Trojan.Siggen32.4175

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\netsh.exe' advfirewall firewall set rule group="Network Discovery" new enable=Yes
'<SYSTEM32>\netsh.exe' advfirewall firewall set rule group="ÐÐÐÑÐâÐÂ§ÐÂ·ÐÑÐÐÐâ" new enable=Yes

Modifies file system

Creates the following files

%ProgramFiles%\easeusdatarecovery\dict
%ProgramFiles%\easeusdatarecovery\remote_config_data
%ProgramFiles%\easeusdatarecovery\start.cmd
%ProgramFiles%\easeusdatarecovery\filefilter.xml
%ProgramFiles%\easeusdatarecovery\resourcedark\imageresource.xml
%ProgramFiles%\easeusdatarecovery\config\prioritydisplaytype.xml
%ProgramFiles%\easeusdatarecovery\config\usefullostfiles.xml
%ProgramFiles%\easeusdatarecovery\style.css
%ProgramFiles%\easeusdatarecovery\config\config.ini
%ProgramFiles%\easeusdatarecovery\config\filterfolder.ini
%ProgramFiles%\easeusdatarecovery\config\nasconfig.ini
%ProgramFiles%\easeusdatarecovery\config\rawconfig.ini
%ProgramFiles%\easeusdatarecovery\config\shellexe.ini
%ProgramFiles%\easeusdatarecovery\config\themdark.ini
%ProgramFiles%\easeusdatarecovery\config\version.ini
%ProgramFiles%\easeusdatarecovery\google-services.json
%ProgramFiles%\easeusdatarecovery\language\english.qm
%ProgramFiles%\easeusdatarecovery\language\qtbase_en.qm
%ProgramFiles%\easeusdatarecovery\language\russian.qm
%ProgramFiles%\easeusdatarecovery\resourcedark\drw_dark.rcc
%ProgramFiles%\easeusdatarecovery\drw.exe
%ProgramFiles%\easeusdatarecovery\drwservice.exe
%ProgramFiles%\easeusdatarecovery\drwui.exe
%ProgramFiles%\easeusdatarecovery\euhwpviewer.exe
%ProgramFiles%\easeusdatarecovery\euimgrepair.exe
%ProgramFiles%\easeusdatarecovery\euinapp.exe
%ProgramFiles%\easeusdatarecovery\euofficerepairwin32.exe
%ProgramFiles%\easeusdatarecovery\euofficetools.exe
%ProgramFiles%\easeusdatarecovery\euofficeviewer.exe
%ProgramFiles%\easeusdatarecovery\eurawimg.exe
%ProgramFiles%\easeusdatarecovery\eurepairhost.exe
%ProgramFiles%\easeusdatarecovery\euunzip.exe
%ProgramFiles%\easeusdatarecovery\firebasefetch.exe
%ProgramFiles%\easeusdatarecovery\pdfviewer.exe
%ProgramFiles%\easeusdatarecovery\archive.dll
%ProgramFiles%\easeusdatarecovery\btrfssearchdll.dll
%ProgramFiles%\easeusdatarecovery\d3d11.dll
%ProgramFiles%\easeusdatarecovery\de265.dll
%ProgramFiles%\easeusdatarecovery\dxgi.dll
%ProgramFiles%\easeusdatarecovery\euhwpfilepathcheckermodule.dll
%ProgramFiles%\easeusdatarecovery\euimageenhance.dll
%ProgramFiles%\easeusdatarecovery\euvideorepair.dll
%ProgramFiles%\easeusdatarecovery\exfatsearchdll.dll
%ProgramFiles%\easeusdatarecovery\ext4searchdll.dll
%ProgramFiles%\easeusdatarecovery\fatsearchdll.dll
%ProgramFiles%\easeusdatarecovery\firebaseonlineconfig.dll
%ProgramFiles%\easeusdatarecovery\heif.dll
%ProgramFiles%\easeusdatarecovery\hfsplussearchdll.dll
%ProgramFiles%\easeusdatarecovery\japanese.dll
%ProgramFiles%\easeusdatarecovery\libcrypto-1_1-x64.dll
%ProgramFiles%\easeusdatarecovery\libeay32.dll
%ProgramFiles%\easeusdatarecovery\liblzma.dll
%ProgramFiles%\easeusdatarecovery\libzmq-mt-4_3_5.dll
%ProgramFiles%\easeusdatarecovery\msvcp140.dll
%ProgramFiles%\easeusdatarecovery\msvcr120.dll
%ProgramFiles%\easeusdatarecovery\ntfssearchdll.dll
%ProgramFiles%\easeusdatarecovery\pdfium.dll
%ProgramFiles%\easeusdatarecovery\pe_tools.dll
%ProgramFiles%\easeusdatarecovery\publog.dll
%ProgramFiles%\easeusdatarecovery\imageformats\qgif.dll
%ProgramFiles%\easeusdatarecovery\imageformats\qjpeg.dll
%ProgramFiles%\easeusdatarecovery\platforms\qminimal.dll
%ProgramFiles%\easeusdatarecovery\platforms\qoffscreen.dll
%ProgramFiles%\easeusdatarecovery\iconengines\qsvgicon.dll
%ProgramFiles%\easeusdatarecovery\qt5core.dll
%ProgramFiles%\easeusdatarecovery\qt5gui.dll
%ProgramFiles%\easeusdatarecovery\qt5network.dll
%ProgramFiles%\easeusdatarecovery\qt5svg.dll
%ProgramFiles%\easeusdatarecovery\qt5widgets.dll
%ProgramFiles%\easeusdatarecovery\qt5winextras.dll
%ProgramFiles%\easeusdatarecovery\platforms\qwindows.dll
%ProgramFiles%\easeusdatarecovery\rawsearchdll.dll
%ProgramFiles%\easeusdatarecovery\refssearchdll.dll
%ProgramFiles%\easeusdatarecovery\vcruntime140.dll
%ProgramFiles%\easeusdatarecovery\zlib.dll
%ProgramFiles%\easeusdatarecovery\config\config.ini.lock
%ProgramFiles%\easeusdatarecovery\config\config.ini.iskweb
%ProgramFiles%\easeusdatarecovery\config\config.ini.viqiea
%ProgramFiles%\easeusdatarecovery\drwui.log
%ProgramFiles%\easeusdatarecovery\eaolog.log
%TEMP%\{c3ada2f4-8958-41dd-bac8-8a2e050d344f}\remote_config_data
%ProgramFiles%\easeusdatarecovery\drwlog.log
%ProgramFiles%\easeusdatarecovery\recoverytrial.ini
%ProgramFiles%\easeusdatarecovery\defaultlog.txt
%ProgramFiles%\easeusdatarecovery\config\config.ini.jpabvd

