Trojan.PWS.Siggen3.38700

Technical Information

Malicious functions

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data

Modifies file system

Creates the following files

<Current directory>\.gitignore
<Current directory>\internal\utils\typeutil\typeutil_test.go
<Current directory>\internal\utils\typeutil\typeutil.go
<Current directory>\internal\utils\fileutil\filetutil.go
<Current directory>\internal\log\log.go
<Current directory>\internal\item\item.go
<Current directory>\internal\item\filename.go
<Current directory>\internal\decrypter\decrypter_windows.go
<Current directory>\internal\decrypter\decrypter_linux.go
<Current directory>\internal\decrypter\decrypter_darwin.go
<Current directory>\internal\decrypter\decrypter.go
<Current directory>\internal\browser\firefox\firefox.go
<Current directory>\internal\browser\chromium\chromium_windows.go
<Current directory>\internal\browser\chromium\chromium_linux.go
<Current directory>\internal\browser\chromium\chromium_darwin.go
<Current directory>\internal\browser\chromium\chromium.go
<Current directory>\internal\browser\browser_windows.go
<Current directory>\internal\browser\browser_linux.go
<Current directory>\internal\browser\browser_darwin.go
<Current directory>\internal\browser\browser.go
<Current directory>\internal\browingdata\password\password.go
<Current directory>\internal\browingdata\outputter_test.go
<Current directory>\internal\browingdata\localstorage\localstorage.go
<Current directory>\internal\browingdata\outputter.go
<Current directory>\toboot\hack-browser-data.exe
<Current directory>\cookie
<Current directory>\firefoxcookie-shm
<Current directory>\firefoxlocalstorage-shm
<Current directory>\firefoxdownload-shm
<Current directory>\firefoxhistory-shm
<Current directory>\firefoxbookmark-shm
<Current directory>\firefoxlocalstorage
<Current directory>\firefoxdownload
<Current directory>\firefoxhistory
<Current directory>\firefoxbookmark
<Current directory>\firefoxkey4
<Current directory>\firefoxcookie
<Current directory>\.git\refs\heads\master
<Current directory>\res\chrome_default_extension.json
<Current directory>\creditcard
<Current directory>\password
<Current directory>\download
<Current directory>\history
<Current directory>\extension\4_manifest.json
<Current directory>\extension\3_manifest.json
<Current directory>\extension\2_manifest.json
<Current directory>\extension\1_manifest.json
<Current directory>\extension\0_manifest.json
<Current directory>\internal\browingdata\history\history.go
<Current directory>\internal\browingdata\extension\extension.go
<Current directory>\internal\browingdata\download\download.go
<Current directory>\.git\hooks\pre-commit.sample
<Current directory>\.git\hooks\pre-applypatch.sample
<Current directory>\.git\hooks\post-update.sample
<Current directory>\.git\hooks\fsmonitor-watchman.sample
<Current directory>\.git\hooks\commit-msg.sample
<Current directory>\.git\hooks\applypatch-msg.sample
<Current directory>\.git\head
<Current directory>\.git\description
<Current directory>\.git\config
<Current directory>\readme_zh.md
<Current directory>\readme.md
<Current directory>\logo.svg
<Current directory>\license
<Current directory>\hidecmd.vbs
<Current directory>\hbdsend.ps1
<Current directory>\ha.bat
<Current directory>\go.sum
<Current directory>\go.mod
<Current directory>\contributors.svg
<Current directory>\chromiumkey
<Current directory>\.git\hooks\pre-push.sample
<Current directory>\.git\hooks\pre-rebase.sample
<Current directory>\.git\hooks\pre-merge-commit.sample
<Current directory>\.git\hooks\pre-receive.sample
<Current directory>\internal\browingdata\creditcard\creditcard.go
<Current directory>\.git\hooks\prepare-commit-msg.sample
<Current directory>\internal\browingdata\cookie\cookie.go
<Current directory>\internal\browingdata\browsingdata.go
<Current directory>\internal\browingdata\bookmark\bookmark.go
<Current directory>\cmd\hack-browser-data\main.go
<Current directory>\.github\workflows\release.yml
<Current directory>\.github\workflows\contributors.yml
<Current directory>\.github\workflows\ci.yml
<Current directory>\.github\release-drafter.yml
<Current directory>\.github\issue_template\bug_report.md
<Current directory>\firefoxextension
<Current directory>\res\firefox_apc2n9d1_default_release_bookmark.json
<Current directory>\.git\packed-refs
<Current directory>\.git\objects\pack\pack-b303ef571f536f71cf4045c046abd308476a500a.pack
<Current directory>\.git\objects\pack\pack-b303ef571f536f71cf4045c046abd308476a500a.idx
<Current directory>\.git\logs\refs\remotes\origin\head
<Current directory>\.git\logs\refs\heads\master
<Current directory>\.git\logs\head
<Current directory>\.git\info\exclude
<Current directory>\.git\index
<Current directory>\.git\hooks\update.sample
<Current directory>\.git\hooks\push-to-checkout.sample
<Current directory>\.git\refs\remotes\origin\head
<Current directory>\res\firefox_apc2n9d1_default_release_extension.json

Deletes the following files

<Current directory>\download
<Current directory>\firefoxcookie-shm
<Current directory>\firefoxlocalstorage
<Current directory>\firefoxlocalstorage-shm
<Current directory>\firefoxdownload
<Current directory>\firefoxdownload-shm
<Current directory>\firefoxhistory
<Current directory>\firefoxhistory-shm
<Current directory>\firefoxbookmark
<Current directory>\firefoxbookmark-shm
<Current directory>\firefoxextension
<Current directory>\history
<Current directory>\extension\4_manifest.json
<Current directory>\extension\3_manifest.json
<Current directory>\extension\2_manifest.json
<Current directory>\extension\1_manifest.json
<Current directory>\extension\0_manifest.json
<Current directory>\cookie
<Current directory>\creditcard
<Current directory>\password
<Current directory>\firefoxcookie
<Current directory>\res\chrome_default_extension.json

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'<SYSTEM32>\wscript.exe' "<Current directory>\hideCMD.vbs"
'<Current directory>\toboot\hack-browser-data.exe' -f json --dir res --zip

Executes the following

'<SYSTEM32>\cmd.exe' /c ""<Current directory>\ha.bat" "
'<SYSTEM32>\cmd.exe' /c "start "" .\toboot\hack-browser-data.exe -f json --dir res --zip"
'<SYSTEM32>\timeout.exe' /t 4
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Compress-Archive -Path ".\res" -DestinationPath .\res.zip -CompressionLevel Fastest -Force
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ep bypass -file "HBDSend.ps1"
'<SYSTEM32>\cmd.exe' /c ""<Current directory>\ha.bat" "' (with hidden window)