Trojan.Siggen14.48802

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Classes\spotify\shell\open\command] '' = '"%APPDATA%\Spotify\Spotify.exe" --protocol-uri="%1"'

Malicious functions

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Spotify" program="%APPDATA%\Spotify\Spotify.exe" dir=in enable=yes profile=any action=allow
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Spotify" program="%APPDATA%\Spotify\Spotify.exe" dir=out enable=yes profile=any action=allow

Modifies file system

Creates the following files

%TEMP%\rarsfx0\silent.cmd
%APPDATA%\spotify\locales\is-0epo0.tmp
%APPDATA%\spotify\locales\is-kfqao.tmp
%APPDATA%\spotify\locales\is-i1aui.tmp
%APPDATA%\spotify\locales\is-f7rfv.tmp
%APPDATA%\spotify\locales\is-r4hon.tmp
%APPDATA%\spotify\locales\is-gvs8a.tmp
%APPDATA%\spotify\locales\is-44m92.tmp
%APPDATA%\spotify\locales\is-nd7k9.tmp
%APPDATA%\spotify\locales\is-1dksi.tmp
%APPDATA%\spotify\locales\is-2ou9m.tmp
%APPDATA%\spotify\locales\is-apj4b.tmp
%APPDATA%\spotify\locales\is-kv15h.tmp
%APPDATA%\spotify\locales\is-1rkvq.tmp
%APPDATA%\spotify\locales\is-et2e4.tmp
%APPDATA%\spotify\locales\is-gn6mk.tmp
%APPDATA%\spotify\locales\is-k0150.tmp
%APPDATA%\spotify\locales\is-bdf2n.tmp
%APPDATA%\spotify\locales\is-r6j8t.tmp
%APPDATA%\spotify\locales\is-ubua6.tmp
%APPDATA%\spotify\locales\is-rq27t.tmp
%APPDATA%\spotify\locales\is-lfd9g.tmp
%APPDATA%\spotify\locales\is-aku18.tmp
%APPDATA%\spotify\locales\is-s01d8.tmp
%APPDATA%\spotify\locales\is-dbang.tmp
%APPDATA%\spotify\locales\is-v48sd.tmp
%APPDATA%\spotify\locales\is-uecie.tmp
%APPDATA%\spotify\locales\is-e93i3.tmp
%APPDATA%\spotify\locales\is-e7c7n.tmp
%APPDATA%\spotify\locales\is-0gmh3.tmp
%APPDATA%\spotify\locales\is-1irbc.tmp
%APPDATA%\spotify\locales\is-be22i.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\spotify\uninstall.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\spotify\spotify.lnk
%APPDATA%\spotify\is-h3eds.tmp
%APPDATA%\spotify\apps\is-a3he4.tmp
%APPDATA%\spotify\is-0b05e.tmp
%APPDATA%\spotify\is-92fri.tmp
%LOCALAPPDATA%\spotify\is-9bavk.tmp
%APPDATA%\spotify\locales\is-qk9bs.tmp
%APPDATA%\spotify\locales\is-v6rpj.tmp
%APPDATA%\spotify\locales\is-i46o6.tmp
%APPDATA%\spotify\locales\is-ku4uo.tmp
%APPDATA%\spotify\locales\is-7ct2n.tmp
%APPDATA%\spotify\locales\is-do02o.tmp
%APPDATA%\spotify\locales\is-4tobg.tmp
%APPDATA%\spotify\locales\is-60prh.tmp
%APPDATA%\spotify\locales\is-p8a5s.tmp
%APPDATA%\spotify\locales\is-t6hb6.tmp
%APPDATA%\spotify\locales\is-4853a.tmp
%APPDATA%\spotify\locales\is-4kua6.tmp
%APPDATA%\spotify\locales\is-3c0sj.tmp
%APPDATA%\spotify\locales\is-aru14.tmp
%APPDATA%\spotify\locales\is-74jg9.tmp
%APPDATA%\spotify\locales\is-cof2v.tmp
