Trojan.Siggen8.54482

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\updfiiwr] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\updfiiwr] 'ImagePath' = '%WINDIR%\SysWOW64\updfiiwr\rtmxemaq.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\updfiiwr] 'ImagePath' = '%WINDIR%\SysWOW64\updfiiwr\rtmxemaq.exe'

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\updfiiwr' = '00000000'

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Injects code into

the following system processes:

%WINDIR%\syswow64\svchost.exe

Modifies file system

Creates the following files

%TEMP%\rtmxemaq.exe
%WINDIR%\syswow64\config\systemprofile:.repos

Moves the following files

from %TEMP%\rtmxemaq.exe to %WINDIR%\syswow64\updfiiwr\rtmxemaq.exe

Deletes itself.

Network activity

TCP

HTTP GET requests

http://www.google.com/
http://li##4u.ru/client/users.json?t%######################################

'43.#31.4.7':443

'93.#79.68.4':425

'mx#.##taguard.no':25

'mx#.##b-support.dk':25

'mx.###mexperts.com':25

'ma#####.freelotto.com':25

'mx###.##il.am0.yahoodns.net':25

'fi######il.jobtarget.com':25

'ms#####.##c.protection.outlook.com':25

'al######x-vip1.prodigy.net':25

'ma##.tcmsp.net':25

'd2#####.#.#ss.uk.barracudanetworks.com':25

'hi##ie.nu':25

'mx#.##rthlink.net':25

'ma##.##abamabowling.com':25

'mx#.#ebhero.com':25

'mx.###courier.com':25

'as#.##flexion.net':25

'mx#.##ailsrvr.com':25

'ma##.#kkuaria.com':25

'17#.#11.49.43':425

'eu#.###.#rotection.outlook.com':25

'ma##.##rrywealth.com':25

'aspmx.l.google.com':25

'85.##4.134.88':481

'po##.#ashvault.pro':80

'ho#########.olc.protection.outlook.com':25

'mx.###zta.onet.pl':25

'sm###.ena.net':25

'gmail-smtp-in.l.google.com':25

'mx####.##il.gm0.yahoodns.net':25

'alt2.aspmx.l.google.com':25

'mt#.##art-nrw.de':25

'mx#.##ic.kg.ac.rs':25

'46.#.52.109':425

'da########-com.relay1g.spamh.com':25

'ma##.#-email.net':25

'mx#.#eznam.cz':25

'ms#####p-mx1.hinet.net':25

'mx##.#tp-mailer.de':25

'ALT1.ASPMX.L.GOOGLE.com':25

'ms#####p-mx2.hinet.net':25

'19#.#.131.101':425

'14#.#6.199.2':425

'85.##.119.25':425

'ba######a.ics-america.com':25

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK th####secainc.com
DNS ASK wi####owercases.com
DNS ASK wi####owergroup.net
DNS ASK st##am.cz
DNS ASK wi####owerinn.com
DNS ASK co#.net
DNS ASK cx#.##.#.cloudfilter.net
DNS ASK sb###obal.net
DNS ASK al######x-vip1.prodigy.net
DNS ASK ms#####.##c.protection.outlook.com
DNS ASK pa###pina.com
DNS ASK ve####nwireless.com
DNS ASK mx######4a201.pphosted.com
DNS ASK ho###blin.co.uk
DNS ASK d2#####.#.#ss.uk.barracudanetworks.com
DNS ASK fl###ronics.com
DNS ASK mx######d6701.pphosted.com
DNS ASK be##buy.com
DNS ASK mx#######b01.gslb.pphosted.com
DNS ASK hi##ie.nu
DNS ASK tg##s.com
DNS ASK tg##d.com
DNS ASK tg###mit.com
DNS ASK ms#.com
DNS ASK wi#####wershop.co.uk
DNS ASK nt##roup.it
DNS ASK mx.##sgroup.it
