Trojan.Siggen32.43236

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\applesoftwareupdateagent

Malicious functions

Patches code

in AMSI dll

000e9566.exe process, Amsi.dll module

Modifies file system

Creates the following files

%TEMP%\is-ir6rajwjmj.tmp\<File name>.tmp
%TEMP%\is-flvwlftnkm.tmp\_isetup\_setup64.tmp
%ALLUSERSPROFILE%\eclipsemeridian\is-s01otk9g1z.tmp
%ALLUSERSPROFILE%\eclipsemeridian\is-h8rwub5tmk.tmp
%ALLUSERSPROFILE%\eclipsemeridian\velocitykeystone\is-ik1ntwxoza.tmp
%ALLUSERSPROFILE%\eclipsemeridian\quantummeridian\is-hpkkusb8ju.tmp
%ALLUSERSPROFILE%\eclipsemeridian\dolphinspavilion\is-d11t3uhiql.tmp
%ALLUSERSPROFILE%\eclipsemeridian\velocitykeystone\is-hvqkmpeokf.tmp
%ALLUSERSPROFILE%\eclipsemeridian\quantummeridian\is-iebmjgjfeu.tmp
%ALLUSERSPROFILE%\eclipsemeridian\dolphinspavilion\is-3sxwtag8fd.tmp
%ALLUSERSPROFILE%\eclipsemeridian\velocitykeystone\is-wsojzc677i.tmp
%ALLUSERSPROFILE%\eclipsemeridian\quantummeridian\is-u2vzgb5mpa.tmp
%ALLUSERSPROFILE%\eclipsemeridian\dolphinspavilion\is-yjjnxa9dxh.tmp
%ALLUSERSPROFILE%\eclipsemeridian\velocitykeystone\is-hqww6k2qgv.tmp
%TEMP%\cfg912f.tmp
%ALLUSERSPROFILE%\eclipsemeridian\args.dat
%TEMP%\000e913f.xml
%ALLUSERSPROFILE%\eclipsemeridian\000e9566.exe
%APPDATA%\windcrryx\05-20-2026

Deletes following files that it created itself

%TEMP%\is-flvwlftnkm.tmp\_isetup\_setup64.tmp
%TEMP%\cfg912f.tmp
%TEMP%\is-ir6rajwjmj.tmp\<File name>.tmp
%TEMP%\000e913f.xml
%ALLUSERSPROFILE%\eclipsemeridian\000e9566.exe

Moves the following files

from %ALLUSERSPROFILE%\eclipsemeridian\is-s01otk9g1z.tmp to %ALLUSERSPROFILE%\eclipsemeridian\eclipsethunder.exe
from %ALLUSERSPROFILE%\eclipsemeridian\is-h8rwub5tmk.tmp to %ALLUSERSPROFILE%\eclipsemeridian\thunderaccuracy.exe
from %ALLUSERSPROFILE%\eclipsemeridian\velocitykeystone\is-ik1ntwxoza.tmp to %ALLUSERSPROFILE%\eclipsemeridian\velocitykeystone\windmillkeystone.wav
from %ALLUSERSPROFILE%\eclipsemeridian\quantummeridian\is-hpkkusb8ju.tmp to %ALLUSERSPROFILE%\eclipsemeridian\quantummeridian\accuracyeclipse.wav
from %ALLUSERSPROFILE%\eclipsemeridian\dolphinspavilion\is-d11t3uhiql.tmp to %ALLUSERSPROFILE%\eclipsemeridian\dolphinspavilion\octagonwindmill.wav
from %ALLUSERSPROFILE%\eclipsemeridian\velocitykeystone\is-hvqkmpeokf.tmp to %ALLUSERSPROFILE%\eclipsemeridian\velocitykeystone\pavilionmeridian.wav
from %ALLUSERSPROFILE%\eclipsemeridian\quantummeridian\is-iebmjgjfeu.tmp to %ALLUSERSPROFILE%\eclipsemeridian\quantummeridian\jasminebridges.wav
from %ALLUSERSPROFILE%\eclipsemeridian\dolphinspavilion\is-3sxwtag8fd.tmp to %ALLUSERSPROFILE%\eclipsemeridian\dolphinspavilion\unicornmeridian.wav
from %ALLUSERSPROFILE%\eclipsemeridian\velocitykeystone\is-wsojzc677i.tmp to %ALLUSERSPROFILE%\eclipsemeridian\velocitykeystone\meridianjasmine.wav
from %ALLUSERSPROFILE%\eclipsemeridian\quantummeridian\is-u2vzgb5mpa.tmp to %ALLUSERSPROFILE%\eclipsemeridian\quantummeridian\granitesentinel.wav
from %ALLUSERSPROFILE%\eclipsemeridian\dolphinspavilion\is-yjjnxa9dxh.tmp to %ALLUSERSPROFILE%\eclipsemeridian\dolphinspavilion\eclipseoctagon.wav
from %ALLUSERSPROFILE%\eclipsemeridian\velocitykeystone\is-hqww6k2qgv.tmp to %ALLUSERSPROFILE%\eclipsemeridian\velocitykeystone\zenithoctagon.wav

Network activity

Connects to

'ip##pi.com':80
'45.##.136.188':2202

TCP

HTTP GET requests

http://ip##pi.com/json/

Other

'45.##.136.188':2202

UDP

DNS ASK ip##pi.com

Miscellaneous

Creates and executes the following

'%TEMP%\is-ir6rajwjmj.tmp\<File name>.tmp' /SL5="$C02EC,2396787,893952,<Full path to file>"
'%ALLUSERSPROFILE%\eclipsemeridian\eclipsethunder.exe' "%ALLUSERSPROFILE%\EclipseMeridian\ThunderAccuracy.exe" "%ALLUSERSPROFILE%\EclipseMeridian\VelocityKeystone\WindmillKeystone.wav" "%ALLUSERSPROFILE%\EclipseMeridian\QuantumMeridian\AccuracyEcli...
'%ALLUSERSPROFILE%\eclipsemeridian\thunderaccuracy.exe' "%ALLUSERSPROFILE%\EclipseMeridian\VelocityKeystone\WindmillKeystone.wav" "%ALLUSERSPROFILE%\EclipseMeridian\QuantumMeridian\AccuracyEclipse.wav" "%ALLUSERSPROFILE%\EclipseMeridian\DolphinsPavi...
'%ALLUSERSPROFILE%\eclipsemeridian\000e9566.exe'

Executes the following

'<SYSTEM32>\schtasks.exe' /create /tn "AppleSoftwareUpdateAgent" /xml "%TEMP%\000E913F.xml" /f
'%ALLUSERSPROFILE%\eclipsemeridian\eclipsethunder.exe' "%ALLUSERSPROFILE%\EclipseMeridian\ThunderAccuracy.exe" "%ALLUSERSPROFILE%\EclipseMeridian\VelocityKeystone\WindmillKeystone.wav" "%ALLUSERSPROFILE%\EclipseMeridian\QuantumMeridian\AccuracyEcli...' (with hidden window)
'<SYSTEM32>\schtasks.exe' /create /tn "AppleSoftwareUpdateAgent" /xml "%TEMP%\000E913F.xml" /f' (with hidden window)