%APPDATA%\spotify\locales\is-l1u25.tmp
%APPDATA%\spotify\locales\is-6egmr.tmp
%APPDATA%\spotify\locales\is-cljd7.tmp
%APPDATA%\spotify\locales\is-i1425.tmp
%APPDATA%\spotify\locales\is-an55p.tmp
%APPDATA%\spotify\locales\is-a6vbn.tmp
%APPDATA%\spotify\locales\is-9umev.tmp
%APPDATA%\spotify\locales\is-it15r.tmp
%APPDATA%\spotify\apps\is-irbqr.tmp
%APPDATA%\spotify\apps\is-lenuj.tmp
%APPDATA%\spotify\is-ojpj6.tmp
%APPDATA%\spotify\is-ett9b.tmp
%APPDATA%\spotify\is-rgirk.tmp
%APPDATA%\spotify\is-sc93b.tmp
%APPDATA%\spotify\is-keusn.tmp
%APPDATA%\spotify\is-m5n1f.tmp
%APPDATA%\spotify\is-834k8.tmp
%APPDATA%\spotify\is-6bdss.tmp
%APPDATA%\spotify\is-js578.tmp
%APPDATA%\spotify\is-1p4sv.tmp
%APPDATA%\spotify\is-vat3v.tmp
%APPDATA%\spotify\is-qqthd.tmp
%APPDATA%\spotify\is-psfju.tmp
%APPDATA%\spotify\is-4t5s3.tmp
%APPDATA%\spotify\is-lt0tv.tmp
%TEMP%\is-81nb7.tmp\wizardform.bitmapimage1.bmp
%TEMP%\is-81nb7.tmp\metroblue.vsf
%TEMP%\is-81nb7.tmp\vclstylesinno.dll
%TEMP%\is-81nb7.tmp\istask.dll
%TEMP%\is-81nb7.tmp\_isetup\_shfoldr.dll
%TEMP%\is-81nb7.tmp\_isetup\_setup64.tmp
%TEMP%\is-81nb7.tmp\_isetup\_regdll.tmp
%TEMP%\is-ejukp.tmp\spotify 1.1.61.583.tmp
%TEMP%\rarsfx0\spotify 1.1.61.583.exe
%APPDATA%\spotify\locales\is-nd9tb.tmp
%APPDATA%\spotify\locales\is-oapcb.tmp
%APPDATA%\spotify\apps\is-r33oc.tmp
%APPDATA%\spotify\locales\is-8h26k.tmp
%APPDATA%\spotify\locales\is-unkrm.tmp
%APPDATA%\spotify\locales\is-i5vma.tmp
%APPDATA%\spotify\locales\is-hs7ga.tmp
%APPDATA%\spotify\locales\is-2vru2.tmp
%APPDATA%\spotify\locales\is-2dfr2.tmp
%APPDATA%\spotify\locales\is-qrlch.tmp
%APPDATA%\spotify\locales\is-fm0nf.tmp
%APPDATA%\spotify\locales\is-3pntn.tmp
%APPDATA%\spotify\locales\is-mara0.tmp
%APPDATA%\spotify\locales\is-senig.tmp
%APPDATA%\spotify\locales\is-8sbcf.tmp
%APPDATA%\spotify\locales\is-0v2g3.tmp
%APPDATA%\spotify\locales\is-17pvs.tmp
%APPDATA%\spotify\locales\is-06u9s.tmp
%APPDATA%\spotify\locales\is-ig190.tmp
%APPDATA%\spotify\prefs
%APPDATA%\spotify\locales\is-ec9tv.tmp
%APPDATA%\spotify\locales\is-r47it.tmp
%APPDATA%\spotify\locales\is-o59gu.tmp
%APPDATA%\spotify\users\21859k671roh071qn2i91kw70-user\is-vnka6.tmp
%APPDATA%\spotify\users\21859k671roh071qn2i91kw70-user\is-ktqpg.tmp
%APPDATA%\spotify\users\21859k671roh071qn2i91kw70-user\is-aoehq.tmp
%APPDATA%\spotify\users\21859k671roh071qn2i91kw70-user\is-h2uqu.tmp
%APPDATA%\spotify\users\21859k671roh071qn2i91kw70-user\is-geiad.tmp
%APPDATA%\spotify\users\21859k671roh071qn2i91kw70-user\is-jknro.tmp
%APPDATA%\spotify\swiftshader\is-0odes.tmp
%APPDATA%\spotify\swiftshader\is-j1t7o.tmp
%APPDATA%\spotify\locales\is-2ugec.tmp
%APPDATA%\spotify\locales\is-vei1u.tmp
%APPDATA%\spotify\locales\is-vi6eh.tmp
%APPDATA%\spotify\unins000.dat

