Trojan.Siggen18.30385

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'SMΔRT-Protection' = '%ProgramFiles(x86)%\Smadav\SMΔRTP.exe rts'

Creates or modifies the following files

Malicious functions

Executes the following

Modifies file system

Creates the following files

%TEMP%\7zipsfx.000\reg64.reg
%ProgramFiles(x86)%\smadav\unins000.dat
C:\users\public\desktop\smadδv.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\smadav antivirus\uninstall smadav.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\smadav antivirus\smadav.lnk
%ProgramFiles(x86)%\smadav\is-s8v73.tmp
%ProgramFiles(x86)%\smadav\is-tb47m.tmp
%ProgramFiles(x86)%\smadav\is-nk188.tmp
%ProgramFiles(x86)%\smadav\is-f25u7.tmp
%ProgramFiles(x86)%\smadav\is-u4o88.tmp
%ProgramFiles(x86)%\smadav\is-gdsgg.tmp
%ProgramFiles(x86)%\smadav\is-m07d0.tmp
%ProgramFiles(x86)%\smadav\is-b1mpc.tmp
%ProgramFiles(x86)%\smadav\is-nfa8m.tmp
%ProgramFiles(x86)%\smadav\is-q6q2q.tmp
%ProgramFiles(x86)%\smadav\is-scc3m.tmp
%ProgramFiles(x86)%\smadav\is-4ud83.tmp
%ProgramFiles(x86)%\smadav\is-do3mk.tmp
%TEMP%\is-8ru7p.tmp\_isetup\_isdecmp.dll
%TEMP%\is-8ru7p.tmp\_isetup\_shfoldr.dll
%TEMP%\is-8ru7p.tmp\_isetup\_setup64.tmp
%TEMP%\is-ooghe.tmp\smadav2022rev148.tmp
%TEMP%\7zipsfx.000\smadav2022rev148.exe
%TEMP%\7zipsfx.000\reg86.reg
%APPDATA%\smadav\smadav.xml
%APPDATA%\smadav\smadavsecondaryupdater.xml

Deletes the following files

Moves the following files

from %ProgramFiles(x86)%\smadav\is-do3mk.tmp to %ProgramFiles(x86)%\smadav\unins000.exe
from %ProgramFiles(x86)%\smadav\is-4ud83.tmp to %ProgramFiles(x86)%\smadav\readme.txt
from %ProgramFiles(x86)%\smadav\is-scc3m.tmp to %ProgramFiles(x86)%\smadav\smδrtp.exe
from %ProgramFiles(x86)%\smadav\is-q6q2q.tmp to %ProgramFiles(x86)%\smadav\smadav.loov
from %ProgramFiles(x86)%\smadav\is-nfa8m.tmp to %ProgramFiles(x86)%\smadav\smadav-updater.exe
from %ProgramFiles(x86)%\smadav\is-b1mpc.tmp to %ProgramFiles(x86)%\smadav\smadengine.dll
from %ProgramFiles(x86)%\smadav\is-m07d0.tmp to %ProgramFiles(x86)%\smadav\smadextmenu64.dll
from %ProgramFiles(x86)%\smadav\is-gdsgg.tmp to %ProgramFiles(x86)%\smadav\smadhook32c.dll
from %ProgramFiles(x86)%\smadav\is-u4o88.tmp to %ProgramFiles(x86)%\smadav\smadhook64c.dll
from %ProgramFiles(x86)%\smadav\is-f25u7.tmp to %ProgramFiles(x86)%\smadav\smadavprotect32.exe
from %ProgramFiles(x86)%\smadav\is-nk188.tmp to %ProgramFiles(x86)%\smadav\smadavprotect64.exe
from %ProgramFiles(x86)%\smadav\is-tb47m.tmp to %ProgramFiles(x86)%\smadav\smadavhelper.exe
from %ProgramFiles(x86)%\smadav\is-s8v73.tmp to %ProgramFiles(x86)%\smadav\smadavsecondaryupdater.exe
from %ProgramFiles(x86)%\smadav\smadextmenu64.dll to %ProgramFiles(x86)%\smadav\smadextc64.dll

Network activity

Connects to

TCP

HTTP GET requests

http://le##ar.com/smadstat.php?ma##################################################################################################################################
http://www.le##ar.com/update/secure-smadav.txt
http://www.le##ar.com/update/secure-smadav.txt/

HTTP POST requests

UDP

Miscellaneous

Searches for the following windows

Creates and executes the following

'%TEMP%\7zipsfx.000\smadav2022rev148.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-ooghe.tmp\smadav2022rev148.tmp' /SL5="$130226,1230613,133120,%TEMP%\7ZipSfx.000\smadav2022rev148.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%ProgramFiles(x86)%\smadav\smδrtp.exe' rtc
'%ProgramFiles(x86)%\smadav\smadavprotect64.exe'
'%ProgramFiles(x86)%\smadav\smδrtp.exe'
'%TEMP%\7zipsfx.000\smadav2022rev148.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /f /im SMΔRTP.exe' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /f /im SmadavProtect32.exe' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /f /im SmadavProtect64.exe' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /f /im SmadavSecondaryUpdater.exe' (with hidden window)
'%WINDIR%\regedit.exe' /s reg64.reg' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /create /tn "smadav" /xml "%APPDATA%\Smadav\smadav.xml"' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Smadav\SmadExtc64.dll"' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /create /tn "SmadavSecondaryUpdater" /xml "%APPDATA%\Smadav\SmadavSecondaryUpdater.xml"' (with hidden window)

Executes the following

'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\SMADAV\SmadExtMenu64.dll"
'%WINDIR%\regedit.exe' /s reg64.reg
'%WINDIR%\syswow64\schtasks.exe' /create /tn "smadav" /xml "%APPDATA%\Smadav\smadav.xml"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Smadav\SmadExtc64.dll"
'%WINDIR%\syswow64\schtasks.exe' /create /tn "SmadavSecondaryUpdater" /xml "%APPDATA%\Smadav\SmadavSecondaryUpdater.xml"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Smadav\SmadExtc64.dll"