Trojan.Siggen22.2529

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\Software\Classes\thunder\shell\open\command] '' = '"%ProgramFiles(x86)%\Thunder Network\MiniThunder\bin\ThunderMini.exe" %1'
[HKLM\Software\Classes\MiniXunlei.Bittorrent.1\shell\open\command] '' = '"%ProgramFiles(x86)%\Thunder Network\MiniThunder\bin\ThunderMini.exe" %1'
[HKLM\SOFTWARE\Classes\ed2k\shell\open\command] '' = '"%ProgramFiles(x86)%\Thunder Network\MiniThunder\bin\ThunderMini.exe" %1'
[HKLM\SOFTWARE\Classes\minithunder\shell\open\command] '' = '"%ProgramFiles(x86)%\Thunder Network\MiniThunder\bin\ThunderMini.exe" %1'

Modifies file system

Creates the following files

%WINDIR%\syswow64\thundermini1.5.3.288.exe
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\task_stop_btn_down.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\task_stop_btn_normal.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\task_stop_btn_over.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\taskbar_bgofnum.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\taskbar_unsigned.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\task_start_btn_over.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\task_state_icon_6in1.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\taskstate.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\tool_icon_4in1.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\toolwndbk.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\triangle_delete.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\warning_texture.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\welcomeframe.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\tiny_close_btn.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\tool_icon_3in1.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\task_start_btn_normal.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\task_restart_btn_over.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\xlheadbar_bk.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\icon_4in1.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\imagelist.checkbox.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\line_17h.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\maindlg_title.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\radio_btn_list.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\task_open_btn_down.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\task_open_btn_normal.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\task_open_btn_over.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\task_opendir_btn_down.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\task_opendir_btn_normal.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\task_opendir_btn_over.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\task_restart_btn_down.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\task_restart_btn_normal.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\xlheadbar.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\downpop_icon_list.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\task_start_btn_down.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\btn_23h_down.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\xllitelogo.png
%ProgramFiles(x86)%\thunder network\minithunder\bin\instfilename
C:\users\public\thunder network\mini_downloadlib_1_5_3_288\profiles\bootstrap.dat
C:\users\public\thunder network\mini_downloadlib_1_5_3_288\profiles\dhtnodes.dat
C:\users\public\thunder network\mini_downloadlib_1_5_3_288\profiles\nodes.dat
C:\users\public\thunder network\mini_downloadlib_1_5_3_288\profiles\server.met
%TEMP%\nsseb98.tmp\nsdialogs.dll
%LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
C:\users\public\documents\thunder network\minixloem\thunder\data\taskdb.dat-journal
C:\users\public\documents\thunder network\minixloem\thunder\data\taskdb.dat
C:\users\public\documents\thunder network\minixloem\thunder\profiles\config.ini
C:\users\public\thunder network\mini_downloadlib_1_5_3_288\profiles\error.dat
C:\users\public\thunder network\mini_downloadlib_1_5_3_288\profiles\asyn_frame.dat
%TEMP%\etilqs_lda3kkcoxczwkdb
C:\users\public\thunder network\cid_store.dat
C:\users\public\thunder network\mini_downloadlib_1_5_3_288\profiles\datu
%ALLUSERSPROFILE%\thunder network\downloadlib\pub_store.dat
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\down_triangle.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\expandcollapse.png
%TEMP%\nsseb98.tmp\system.dll
%ProgramFiles(x86)%\thunder network\minithunder\bho\thunderagent.dll
%ProgramFiles(x86)%\thunder network\minithunder\bho\xlnoniesvr.exe
%ProgramFiles(x86)%\thunder network\minithunder\bho\xunleibho.dll
%ProgramFiles(x86)%\thunder network\minithunder\bho\getallurl.htm
%ProgramFiles(x86)%\thunder network\minithunder\bho\geturl.htm
%ProgramFiles(x86)%\thunder network\minithunder\bho\minixlgetallurl.htm
%ProgramFiles(x86)%\thunder network\minithunder\bho\minixlgeturl.htm
%ProgramFiles(x86)%\thunder network\minithunder\bho\thunder.xpi
%ProgramFiles(x86)%\thunder network\minithunder\bho\xl_plugin_chrome.crx
%ProgramFiles(x86)%\thunder network\minithunder\bho\xl_plugin_chrome_5.crx
C:\users\public\desktop\Г±ВёГ Г—ВѕВ«ВјГІВ°Г¦.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\Г±ВёГ Г—ГЁГВјГѕ\Г±ВёГ Г—ВѕВ«ВјГІВ°Г¦\Г¦ГґВ¶ВЇГ±ВёГ Г—ВѕВ«ВјГІВ°Г¦.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\Г±ВёГ Г—ГЁГВјГѕ\Г±ВёГ Г—ВѕВ«ВјГІВ°Г¦\Г°В¶ГґГёГ±ВёГ Г—ВѕВ«ВјГІВ°Г¦.lnk
%ProgramFiles(x86)%\thunder network\minithunder\bho\thunderagent7.2.7.3498.dll
%ProgramFiles(x86)%\thunder network\minithunder\bho\xunleibho7.2.7.3498.dll
%ProgramFiles(x86)%\thunder network\minithunder\uninst.exe
%ProgramFiles(x86)%\thunder network\minithunder\bho\bhoinstall.exe
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\delete_btn_list.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\default_menu.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\default_icon.png
%ProgramFiles(x86)%\thunder network\minithunder\bin\download_engine.dll
%ProgramFiles(x86)%\thunder network\minithunder\bin\dphubt.dll
%ProgramFiles(x86)%\thunder network\minithunder\bin\libpng13.dll
%ProgramFiles(x86)%\thunder network\minithunder\bin\zlib1.dll
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader.xml
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\downtriangle.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\exporttask2thunder7progress.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\exporttask2thunder7progressbk.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\mainframe.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\minixltab_normal.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\minixltab_sel.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\mini_btn.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\msgboxicon.png
%ProgramFiles(x86)%\thunder network\minithunder\bin\uninstallclean.exe
%ProgramFiles(x86)%\thunder network\minithunder\bin\thundermini.exe
%ProgramFiles(x86)%\thunder network\minithunder\bin\dl_lib.dll
%TEMP%\thunder network\minixloem\thunder\crashinfo.ini
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\msgboxicon_warning.png
%ProgramFiles(x86)%\thunder network\minithunder\bin\sqlite3.dll
%TEMP%\nsseb98.tmp\modern-header.bmp
%WINDIR%\syswow64\atl71.dll
%WINDIR%\syswow64\msvcp71.dll
%WINDIR%\syswow64\msvcr71.dll
%ProgramFiles(x86)%\thunder network\minithunder\bin\thunderliveud.exe
%ProgramFiles(x86)%\thunder network\minithunder\bin\xlbughandler.dll
%TEMP%\nsxeb68.tmp
%ProgramFiles(x86)%\thunder network\minithunder\bin\xlluaruntime.dll
%ProgramFiles(x86)%\thunder network\minithunder\bin\download-complete.wav
%ProgramFiles(x86)%\thunder network\minithunder\bin\thunderfw.exe
%ProgramFiles(x86)%\thunder network\minithunder\bin\xlbugreport.exe
%ProgramFiles(x86)%\thunder network\minithunder\bin\dl_peer_id.dll
%ProgramFiles(x86)%\thunder network\minithunder\bin\libexpat.dll
%ProgramFiles(x86)%\thunder network\minithunder\bin\minizip.dll
%ProgramFiles(x86)%\thunder network\minithunder\bin\xl_data.dll
%ProgramFiles(x86)%\thunder network\minithunder\bin\torrentfile.ico
%TEMP%\nsseb98.tmp\nsdialogsex.dll
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\normalframe.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\taskactive.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\btn_26h_normal.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\btn_26h_over.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\btn_sel_26h_down.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\btn_sel_26h_normal.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\btn_sel_26h_over.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\btn_update_down.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\btn_update_normal.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\btn_update_over.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\button_orange_normal.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\button_orange_over.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\check_box.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\check_btn_list.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\close_btn.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\close_btn_alone.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\selbutton.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\btn_26h_down.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\successicon.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\btn_23h_over.png
%ProgramFiles(x86)%\thunder network\minithunder\bin\xlcrypto.dll
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\taskactiveprogress.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\taskdownloadnormal.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\taskdownloadselected.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\taskfailed.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\taskfailedactived.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\taskfailedselected.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\tasknormal.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\tasknormalprogress.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\taskselected.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\tipsframe.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\title_btn.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\about_title.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\bitmap.griper.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\bitorrent_big.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\bitorrent_min.png
%ProgramFiles(x86)%\thunder network\minithunder\skin\downloader\btn_23h_normal.png
%HOMEPATH%\downloads\unconfirmed 731223.crdownload