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\spotify\update

Deletes the following files

%TEMP%\is-81nb7.tmp\istask.dll
%TEMP%\is-81nb7.tmp\metroblue.vsf
%TEMP%\is-81nb7.tmp\vclstylesinno.dll
%TEMP%\is-81nb7.tmp\wizardform.bitmapimage1.bmp
%TEMP%\is-81nb7.tmp\_isetup\_regdll.tmp
%TEMP%\is-81nb7.tmp\_isetup\_setup64.tmp
%TEMP%\is-81nb7.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ejukp.tmp\spotify 1.1.61.583.tmp
%TEMP%\rarsfx0\silent.cmd
%TEMP%\rarsfx0\spotify 1.1.61.583.exe

Moves the following files

from %APPDATA%\spotify\is-lt0tv.tmp to %APPDATA%\spotify\unins000.exe
from %APPDATA%\spotify\locales\is-i1aui.tmp to %APPDATA%\spotify\locales\nb.pak
from %APPDATA%\spotify\locales\is-f7rfv.tmp to %APPDATA%\spotify\locales\ms.pak
from %APPDATA%\spotify\locales\is-r4hon.tmp to %APPDATA%\spotify\locales\ms.mo
from %APPDATA%\spotify\locales\is-gvs8a.tmp to %APPDATA%\spotify\locales\mr.pak
from %APPDATA%\spotify\locales\is-44m92.tmp to %APPDATA%\spotify\locales\ml.pak
from %APPDATA%\spotify\locales\is-nd7k9.tmp to %APPDATA%\spotify\locales\lv.pak
from %APPDATA%\spotify\locales\is-1dksi.tmp to %APPDATA%\spotify\locales\lt.pak
from %APPDATA%\spotify\locales\is-2ou9m.tmp to %APPDATA%\spotify\locales\ko.pak
from %APPDATA%\spotify\locales\is-apj4b.tmp to %APPDATA%\spotify\locales\ko.mo
from %APPDATA%\spotify\locales\is-kv15h.tmp to %APPDATA%\spotify\locales\kn.pak
from %APPDATA%\spotify\locales\is-1rkvq.tmp to %APPDATA%\spotify\locales\ja.pak
from %APPDATA%\spotify\locales\is-gn6mk.tmp to %APPDATA%\spotify\locales\it.pak
from %APPDATA%\spotify\locales\is-0epo0.tmp to %APPDATA%\spotify\locales\nl.pak
from %APPDATA%\spotify\locales\is-k0150.tmp to %APPDATA%\spotify\locales\it.mo
from %APPDATA%\spotify\locales\is-bdf2n.tmp to %APPDATA%\spotify\locales\id.pak
from %APPDATA%\spotify\locales\is-r6j8t.tmp to %APPDATA%\spotify\locales\id.mo
from %APPDATA%\spotify\locales\is-ubua6.tmp to %APPDATA%\spotify\locales\hu.pak
from %APPDATA%\spotify\locales\is-rq27t.tmp to %APPDATA%\spotify\locales\hu.mo
from %APPDATA%\spotify\locales\is-lfd9g.tmp to %APPDATA%\spotify\locales\hr.pak
from %APPDATA%\spotify\locales\is-aku18.tmp to %APPDATA%\spotify\locales\hi.pak
from %APPDATA%\spotify\locales\is-s01d8.tmp to %APPDATA%\spotify\locales\he.pak
from %APPDATA%\spotify\locales\is-dbang.tmp to %APPDATA%\spotify\locales\he.mo
from %APPDATA%\spotify\locales\is-v48sd.tmp to %APPDATA%\spotify\locales\gu.pak
from %APPDATA%\spotify\locales\is-et2e4.tmp to %APPDATA%\spotify\locales\ja.mo
from %APPDATA%\spotify\locales\is-8sbcf.tmp to %APPDATA%\spotify\locales\da.pak
