Trojan.Siggen24.45610

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '258.exe' = '%ProgramFiles(x86)%\LP\925E\258.exe'

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Security Center
Windows Defender

blocks the following features:

Windows Action Center

Terminates or attempts to terminate

the following system processes:

%WINDIR%\explorer.exe

Searches for registry branches where third party applications store passwords

[HKCU\Software\Far\Plugins\FTP\Hosts]
[HKCU\Software\BulletProof Software\BulletProof FTP Client\Options]
[HKCU\Software\BPFTP]
[HKCU\Software\TurboFTP]
[HKCU\Software\Sota\FFFTP]
[HKCU\Software\Sota\FFFTP\Options]
[HKCU\Software\CoffeeCup Software\Internet\Profiles]
[HKCU\Software\FTPWare\COREFTP\Sites]
[HKCU\Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224]
[HKCU\Software\VanDyke\SecureFX]
[HKCU\Software\Cryer\WebSitePublisher]
[HKCU\Software\ExpanDrive\Sessions]
[HKLM\Software\Wow6432Node\NCH Software\ClassicFTP\FTPAccounts]
[HKCU\SOFTWARE\NCH Software\Fling\Accounts]
[HKCU\SOFTWARE\Wow6432Node\Robo-FTP 3.7\Scripts]
[HKLM\SOFTWARE\Wow6432Node\NCH Software\Fling\Accounts]
[HKCU\Software\FTPClient\Sites]
[HKLM\Software\Wow6432Node\FTPClient\Sites]
[HKCU\Software\SoftX.org\FTPClient\Sites]
[HKLM\Software\Wow6432Node\SoftX.org\FTPClient\Sites]
[HKCU\Software\Martin Prikryl]
[HKLM\Software\Wow6432Node\Martin Prikryl]
[HKCU\Software\South River Technologies\WebDrive\Connections]
[HKLM\Software\Wow6432Node\South River Technologies\WebDrive\Connections]
[HKCU\Software\FlashPeak\BlazeFtp\Settings]
[HKCU\SOFTWARE\Wow6432Node\Robo-FTP 3.7\FTPServers]
[HKLM\SOFTWARE\Wow6432Node\Robo-FTP 3.7\FTPServers]
[HKCU\Software\BPFTP\Bullet Proof FTP\Options]
[HKCU\Software\NCH Software\ClassicFTP\FTPAccounts]
[HKCU\Software\BulletProof Software\BulletProof FTP Client\Main]
[HKCU\Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar]
[HKCU\Software\Far2\Plugins\FTP\Hosts]
[HKCU\Software\Far\SavedDialogHistory\FTPHost]
[HKCU\Software\Far2\SavedDialogHistory\FTPHost]
[HKCU\Software\Ghisler\Windows Commander]
[HKCU\Software\Ghisler\Total Commander]
[HKLM\Software\Wow6432Node\Ghisler\Windows Commander]
[HKLM\Software\Ghisler\Windows Commander]
[HKLM\Software\Wow6432Node\Ghisler\Total Commander]
[HKLM\Software\Ghisler\Total Commander]
[HKCU\Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar]
[HKCU\Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar]
[HKLM\Software\FileZilla Client]
[HKCU\Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar]
[HKCU\Software\FlashFXP\3]
[HKCU\Software\FlashFXP]
[HKLM\Software\Wow6432Node\FlashFXP\3]
[HKLM\Software\FlashFXP\3]
[HKLM\Software\Wow6432Node\FlashFXP]
[HKLM\Software\FlashFXP]
[HKCU\Software\FileZilla]
[HKCU\Software\FileZilla Client]
[HKLM\Software\Wow6432Node\FileZilla]
[HKLM\Software\FileZilla]
[HKLM\Software\Wow6432Node\FileZilla Client]
[HKCU\Software\BPFTP\Bullet Proof FTP\Main]
[HKLM\SOFTWARE\Wow6432Node\Robo-FTP 3.7\Scripts]

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\login data

Modifies file system

Creates the following files

%ProgramFiles(x86)%\lp\925e\258.exe
%APPDATA%\e134b\babe.134
%ProgramFiles(x86)%\lp\925e\819d.tmp

Network activity

Connects to

'ba###eon.com':80
'google.com':80
'localhost':63071

TCP

HTTP GET requests

http://ba###eon.com/134.gif?pr###################################################################################################################################################################...
http://www.google.com/

Other

'localhost':49196

UDP

DNS ASK ba###eon.com
DNS ASK ou####eedomains.com
DNS ASK we#####fordomains.com
DNS ASK ou#####transfers.com
DNS ASK microsoft.com
DNS ASK google.com

Miscellaneous

Searches for the following windows

ClassName: 'Progman' WindowName: ''
ClassName: 'Proxy Desktop' WindowName: ''
ClassName: 'SystemTray_Main' WindowName: ''
ClassName: 'Media Center Tray Applet' WindowName: ''
ClassName: '' WindowName: 'View Available Networks'
ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''

Creates and executes the following