DNS ASK th####irlings.com
DNS ASK jo###upport.dk
DNS ASK mx#.##b-support.dk
DNS ASK jo####thballs.com
DNS ASK jo##abs.com
DNS ASK mx.###mexperts.com
DNS ASK wi#####wer-market.com
DNS ASK google.com
DNS ASK sm######mch20.panalpina.com
DNS ASK t-##line.de
DNS ASK sm######.mc.a.cloudfilter.net
DNS ASK fr###otto.com
DNS ASK ma#####.freelotto.com
DNS ASK ud##.edu
DNS ASK ya##o.co.uk
DNS ASK mx###.##il.am0.yahoodns.net
DNS ASK jo###rget.com
DNS ASK fi######il.jobtarget.com
DNS ASK mx##.#-online.de
DNS ASK wa###ker.com
DNS ASK mc##i.com
DNS ASK eu#.###.#rotection.outlook.com
DNS ASK at####.hosts.co.uk
DNS ASK sc###cks.com
DNS ASK si.##ail.gs.com
DNS ASK ve#####-encoding.com
DNS ASK ma##.tcmsp.net
DNS ASK em#####appliance.com
DNS ASK mx#######601.gslb.pphosted.com
DNS ASK cf##.com
DNS ASK sm##.xap.com
DNS ASK oo##.com
DNS ASK ba######a.ics-america.com
DNS ASK ma##.#kkuaria.com
DNS ASK gr###ages.no
DNS ASK ak###ria.com
DNS ASK ma##.#kkuaria.org
DNS ASK wi####owersoft.com
DNS ASK ma##.#ostyou.net
DNS ASK cf#a.us
DNS ASK ma##.cfxa.us
DNS ASK ga##com.com
DNS ASK mx.#######.com.cust.b.hostedemail.com
DNS ASK ak###king.de
DNS ASK ma##.#kku-king.de
DNS ASK ma#######xcite.roc2.bluetie.com
DNS ASK ex##te.com
DNS ASK mx#.##taguard.no
DNS ASK sm##.##cureserver.net
DNS ASK mx.###courier.com
DNS ASK ho##ail.de
DNS ASK hi##i.in
DNS ASK bs#.##rra.com.br
DNS ASK vi#####br-mx.terra.com
DNS ASK ak##a.com
DNS ASK mx#.#ebhero.com
DNS ASK al####abowling.com
DNS ASK li##4u.ru
DNS ASK ma##.##abamabowling.com
DNS ASK ak##a.it
DNS ASK pe###epc.com
DNS ASK mx#.##rthlink.net
DNS ASK si##.com
DNS ASK as#.##flexion.net
DNS ASK al####abrick.com
DNS ASK mx#.##ailsrvr.com
DNS ASK ju##.com
DNS ASK mx.##s.untd.com
DNS ASK lo###dbonar.com
DNS ASK ma######.lowandbonar.com
DNS ASK ph###sdodge.com
DNS ASK ha###urier.com
DNS ASK di###alview.com
DNS ASK mx##.gmx.net
DNS ASK gm#.ph
DNS ASK ti###linet.it
DNS ASK alt2.aspmx.l.google.com
DNS ASK kd#.##globe.ne.jp
DNS ASK bg#####1.biglobe.ne.jp
DNS ASK st###-nrw.de
DNS ASK mt#.##art-nrw.de
DNS ASK po###a.onet.pl
DNS ASK eg##co.com
DNS ASK aspmx.l.google.com
DNS ASK wp.pl
DNS ASK k1##n.net
DNS ASK eg###uto.com
DNS ASK me###one.net
DNS ASK da########-com.relay1g.spamh.com
DNS ASK ge##.##s-automotive.com
DNS ASK qu##les.com
DNS ASK mx######68d01.pphosted.com
DNS ASK de###nsult.de
DNS ASK ma######1.deutschebahn.com
DNS ASK ra##axy.com
DNS ASK ma###.ranbaxy.com
DNS ASK tr##.com
DNS ASK mx#######501.gslb.pphosted.com
DNS ASK da###rylaw.com
DNS ASK cg#3.fr
DNS ASK ho##ial.com
DNS ASK mx#.##ic.kg.ac.rs
DNS ASK vi##in.net
DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
DNS ASK mx.##.##mail.iss.as9143.net
DNS ASK 19#.###.#11.95.bl.spamcop.net
DNS ASK op.pl
DNS ASK 19#.###.#11.95.zen.spamhaus.org
DNS ASK mx.###zta.onet.pl
DNS ASK ti##ali.it
DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
DNS ASK gm##l.com
DNS ASK gmail-smtp-in.l.google.com
DNS ASK et###.#ail.tiscali.it