from %APPDATA%\spotify\locales\is-1irbc.tmp to %APPDATA%\spotify\locales\pl.mo
from %APPDATA%\spotify\is-0b05e.tmp to %APPDATA%\spotify\config.ini
from %APPDATA%\spotify\is-92fri.tmp to %APPDATA%\spotify\chrome_elf.dll
from %LOCALAPPDATA%\spotify\is-9bavk.tmp to %LOCALAPPDATA%\spotify\update
from %APPDATA%\spotify\locales\is-qk9bs.tmp to %APPDATA%\spotify\locales\zh-tw.pak
from %APPDATA%\spotify\locales\is-v6rpj.tmp to %APPDATA%\spotify\locales\zh-hant.mo
from %APPDATA%\spotify\locales\is-i46o6.tmp to %APPDATA%\spotify\locales\zh-cn.pak
from %APPDATA%\spotify\locales\is-ku4uo.tmp to %APPDATA%\spotify\locales\vi.pak
from %APPDATA%\spotify\locales\is-7ct2n.tmp to %APPDATA%\spotify\locales\vi.mo
from %APPDATA%\spotify\locales\is-do02o.tmp to %APPDATA%\spotify\locales\tr.pak
from %APPDATA%\spotify\locales\is-ig190.tmp to %APPDATA%\spotify\locales\tr.mo
from %APPDATA%\spotify\locales\is-4tobg.tmp to %APPDATA%\spotify\locales\th.pak
from %APPDATA%\spotify\locales\is-uecie.tmp to %APPDATA%\spotify\locales\fr.pak
from %APPDATA%\spotify\locales\is-kfqao.tmp to %APPDATA%\spotify\locales\nl.mo
from %APPDATA%\spotify\locales\is-4853a.tmp to %APPDATA%\spotify\locales\ta.pak
from %APPDATA%\spotify\locales\is-4kua6.tmp to %APPDATA%\spotify\locales\sw.pak
from %APPDATA%\spotify\locales\is-3c0sj.tmp to %APPDATA%\spotify\locales\sv.pak
from %APPDATA%\spotify\locales\is-aru14.tmp to %APPDATA%\spotify\locales\sv.mo
from %APPDATA%\spotify\locales\is-74jg9.tmp to %APPDATA%\spotify\locales\sr.pak
from %APPDATA%\spotify\locales\is-cof2v.tmp to %APPDATA%\spotify\locales\sl.pak
from %APPDATA%\spotify\locales\is-l1u25.tmp to %APPDATA%\spotify\locales\sk.pak
from %APPDATA%\spotify\locales\is-6egmr.tmp to %APPDATA%\spotify\locales\ro.pak
from %APPDATA%\spotify\locales\is-cljd7.tmp to %APPDATA%\spotify\locales\pt-pt.pak
from %APPDATA%\spotify\locales\is-i1425.tmp to %APPDATA%\spotify\locales\pt-br.pak
from %APPDATA%\spotify\locales\is-an55p.tmp to %APPDATA%\spotify\locales\pt-br.mo
from %APPDATA%\spotify\locales\is-t6hb6.tmp to %APPDATA%\spotify\locales\te.pak
from %APPDATA%\spotify\locales\is-be22i.tmp to %APPDATA%\spotify\locales\pl.pak
from %APPDATA%\spotify\locales\is-e93i3.tmp to %APPDATA%\spotify\locales\fr.mo
from %APPDATA%\spotify\locales\is-0gmh3.tmp to %APPDATA%\spotify\locales\fr-ca.mo
from %APPDATA%\spotify\locales\is-e7c7n.tmp to %APPDATA%\spotify\locales\fil.pak
from %APPDATA%\spotify\is-rgirk.tmp to %APPDATA%\spotify\spotifymigrator.exe
from %APPDATA%\spotify\locales\is-2ugec.tmp to %APPDATA%\spotify\locales\uk.pak
from %APPDATA%\spotify\locales\is-vei1u.tmp to %APPDATA%\spotify\locales\ru.pak