Deletes the following files

%TEMP%\nsseb98.tmp\modern-header.bmp
%TEMP%\nsseb98.tmp\nsdialogs.dll
%TEMP%\nsseb98.tmp\nsdialogsex.dll
%TEMP%\nsseb98.tmp\system.dll

Network activity

Connects to

'do##.sandai.net':80
'he##.xunlei.com':80
'cl####.stat.xunlei.com':80
'hu###.hz.sandai.net':80
'hu####.hz.sandai.net':80
'localhost':80
'hu######ta.hz.sandai.net':80
'clients2.google.com':443
'clients4.google.com':443
'tr######e.googleapis.com':443
'clients3.google.com':443
'ss#.#static.com':443

TCP

HTTP GET requests

http://do##.sandai.net/mini/ThunderMini1.5.3.288.exe
http://he##.xunlei.com/online/stat_inst.php?th#####################################################################################################

HTTP POST requests

http://11#.##2.223.136:80/
http://14#.##6.220.33:80/

Other

'clients2.google.com':443
'clients4.google.com':443
'tr######e.googleapis.com':443
'clients3.google.com':443
'ss#.#static.com':443

UDP

DNS ASK do##.sandai.net
DNS ASK tr######e.googleapis.com
DNS ASK clients4.google.com
DNS ASK clients2.google.com
DNS ASK hu######ta.hz.sandai.net
DNS ASK sc###.##ub.hz.sandai.net
DNS ASK im#####r.hz.sandai.net
DNS ASK google.com
DNS ASK clients3.google.com
DNS ASK re###.##ub.hz.sandai.net
DNS ASK hu###.hz.sandai.net
DNS ASK 36##.#l7.sandai.net
DNS ASK hu#####.hz.sandai.net
DNS ASK hu####.hz.sandai.net
DNS ASK cl####.stat.xunlei.com
DNS ASK wu###u114.com
DNS ASK he##.xunlei.com
DNS ASK ss#.#static.com
'hu#####.hz.sandai.net':8000

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''
ClassName: '#32770' WindowName: 'Г‘ВёГЂГ—ВѕВ«ВјГІВ°Г¦ '
ClassName: 'Button' WindowName: 'В°ВІГ—В°(&I)'
ClassName: '#32770' WindowName: 'Г‘ВёГЂГ—ВѕВ«ВјГІВ°Г¦'
ClassName: 'MiniXLmaxthonShellCmdWnd{823C17F4-54EA-43f4-A1D9-D3C49A287791}' WindowName: ''
ClassName: 'MiniXLThunderShellCmdWnd{823C17F4-54EA-43f4-A1D9-D3C49A287791}' WindowName: ''
ClassName: 'XLUEFrameHostWnd' WindowName: 'Г‘ВёГЂГ—7'
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
ClassName: 'MiniXLThunderShellCmdWnd{823C17F4-54EA-43f4-A1D9-D3C49A287791}' WindowName: 'MiniXLThunderShellCmdWnd{823C17F4-54EA-43f4-A1D9-D3C49A287791}'
ClassName: 'WTWindow' WindowName: 'CFВ·ГЂВ·Г‡В·ВЁВіГЊГђГІ'
ClassName: 'AfxFrameOrView42s' WindowName: ''
ClassName: 'Shell Embedding' WindowName: ''
ClassName: 'Shell DocObject View' WindowName: ''
ClassName: 'Internet Explorer_Server' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\thundermini1.5.3.288.exe'
'%ProgramFiles(x86)%\thunder network\minithunder\bin\uninstallclean.exe'
'%ProgramFiles(x86)%\thunder network\minithunder\bho\bhoinstall.exe' -install -silent
'%ProgramFiles(x86)%\thunder network\minithunder\bin\thunderfw.exe' ThunderMini1.5.3.288 "%ProgramFiles(x86)%\Thunder Network\MiniThunder\bin\ThunderMini.exe"
'%ProgramFiles(x86)%\thunder network\minithunder\bho\bhoinstall.exe' -r chrome
'%ProgramFiles(x86)%\thunder network\minithunder\bho\bhoinstall.exe' -r firefox
'%ProgramFiles(x86)%\thunder network\minithunder\bin\thundermini.exe'

Executes the following

'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Thunder Network\MiniThunder\BHO\ThunderAgent.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Thunder Network\MiniThunder\BHO\XunleiBHO.dll"

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial