Trojan.Siggen18.38958

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\yebao\shell\open\command] '' = '"%ProgramFiles(x86)%\YBPlatform\YeBao.exe" "%1"'

Malicious functions

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="yebao" dir=in program="%ProgramFiles(x86)%\YBPlatform\YeBao.exe" action=allow
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="yebao" dir=out program="%ProgramFiles(x86)%\YBPlatform\YeBao.exe" action=allow

Modifies file system

Creates the following files

%TEMP%\launcher.exe
%ProgramFiles(x86)%\ybplatform\netfilterinterface.dll
%ProgramFiles(x86)%\ybplatform\soui.dll
%ProgramFiles(x86)%\ybplatform\tcpproxy.dll
%ProgramFiles(x86)%\ybplatform\toolbox\steam_repair.exe
%ProgramFiles(x86)%\ybplatform\utilities.dll
%ProgramFiles(x86)%\ybplatform\wintun.dll
%ProgramFiles(x86)%\ybplatform\wintunsocks.exe
%ProgramFiles(x86)%\ybplatform\wintunsocksdll.dll
%ProgramFiles(x86)%\ybplatform\yblsp.dll
%ProgramFiles(x86)%\ybplatform\yblsp64.dll
%ProgramFiles(x86)%\ybplatform\yebao.exe
%ProgramFiles(x86)%\ybplatform\yebaocore.dll
%ProgramFiles(x86)%\ybplatform\yebaodebug.dll
%ProgramFiles(x86)%\ybplatform\yebaouninstall.exe
%ALLUSERSPROFILE%\yebao\temp\gamepic\9_default.png.tmp
%ProgramFiles(x86)%\ybplatform\yebaovpn.dll
%ProgramFiles(x86)%\ybplatform\config\client.json
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\fd239c196a8df63f6a371c4a4b714aab_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%ProgramFiles(x86)%\ybplatform\config\cache.json
%ProgramFiles(x86)%\ybplatform\log\yebao.log
%ProgramFiles(x86)%\ybplatform\log\cache
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\野豹游戏加速器\野豹游戏加速器.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\野豹游戏加速器\卸载.lnk
%ALLUSERSPROFILE%\yebao\temp\bannerpic\banner_23.png.tmp
%ALLUSERSPROFILE%\yebao\temp\gamepic\51_default.png.tmp
%ALLUSERSPROFILE%\yebao\temp\gamepic\363_default.png.tmp
%ALLUSERSPROFILE%\yebao\temp\gamepic\2241_default.png.tmp
%ALLUSERSPROFILE%\yebao\temp\gamepic\5_default.png.tmp
%ProgramFiles(x86)%\ybplatform\netfilter\nfwfp862.sys
%ProgramFiles(x86)%\ybplatform\yebaokernel.dll
%ProgramFiles(x86)%\ybplatform\netfilter\nfwfp86.sys
%ProgramFiles(x86)%\ybplatform\verinfo.json
%TEMP%\tmpclient.7z
%ProgramFiles(x86)%\ybplatform\ca.cer
%ProgramFiles(x86)%\ybplatform\client.p12
%ProgramFiles(x86)%\ybplatform\config\consoleconfig.txt
%ProgramFiles(x86)%\ybplatform\config\dialconfig.txt
%ProgramFiles(x86)%\ybplatform\config\filter.txt
%ProgramFiles(x86)%\ybplatform\config\httpproxy.txt
%ProgramFiles(x86)%\ybplatform\config\ipmask.json
%ProgramFiles(x86)%\ybplatform\config\remind.json
%ProgramFiles(x86)%\ybplatform\license\license_7z.txt
%ProgramFiles(x86)%\ybplatform\license\license_pcap.txt
%ProgramFiles(x86)%\ybplatform\license\license_soui.txt
%ProgramFiles(x86)%\ybplatform\license\license_wintun.txt
%ProgramFiles(x86)%\ybplatform\yebao.dat
%ProgramFiles(x86)%\ybplatform\netfilter\nfwfp64.sys
%ProgramFiles(x86)%\ybplatform\7zdecode.dll
%ProgramFiles(x86)%\ybplatform\bin\imgdecoder-gdip.dll
%ProgramFiles(x86)%\ybplatform\bin\render-skia.dll
%ProgramFiles(x86)%\ybplatform\checktoolservice.exe
%ProgramFiles(x86)%\ybplatform\console\openconsolenpfx32.sys
%ProgramFiles(x86)%\ybplatform\console\openconsolenpfx64.sys
%ProgramFiles(x86)%\ybplatform\crashsender1403.exe
%ProgramFiles(x86)%\ybplatform\httpproxy.exe
%ProgramFiles(x86)%\ybplatform\http_dll.dll
%ProgramFiles(x86)%\ybplatform\mount.exe
%ProgramFiles(x86)%\ybplatform\mount64.exe
%ProgramFiles(x86)%\ybplatform\netfilter\nftdi64.sys
%ProgramFiles(x86)%\ybplatform\netfilter\nftdi86.sys
%ProgramFiles(x86)%\ybplatform\netfilter\nfwfp642.sys
%TEMP%\ybuf1dd.tmp

