Trojan.Siggen27.55876

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\a3d90235

Malicious functions

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

Reads files which store third party applications passwords

%APPDATA%\mozilla\firefox\profiles.ini
%APPDATA%\thunderbird\profiles.ini
%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\login data

Modifies settings of Windows Internet Explorer

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.1:19185�'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'

Modifies file system

Creates the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%TEMP%\deuepeoa
%TEMP%\ffiehe
%TEMP%\rupeieeeiy
%TEMP%\apyiryrwqpdpw
%TEMP%\oroipwyfafpr
%TEMP%\ayydedewefhfs
%TEMP%\sieityuisye
%TEMP%\aepdeuerroeof
%TEMP%\eteaqqpe
%ALLUSERSPROFILE%\yddftopda.dll
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%TEMP%\tdwuoropes
%TEMP%\tdwuoropes-shm
%TEMP%\fdpoeh
%TEMP%\sftehq
%TEMP%\iiowiewuiif
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\i1qxizwr\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\a2glzghe\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\wga70mfb\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7e0tctqx\desktop.ini
%APPDATA%\microsoft\windows\cookies\low\index.dat
%TEMP%\eqyrurhi
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cert9.db-journal
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\key4.db-journal
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cert9.db-journal
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\key4.db-journal
%TEMP%\huhetea
%TEMP%\yyaphehaw
%TEMP%\udfqaafpth
%TEMP%\eteaqqpe-shm

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\a2glzghe\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\wga70mfb\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7e0tctqx\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\i1qxizwr\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini

Deletes the following files

%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cert9.db-journal
%TEMP%\tdwuoropes
%TEMP%\tdwuoropes-shm
%TEMP%\aepdeuerroeof
%TEMP%\sftehq
%TEMP%\sieityuisye
%TEMP%\ayydedewefhfs
%TEMP%\oroipwyfafpr
%TEMP%\apyiryrwqpdpw
%TEMP%\rupeieeeiy
%TEMP%\eteaqqpe-shm
%TEMP%\ffiehe
%TEMP%\fdpoeh
%TEMP%\iiowiewuiif
%TEMP%\udfqaafpth
%TEMP%\eqyrurhi
%TEMP%\yyaphehaw
%TEMP%\huhetea
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\key4.db-journal
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cert9.db-journal
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\key4.db-journal
%TEMP%\deuepeoa
%TEMP%\eteaqqpe

Modifies the following files

%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cert9.db
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\key4.db
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cert9.db
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\key4.db
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\prefs.js
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\prefs.js

Substitutes the following files

%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cert9.db-journal
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cert9.db-journal

Network activity

Connects to

'34.##8.202.91':443

TCP

Other

'34.##8.202.91':443

Miscellaneous

Adds a root certificate

Searches for the following windows

ClassName: '{846ee340-7039-11de-9d20-806e6f6e6963}' WindowName: '{846ee340-7039-11de-9d20-806e6f6e6963}'
ClassName: 'TrayNotifyWnd' WindowName: ''
ClassName: 'SysPager' WindowName: ''
ClassName: 'ToolbarWindow32' WindowName: ''

Creates and executes the following