Trojan.Siggen9.16039

Technical Information

Modifies file system

Creates the following files

C:\iifb\bd0.html
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\cjpd.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.9_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.8_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.7_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.6_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.5_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.4_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.3_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.2_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.1_0\content.js
C:\llq\cj\appdata\roaming\360se6\user data\default\extensions\nfbikdkjfjcejddbdcpbafnclkfdhijd\52.41.34_0\js\main.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.9_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.7_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.6_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.5_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.4_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.3_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.2_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.10_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.2_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.1_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.0_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.8_0\content.js
C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\default-big.png
C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\default.ico
C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\manifest.xml
%APPDATA%\microsoft\internet explorer\userdata\ym6ouwc2\oxmlstore[1].xml
%APPDATA%\microsoft\internet explorer\userdata\index.dat
nul
C:\llq\seyishi.key
C:\llq\seyishi.crt
C:\llq\cs.htm
C:\llq\cj\favorites\聚划算.url
C:\llq\cj\favorites\网址大全.url
C:\llq\cj\favorites\百度.url
C:\llq\cj\favorites\爱淘宝.url
C:\llq\cj\favorites\天猫.url
C:\llq\cj\favorites\links\聚划算.url
C:\llq\cj\favorites\links\网址大全.url
C:\llq\cj\favorites\links\百度.url
C:\llq\cj\favorites\links\爱淘宝.url
C:\llq\cj\favorites\links\天猫.url
C:\llq\cj\favorites\links\desktop.ini
C:\llq\cj\appdata\roaming\sogouexplorer\favorite3.dat
C:\llq\cj\appdata\roaming\sogouexplorer\extension4.db
C:\llq\cj\appdata\roaming\sogouexplorer\extension3.db
C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.sogou.muti-translate\1.7.1.33\js\main.js
C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\sgs.js
C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\sg.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.9_0\js\mark.js
%APPDATA%\microsoft\internet explorer\userdata\tfxpk3i2\oxmlstore[1].xml
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.8_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.6_0\js\mark.js
C:\llq\ca15.cer
C:\kl\ccc.cmd
C:\iifb\xgg.html
C:\iifb\shuo4.html
C:\iifb\pc.html
C:\iifb\im\yhfdjtjyt.gif
C:\iifb\im\thumbs.db
C:\iifb\im\style123.css
C:\iifb\im\333.gif
C:\iifb\im\222.gif
C:\llq\certutil.lnk
C:\iifb\im\111.gif
C:\iifb\hn.html
C:\iifb\good.html
C:\iifb\gg.html
C:\iifb\dh.html
C:\iifb\bdx.html
C:\iifb\bdbd.html
C:\iifb\bd4.html
C:\iifb\bd3.html
C:\iifb\bd2.html
C:\iifb\bd1.html
C:\iifb\im\000.png
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.5_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.6_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.7_0\bubble_compiled.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.5_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.4_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.3_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.2_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.1_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.0_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\content.js
C:\llq\cj\appdata\local\liebao\user data\default\extensions\ikhdkkncnoglghljlkmcimlnlhkeamad\4.3_0\js\content.js
C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\ohjkicjidmohhfcjjlahfppkdblibkkb\14.21.0_0\include.preload.js
C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\ohjkicjidmohhfcjjlahfppkdblibkkb\14.21.0_0\include.postload.js
C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\bcajlbggkngndkclhoihkflldkaeeohm\4.2.3_0\include.preload.js
C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\bcajlbggkngndkclhoihkflldkaeeohm\4.2.3_0\include.postload.js
C:\llq\cj\appdata\local\360chrome\chrome\user data\default\extensions\dlmbnmecnkclepjchnmjnoecnhlokdld\71.24.6_0\include.preload.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.5_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.4_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.3_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.2_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.1_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.0_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.9_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.8_0\bubble_compiled.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.7_0\js\mark.js
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020022820200229\index.dat

Sets the 'hidden' attribute to the following files

C:\iifb\im\thumbs.db

Deletes the following files

%APPDATA%\microsoft\internet explorer\userdata\ym6ouwc2\oxmlstore[1].xml
%APPDATA%\microsoft\internet explorer\userdata\tfxpk3i2\oxmlstore[1].xml

Substitutes the following files

%APPDATA%\microsoft\internet explorer\userdata\ym6ouwc2\oxmlstore[1].xml
%APPDATA%\microsoft\internet explorer\userdata\tfxpk3i2\oxmlstore[1].xml

Network activity

TCP

HTTP GET requests

http://vi#.###gtaigroup.com/js/ym.js
http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
http://vi#.###gtaigroup.com/tongbu/hx.html?sh########
http://js.##ers.51.la/20061693.js
http://ia.#1.la/go1?id###########################################################################################################################################################################...

'vi#.###gtaigroup.com':443

'po#.#aidu.com':443

'js.##ers.51.la':443

'du#.##idustatic.com':443

'ia.#1.la':443

'ec####.baidu.com':443

UDP

DNS ASK vi#.###gtaigroup.com
DNS ASK vi#.#dqkq.tw
DNS ASK po#.#aidu.com
DNS ASK js.##ers.51.la
DNS ASK du#.##idustatic.com
DNS ASK ia.#1.la
DNS ASK ec####.baidu.com
DNS ASK oc##.thawte.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'IEFrame' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''
ClassName: 'Static' WindowName: ''
ClassName: 'DDEMLMom' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\ccc.cmd" h"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\ccc.cmd" "
'%WINDIR%\syswow64\mshta.exe' vbscript:createobject("wscript.shell").run("""C:\kl\ccc.cmd"" h",0)(window.close)
'%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\ccc.cmd" h"
'%WINDIR%\syswow64\cmd.exe' /c tasklist | findstr /i "cmd.exe" 2>nul
'%WINDIR%\syswow64\tasklist.exe'
'%WINDIR%\syswow64\findstr.exe' /i "cmd.exe"
'%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n "60"

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial