Trojan.Siggen9.17149

Technical Information

Modifies file system

Creates the following files

%TEMP%\nssb151.tmp
%TEMP%\nssb1a0.tmp\installer-164x314.bmp
%TEMP%\nspf67f.tmp
%TEMP%\nsof1eb.tmp
%TEMP%\nsie344.tmp
%TEMP%\nssb1a0.tmp\wmiinspector.dll
%TEMP%\nssb1a0.tmp\md5dll.dll
%TEMP%\installationpixel.txt
%TEMP%\nssb1a0.tmp\inetc.dll
%TEMP%\isprocessactive.txt
%TEMP%\nsqc53b.tmp
%TEMP%\nssb1a0.tmp\modern-header.bmp
%TEMP%\nsdbdf7.tmp
%TEMP%\nssb1a0.tmp\nsexec.dll
%TEMP%\ff.bat
%TEMP%\nstb376.tmp
%TEMP%\sqlite3.exe
%TEMP%\nssb1a0.tmp\userinfo.dll
%WINDIR%\reimage.ini
%TEMP%\nssb1a0.tmp\banner.dll
%TEMP%\nssb1a0.tmp\system.dll
%TEMP%\downloader log.txt
%TEMP%\nssb1a0.tmp\logex.dll
%TEMP%\nssb1a0.tmp\execdos.dll
%TEMP%\nssb1a0.tmp\nsdialogs.dll

Deletes the following files

%TEMP%\nstb376.tmp
%TEMP%\ff.bat
%TEMP%\nsdbdf7.tmp
%TEMP%\nsqc53b.tmp
%TEMP%\isprocessactive.txt
%TEMP%\nsie344.tmp
%TEMP%\nsof1eb.tmp
%TEMP%\nspf67f.tmp
%TEMP%\installationpixel.txt

Substitutes the following files

%TEMP%\ff.bat
%TEMP%\isprocessactive.txt

Network activity

TCP

HTTP GET requests

http://www.re###geplus.com/includes/install_start.php?tr#########################################################################################################################################...
http://www.re###geplus.com/events4mem.php?ve#####################################################################################################################################################...

UDP

DNS ASK re###geplus.com
DNS ASK google.com
DNS ASK cd####.reimage.com

Miscellaneous

Creates and executes the following

'%TEMP%\sqlite3.exe' "%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\cookies.sqlite" "select value, expiry from moz_cookies where baseDomain like 'reimageplus.com' and name='_trackid';"
'%TEMP%\sqlite3.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies" "select value, expires_utc from cookies where host_key like '%reimageplus.com' and name='_trackid';"
'%TEMP%\sqlite3.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies" "select name, expires_utc from cookies where host_key like '%reimageplus.com' and name like '_trackid_%';"
'%TEMP%\sqlite3.exe' "%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\cookies.sqlite" "select value, expiry from moz_cookies where baseDomain like 'reimageplus.com' and name='_tracking';"
'%TEMP%\sqlite3.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies" "select value, expires_utc from cookies where host_key like '%reimageplus.com' and name='_tracking';"
'%TEMP%\sqlite3.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies" "select name, expires_utc from cookies where host_key like '%reimageplus.com' and name like '_tracking_%';"
'%TEMP%\sqlite3.exe' "%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\cookies.sqlite" "select value, expiry from moz_cookies where baseDomain like 'reimageplus.com' and name='_campaign';"
'%TEMP%\sqlite3.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies" "select value, expires_utc from cookies where host_key like '%reimageplus.com' and name='_campaign';"
'%TEMP%\sqlite3.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies" "select name, expires_utc from cookies where host_key like '%reimageplus.com' and name like '_campaign_%';"
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\FF.bat" > %TEMP%\FF.txt"' (with hidden window)
'%TEMP%\sqlite3.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies" "select value, expires_utc from cookies where host_key like '%reimageplus.com' and name='_campaign';"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C tasklist /FI "IMAGENAME eq avupdate.exe" > %TEMP%\IsProcessActive.txt' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C tasklist /FI "IMAGENAME eq Reimage.exe" > %TEMP%\IsProcessActive.txt' (with hidden window)
'%WINDIR%\syswow64\ping.exe' -n 4 www.google.com' (with hidden window)
'%TEMP%\sqlite3.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies" "select name, expires_utc from cookies where host_key like '%reimageplus.com' and name like '_trackid_%';"' (with hidden window)
'%WINDIR%\syswow64\nslookup.exe' cdnrep.reimage.com' (with hidden window)
'%TEMP%\sqlite3.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies" "select value, expires_utc from cookies where host_key like '%reimageplus.com' and name='_tracking';"' (with hidden window)
'%TEMP%\sqlite3.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies" "select name, expires_utc from cookies where host_key like '%reimageplus.com' and name like '_campaign_%';"' (with hidden window)
'%TEMP%\sqlite3.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies" "select value, expires_utc from cookies where host_key like '%reimageplus.com' and name='_trackid';"' (with hidden window)
'%TEMP%\sqlite3.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies" "select name, expires_utc from cookies where host_key like '%reimageplus.com' and name like '_tracking_%';"' (with hidden window)
'%WINDIR%\syswow64\tasklist.exe' ' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\FF.bat" > %TEMP%\FF.txt"
'%WINDIR%\syswow64\cmd.exe' /C tasklist /FI "IMAGENAME eq Reimage.exe" > %TEMP%\IsProcessActive.txt
'%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq Reimage.exe"
'%WINDIR%\syswow64\cmd.exe' /C tasklist /FI "IMAGENAME eq avupdate.exe" > %TEMP%\IsProcessActive.txt
'%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq avupdate.exe"
'%WINDIR%\syswow64\ping.exe' -n 4 www.google.com
'%WINDIR%\syswow64\nslookup.exe' cdnrep.reimage.com
'%WINDIR%\syswow64\tasklist.exe'