from %APPDATA%\spotify\locales\is-i5vma.tmp to %APPDATA%\spotify\locales\ru.mo
from %APPDATA%\spotify\locales\is-8h26k.tmp to %APPDATA%\spotify\locales\en.mo
from %APPDATA%\spotify\locales\is-oapcb.tmp to %APPDATA%\spotify\locales\en-us.pak
from %APPDATA%\spotify\locales\is-nd9tb.tmp to %APPDATA%\spotify\locales\en-gb.pak
from %APPDATA%\spotify\apps\is-r33oc.tmp to %APPDATA%\spotify\apps\settings.spa
from %APPDATA%\spotify\apps\is-irbqr.tmp to %APPDATA%\spotify\apps\login.spa
from %APPDATA%\spotify\apps\is-lenuj.tmp to %APPDATA%\spotify\apps\glue-resources.spa
from %APPDATA%\spotify\is-ojpj6.tmp to %APPDATA%\spotify\v8_context_snapshot.bin
from %APPDATA%\spotify\apps\is-a3he4.tmp to %APPDATA%\spotify\apps\xpui.spa
from %APPDATA%\spotify\swiftshader\is-0odes.tmp to %APPDATA%\spotify\swiftshader\libglesv2.dll
from %APPDATA%\spotify\is-sc93b.tmp to %APPDATA%\spotify\spotify.exe
from %APPDATA%\spotify\is-keusn.tmp to %APPDATA%\spotify\snapshot_blob.bin
from %APPDATA%\spotify\is-m5n1f.tmp to %APPDATA%\spotify\resources.pak
from %APPDATA%\spotify\is-834k8.tmp to %APPDATA%\spotify\libglesv2.dll
from %APPDATA%\spotify\is-6bdss.tmp to %APPDATA%\spotify\libegl.dll
from %APPDATA%\spotify\is-js578.tmp to %APPDATA%\spotify\libcef.dll
from %APPDATA%\spotify\is-1p4sv.tmp to %APPDATA%\spotify\icudtl.dat
from %APPDATA%\spotify\is-vat3v.tmp to %APPDATA%\spotify\d3dcompiler_47.dll
from %APPDATA%\spotify\is-qqthd.tmp to %APPDATA%\spotify\crash_reporter.cfg
from %APPDATA%\spotify\is-psfju.tmp to %APPDATA%\spotify\chrome_200_percent.pak
from %APPDATA%\spotify\is-4t5s3.tmp to %APPDATA%\spotify\chrome_100_percent.pak
from %APPDATA%\spotify\is-ett9b.tmp to %APPDATA%\spotify\spotifystartuptask.exe
from %APPDATA%\spotify\locales\is-p8a5s.tmp to %APPDATA%\spotify\locales\th.mo
from %APPDATA%\spotify\users\21859k671roh071qn2i91kw70-user\is-jknro.tmp to %APPDATA%\spotify\users\21859k671roh071qn2i91kw70-user\ad-state-storage.bnk
from %APPDATA%\spotify\users\21859k671roh071qn2i91kw70-user\is-aoehq.tmp to %APPDATA%\spotify\users\21859k671roh071qn2i91kw70-user\local_sync_state
from %APPDATA%\spotify\users\21859k671roh071qn2i91kw70-user\is-geiad.tmp to %APPDATA%\spotify\users\21859k671roh071qn2i91kw70-user\frecency.pb
from %APPDATA%\spotify\locales\is-a6vbn.tmp to %APPDATA%\spotify\locales\fi.pak
from %APPDATA%\spotify\locales\is-9umev.tmp to %APPDATA%\spotify\locales\fi.mo
from %APPDATA%\spotify\locales\is-it15r.tmp to %APPDATA%\spotify\locales\fa.pak
from %APPDATA%\spotify\locales\is-unkrm.tmp to %APPDATA%\spotify\locales\et.pak
from %APPDATA%\spotify\locales\is-hs7ga.tmp to %APPDATA%\spotify\locales\es.pak
from %APPDATA%\spotify\locales\is-2vru2.tmp to %APPDATA%\spotify\locales\es.mo
from %APPDATA%\spotify\locales\is-2dfr2.tmp to %APPDATA%\spotify\locales\es-419.pak
from %APPDATA%\spotify\locales\is-qrlch.tmp to %APPDATA%\spotify\locales\es-419.mo
from %APPDATA%\spotify\locales\is-fm0nf.tmp to %APPDATA%\spotify\locales\el.pak
from %APPDATA%\spotify\locales\is-3pntn.tmp to %APPDATA%\spotify\locales\el.mo
from %APPDATA%\spotify\users\21859k671roh071qn2i91kw70-user\is-h2uqu.tmp to %APPDATA%\spotify\users\21859k671roh071qn2i91kw70-user\local-files.bnk
from %APPDATA%\spotify\locales\is-mara0.tmp to %APPDATA%\spotify\locales\de.pak
from %APPDATA%\spotify\swiftshader\is-j1t7o.tmp to %APPDATA%\spotify\swiftshader\libegl.dll
from %APPDATA%\spotify\locales\is-0v2g3.tmp to %APPDATA%\spotify\locales\cs.pak
from %APPDATA%\spotify\locales\is-17pvs.tmp to %APPDATA%\spotify\locales\cs.mo
from %APPDATA%\spotify\locales\is-06u9s.tmp to %APPDATA%\spotify\locales\ca.pak
from %APPDATA%\spotify\locales\is-vi6eh.tmp to %APPDATA%\spotify\locales\bn.pak
from %APPDATA%\spotify\locales\is-60prh.tmp to %APPDATA%\spotify\locales\bg.pak
from %APPDATA%\spotify\locales\is-ec9tv.tmp to %APPDATA%\spotify\locales\ar.pak
from %APPDATA%\spotify\locales\is-r47it.tmp to %APPDATA%\spotify\locales\ar.mo
from %APPDATA%\spotify\locales\is-o59gu.tmp to %APPDATA%\spotify\locales\am.pak
from %APPDATA%\spotify\users\21859k671roh071qn2i91kw70-user\is-vnka6.tmp to %APPDATA%\spotify\users\21859k671roh071qn2i91kw70-user\watch-sources.bnk
from %APPDATA%\spotify\users\21859k671roh071qn2i91kw70-user\is-ktqpg.tmp to %APPDATA%\spotify\users\21859k671roh071qn2i91kw70-user\prefs
from %APPDATA%\spotify\locales\is-senig.tmp to %APPDATA%\spotify\locales\de.mo
from %APPDATA%\spotify\is-h3eds.tmp to %APPDATA%\spotify\prefs

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''

Creates and executes the following

'%TEMP%\rarsfx0\spotify 1.1.61.583.exe' /SILENT
'%TEMP%\is-ejukp.tmp\spotify 1.1.61.583.tmp' /SL5="$10246,84538169,64512,%TEMP%\RarSFX0\Spotify 1.1.61.583.exe" /SILENT
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="Spotify"' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Spotify" program="%APPDATA%\Spotify\Spotify.exe" dir=in enable=yes profile=any action=allow' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Spotify" program="%APPDATA%\Spotify\Spotify.exe" dir=out enable=yes profile=any action=allow' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\Silent.cmd" "
'%WINDIR%\syswow64\regedit.exe' /S "%TEMP%\RarSFX0\settings.reg"
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="Spotify"

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial