C:\\Users\\user\\AppData\\Local\\...
'<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\cmd.exe /c wmic process where name='Cursor.exe' get ExecutablePath /value"
'<SYSTEM32>\cmd.exe' /c wmic process where name='Cursor.exe' get ExecutablePath /value
'<SYSTEM32>\wbem\wmic.exe' process where name='Cursor.exe' get ExecutablePath /value
'<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Cursor.exe" /ve"
'<SYSTEM32>\cmd.exe' /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Cursor.exe" /ve
'<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Cursor.exe" /ve
'<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\cmd.exe /c where Cursor.exe"
'<SYSTEM32>\cmd.exe' /c where Cursor.exe
'<SYSTEM32>\where.exe' Cursor.exe
'<SYSTEM32>\cmd.exe' /d /s /c "getmac"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command " try { # 确保临时文件不存在 if (Test-Path \"C:\\Users\\user\\AppData\\Local\\Temp\\cursor_path_output.txt\") { Remove-Item \"C:\\Users\\user\\AppData\\L...' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "Get-Process -Name Cursor -ErrorAction SilentlyContinue | Select-Object -First 1 -ExpandProperty Path | Out-File -FilePath 'C:\\Users\\user\\AppData\\Local\\...' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\cmd.exe /c wmic process where name='Cursor.exe' get ExecutablePath /value"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Cursor.exe" /ve"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "<SYSTEM32>\cmd.exe /c where Cursor.exe"' (with hidden window)

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial