Exploit.Siggen2.2035

Technical Information

Malicious functions

Creates and executes the following

'' (downloaded from the Internet)

Creates and executes the following (exploit)

'%APPDATA%\vbc.exe'

Injects code into

the following system processes:

%WINDIR%\syswow64\cmd.exe

Terminates or attempts to terminate

the following system processes:

%WINDIR%\syswow64\cmd.exe

Searches for registry branches where third party applications store passwords

[<HKCU>\Software\LinasFTP\Site Manager]
[<HKCU>\Software\FlashPeak\BlazeFtp\Settings]
[<HKCU>\Software\Ghisler\Total Commander]
[<HKCU>\Software\Far\Plugins\FTP\Hosts]
[<HKCU>\Software\Far2\Plugins\FTP\Hosts]
[<HKCU>\Software\VanDyke\SecureFX]
[<HKLM>\Software\Wow6432Node\NCH Software\Fling\Accounts]
[<HKCU>\Software\NCH Software\Fling\Accounts]
[<HKLM>\Software\Wow6432Node\NCH Software\ClassicFTP\FTPAccounts]
[<HKCU>\Software\NCH Software\ClassicFTP\FTPAccounts]
[<HKCU>\Software\SimonTatham\PuTTY\Sessions]
[<HKLM>\Software\Wow6432Node\SimonTatham\PuTTY\Sessions]
[<HKCU>\Software\Martin Prikryl]
[<HKLM>\Software\Wow6432Node\Martin Prikryl]
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]

Reads files which store third party applications passwords

%APPDATA%\opera software\opera stable\login data
%APPDATA%\thunderbird\profiles.ini

Modifies file system

Creates the following files

%APPDATA%\vbc.exe
%APPDATA%\delete\legacy\rsupdatefield.xml
%APPDATA%\delete\legacy\x-thomson-sap-image.xml
%APPDATA%\delete\legacy\microsoftvisualstudiovcproject.dll
%APPDATA%\delete\legacy\edbgtl.dll
%APPDATA%\conference\terrace.xml
%TEMP%\asmx\administracion\issues\u2dmapi.dll
%TEMP%\symmetry
%APPDATA%\pipermail\custsat.dll
%TEMP%\tiffinhomochromy.dll
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%APPDATA%\e6f983\35a09b.hdb
%APPDATA%\local\pic\aaa\vswebdesignedui.dll
%APPDATA%\local\pic\aaa\org.freedesktop.geoclue2.manager.xml
%APPDATA%\local\pic\aaa\dbgclr.exe
%APPDATA%\local\pic\aaa\vnd.oasis.opendocument.image.xml
%APPDATA%\local\pic\aaa\freezepanes.xml
%APPDATA%\local\pic\aaa\soapsudscode.dll
%APPDATA%\local\pic\aaa\categorynames.xml
%APPDATA%\pipermail\rcxdti.dll
%APPDATA%\pipermail\dbgurtmui.dll
%APPDATA%\invitation\rd\quick\postscript.xml
%APPDATA%\pipermail\x-ustar.xml
%TEMP%\science\pixel\comment\org.gnome.evolution.shell.network-config.gschema.xml
%TEMP%\science\pixel\comment\microsoftvsavb.dll
%TEMP%\science\pixel\comment\aspnetstate.exe
%TEMP%\science\pixel\comment\privilege.xml
%TEMP%\science\pixel\comment\crtowordschs.dll
%TEMP%\nsf4dea.tmp
%APPDATA%\e6f983\35a09b.lck
%APPDATA%\e6f983\35a09b.exe