DNS ASK po##.#ashvault.pro
DNS ASK sm###.ena.net
DNS ASK ho##ail.com
DNS ASK ho#########.olc.protection.outlook.com
DNS ASK ki####olding.com
DNS ASK mx##.#####-group.kibarholding.com
DNS ASK ve##zon.net
DNS ASK mx####.##il.gm0.yahoodns.net
DNS ASK kg.#c.rs
DNS ASK 19#.###.211.95.in-addr.arpa
DNS ASK 19#.###.#11.95.cbl.abuseat.org
DNS ASK ak###ria.org
DNS ASK ma##.#-email.net
DNS ASK jo###eere.com
DNS ASK mx######b2d01.pphosted.com
DNS ASK se##v.com
DNS ASK th#####lpoint.org.uk
DNS ASK mp##.com
DNS ASK ma##.mpsa.com
DNS ASK mk##rp.com
DNS ASK ma##.mkcorp.com
DNS ASK gm#.de
DNS ASK mx##.#mig.gmx.net
DNS ASK ge##ing.de
DNS ASK pt.#bm.com
DNS ASK ALT1.ASPMX.L.GOOGLE.com
DNS ASK ai#.com
DNS ASK am####05.aig.com
DNS ASK th#####gerreport.com
DNS ASK ao#.com
DNS ASK ba####america.com
DNS ASK mx#######c05.gslb.pphosted.com
DNS ASK gs.com
DNS ASK ca###wealth.com
DNS ASK ma##.##rrywealth.com
DNS ASK th#####watergroup.com
DNS ASK mx#######a01.gslb.pphosted.com
DNS ASK mx##.#tp-mailer.de
DNS ASK gr###point.com
DNS ASK mx.#p.pl
DNS ASK mx#######101.gslb.pphosted.com
DNS ASK se##am.cz
DNS ASK mx#.#eznam.cz
DNS ASK an######anzlei-gutwald.de
DNS ASK mx##.#spgateway.de
DNS ASK sp####nau-ries.de
DNS ASK ms#.#inet.net
DNS ASK ms#####p-mx1.hinet.net
DNS ASK go###email.com
DNS ASK jp###gan.com
DNS ASK se####ayagam.com
DNS ASK ms#####p-mx2.hinet.net
DNS ASK cl#######.us.messagelabs.com
DNS ASK ha###burton.com
DNS ASK mx#######f01.gslb.pphosted.com
DNS ASK ne##is.com
DNS ASK cl######.us.messagelabs.com
DNS ASK rc#.com
DNS ASK mx#######607.gslb.pphosted.com
DNS ASK gr####sanjose.com
DNS ASK sm##.##upo-sanjose.com
DNS ASK ho###il.co.uk
DNS ASK ch##e.com
DNS ASK mx#######nxto.departement13.fr

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\updfiiwr\rtmxemaq.exe' /d"<Full path to file>"
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\updfiiwr\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\rtmxemaq.exe" %WINDIR%\SysWOW64\updfiiwr\' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create updfiiwr binPath= "%WINDIR%\SysWOW64\updfiiwr\rtmxemaq.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' description updfiiwr "wifi internet conection"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start updfiiwr' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\updfiiwr\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\rtmxemaq.exe" %WINDIR%\SysWOW64\updfiiwr\
'%WINDIR%\syswow64\sc.exe' create updfiiwr binPath= "%WINDIR%\SysWOW64\updfiiwr\rtmxemaq.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\sc.exe' description updfiiwr "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start updfiiwr
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/xhv -o pool.hashvault.pro:80 -u hvs1hBH2qRhZkKfQyujRfXN4wmUM8hM4VQnhn9xUM6NVgAcdnA3dUBh7qqFx38kZTVEbU3tD3jr2aFXwFtwyj3is7hGGAcW1EH.5000 -p Г‘ВЃ -k

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial