BackDoor.Siggen2.3295

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\svchost
<SYSTEM32>\tasks\taskhost
<SYSTEM32>\tasks\explorer
<SYSTEM32>\tasks\spoolsv

Malicious functions

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%APPDATA%\opera software\opera stable\login data
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\holycrosschurchinstructions.docx

Modifies file system

Creates the following files

C:\intofont\udybtdceuppyxuzkxbng.exe
%TEMP%\5yqzkuycuh
%TEMP%\omxlti22jq
%TEMP%\vxwvc4i0u0
%TEMP%\kjkqnbxpet
%TEMP%\nvrdacblrw
%TEMP%\cdpzewicaz
%TEMP%\jdgeeolhhs
%TEMP%\lnyzcjgtu9
C:\perflogs\admin\explorer.exe
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%TEMP%\26j7xgukl1
%TEMP%\2uoojkpn8v
%TEMP%\04dzlzpzxf
%TEMP%\qzsa7m4iq8
%TEMP%\ua6qz0yup2
%TEMP%\43vyi82twy
%TEMP%\rpvgyqpxwl
%TEMP%\mmsoozwb45
%TEMP%\haxhke9guv
%TEMP%\qqvmcd8ftk
%TEMP%\3n1hdv7ofc
C:\intofont\q9uozln967xadi4u4mz94ycvh3guj1.bat
C:\intofont\5h8trf7x7rouuscteqx5t4mjg575hw.bat
C:\intofont\intosession.exe
C:\intofont\zojwwy0ge2aousomiqar0comav2a6x.vbe
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\svchost.exe
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\f4d236fdec2fd03914189c3b26e5cb0dfea9d761
%TEMP%\b6ef3edfc3a0ea549ede8f0c9e8a4dfa.dat
C:\totalcmd\language\taskhost.exe
%TEMP%\b4xqldbnqh
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
C:\totalcmd\language\b75386f1303e64d8139363b71e44ac16341adf4e
C:\msocache\all users\spoolsv.exe
C:\msocache\all users\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4
<Current directory>\svchost.exe
<Current directory>\f4d236fdec2fd03914189c3b26e5cb0dfea9d761
%TEMP%\vynhpw3jak
%TEMP%\rgrs1aurad
%TEMP%\r1nygo3rjn
%TEMP%\unhl9rttt3
C:\intofont\bpfbcgqtfcxmisc4pvbubvd6xr907n.vbe
C:\perflogs\admin\7a0fd90576e08807bde2cc57bcf9854bbce05fe3
%TEMP%\pg69ba7x9u

Deletes the following files

%TEMP%\vynhpw3jak
%TEMP%\43vyi82twy
%TEMP%\ua6qz0yup2
%TEMP%\qzsa7m4iq8
%TEMP%\04dzlzpzxf
%TEMP%\2uoojkpn8v
%TEMP%\26j7xgukl1
%TEMP%\lnyzcjgtu9
%TEMP%\jdgeeolhhs
%TEMP%\cdpzewicaz
%TEMP%\nvrdacblrw
%TEMP%\b4xqldbnqh
%TEMP%\kjkqnbxpet
%TEMP%\omxlti22jq
%TEMP%\5yqzkuycuh
%TEMP%\mmsoozwb45
%TEMP%\rpvgyqpxwl
%TEMP%\haxhke9guv
%TEMP%\qqvmcd8ftk
%TEMP%\3n1hdv7ofc
%TEMP%\unhl9rttt3
%TEMP%\r1nygo3rjn
%TEMP%\rgrs1aurad
%TEMP%\vxwvc4i0u0
%TEMP%\pg69ba7x9u

Network activity

TCP

HTTP GET requests

http://18#.#3.4.183/xhsjb7i321fx5je01h0e3fo4eu2gs4iwwzpqf37d1r5gb8fvmlwda/3o3ny6eb4orq92zmpu73hirraugjj8rvnmeg1rwzzyqckjtonifpf5ptxcyh5/afdc2a9fc06b6da9de6df230d858dc0f41daf51e.php?88##########...
http://18#.#3.4.183/xhsjb7i321fx5je01h0e3fo4eu2gs4iwwzpqf37d1r5gb8fvmlwda/3o3ny6eb4orq92zmpu73hirraugjj8rvnmeg1rwzzyqckjtonifpf5ptxcyh5/afdc2a9fc06b6da9de6df230d858dc0f41daf51e.php?fb##########...
http://18#.#3.4.183/xhsjb7i321fx5je01h0e3fo4eu2gs4iwwzpqf37d1r5gb8fvmlwda/3o3ny6eb4orq92zmpu73hirraugjj8rvnmeg1rwzzyqckjtonifpf5ptxcyh5/iiysvo14g8infxd0905p/8dbc82710763ea54b5533bdf552c8251.php...

'ip##fo.io':443

UDP

DNS ASK ip##fo.io

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\wscript.exe' "C:\intofont\BpFBcgQTfcxmISc4pVBubvD6XR907n.vbe"
'C:\intofont\udybtdceuppyxuzkxbng.exe' -p9682ebb40f7071006eb589953f29502aacbc5179
'%WINDIR%\syswow64\wscript.exe' "C:\intofont\ZojWWY0Ge2aousOMIqaR0COmAV2A6x.vbe"
'C:\intofont\intosession.exe'
'<Current directory>\svchost.exe'
'%WINDIR%\syswow64\cmd.exe' /c ""C:\intofont\Q9UOzln967XAdI4U4mZ94yCvh3gUj1.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""C:\intofont\5h8TRf7x7rOUuScTEQx5t4Mjg575HW.bat" "' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""C:\intofont\Q9UOzln967XAdI4U4mZ94yCvh3gUj1.bat" "
'%WINDIR%\syswow64\cmd.exe' /c ""C:\intofont\5h8TRf7x7rOUuScTEQx5t4Mjg575HW.bat" "
'<SYSTEM32>\schtasks.exe' /create /tn "svchost" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\svchost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\taskhost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'C:\PerfLogs\Admin\explorer.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\spoolsv.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "svchost" /sc ONLOGON /tr "'<Current directory>\svchost.exe'" /rl HIGHEST /f
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-MpPreference -verbose