Deletes following files that it created itself

%ProgramFiles%\easeusdatarecovery\config\config.ini.lock
%TEMP%\{c3ada2f4-8958-41dd-bac8-8a2e050d344f}\remote_config_data

Moves the following files

from %ProgramFiles%\easeusdatarecovery\config\config.ini.iskweb to %ProgramFiles%\easeusdatarecovery\config\config.ini
from %ProgramFiles%\easeusdatarecovery\config\config.ini.viqiea to %ProgramFiles%\easeusdatarecovery\config\config.ini
from %ProgramFiles%\easeusdatarecovery\config\config.ini.jpabvd to %ProgramFiles%\easeusdatarecovery\config\config.ini

Substitutes the following files

%ProgramFiles%\easeusdatarecovery\config\config.ini.lock

Network activity

Connects to

'mo#####.map.fastly.net':443
'localhost':49695
'fi########moteconfig.googleapis.com':443

TCP

Other

'localhost':49695
'localhost':49696
'fi########moteconfig.googleapis.com':443

UDP

DNS ASK mo#####.map.fastly.net
DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
DNS ASK fi########moteconfig.googleapis.com

Miscellaneous

Creates and executes the following

'%ProgramFiles%\easeusdatarecovery\drw.exe'
'%ProgramFiles%\easeusdatarecovery\drwui.exe'
'%ProgramFiles%\easeusdatarecovery\firebasefetch.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /c ""%ProgramFiles%\EaseUSDataRecovery\start.cmd" "
'<SYSTEM32>\fsutil.exe' behavior query disabledeletenotify
'<SYSTEM32>\cmd.exe' /c ""%ProgramFiles%\EaseUSDataRecovery\start.cmd" "' (with hidden window)
'%ProgramFiles%\easeusdatarecovery\firebasefetch.exe' ' (with hidden window)
'<SYSTEM32>\fsutil.exe' behavior query disabledeletenotify' (with hidden window)
'<SYSTEM32>\netsh.exe' advfirewall firewall set rule group="Network Discovery" new enable=Yes' (with hidden window)
'<SYSTEM32>\netsh.exe' advfirewall firewall set rule group="ÐÐÐÑÐâÐÂ§ÐÂ·ÐÑÐÐÐâ" new enable=Yes' (with hidden window)