Deletes the following files

%ProgramFiles(x86)%\ybplatform\config\ipm0029.old

Moves the following files

from %ALLUSERSPROFILE%\yebao\temp\bannerpic\banner_23.png.tmp to %ALLUSERSPROFILE%\yebao\temp\bannerpic\banner_23.png
from %ALLUSERSPROFILE%\yebao\temp\gamepic\51_default.png.tmp to %ALLUSERSPROFILE%\yebao\temp\gamepic\51_default.png
from %ALLUSERSPROFILE%\yebao\temp\gamepic\363_default.png.tmp to %ALLUSERSPROFILE%\yebao\temp\gamepic\363_default.png
from %ALLUSERSPROFILE%\yebao\temp\gamepic\2241_default.png.tmp to %ALLUSERSPROFILE%\yebao\temp\gamepic\2241_default.png
from %ALLUSERSPROFILE%\yebao\temp\gamepic\5_default.png.tmp to %ALLUSERSPROFILE%\yebao\temp\gamepic\5_default.png
from %ALLUSERSPROFILE%\yebao\temp\gamepic\9_default.png.tmp to %ALLUSERSPROFILE%\yebao\temp\gamepic\9_default.png
from %ProgramFiles(x86)%\ybplatform\config\ipmask.json to %ProgramFiles(x86)%\ybplatform\config\ipm0029.old

Substitutes the following files

%ProgramFiles(x86)%\ybplatform\config\ipmask.json

Network activity

Connects to

'localhost':49174
'localhost':49240
'localhost':49242
'localhost':49244
'localhost':49246
'localhost':49248
'localhost':49250
'localhost':49252
'localhost':49254
'localhost':49256
'localhost':49258
'localhost':49260
'ap######uct.yebaojiasu.com':443
'localhost':49202
'localhost':49268
'localhost':49273
'localhost':49275
'localhost':49277
'localhost':49279
'localhost':49283
'localhost':49285
'localhost':49288
'localhost':49290
'localhost':49292
'localhost':49294
'localhost':49298
'localhost':49300
'localhost':49236
'localhost':49238
'localhost':49234
'localhost':49232
'localhost':49230
'ap######n-js.yebaojiasu.com':443
'localhost':49179
'dl###.#ebaojiasu.com':443
'localhost':49182
'localhost':49184
'localhost':49186
'localhost':49188
'localhost':49190
'localhost':49192
'localhost':49194
'localhost':49196
'localhost':49198
'localhost':49303
'localhost':49270
'localhost':49200
'localhost':49206
'localhost':49208
'localhost':49210
'localhost':49212
'localhost':49214
'localhost':49216
'localhost':49218
'localhost':49220
'localhost':49222
'localhost':49224
'localhost':49226
'localhost':49228
'localhost':49176
'localhost':49204
'localhost':49305

TCP

Other

'localhost':49174
'localhost':49217
'localhost':49245
'localhost':49213
'localhost':49205
'localhost':49209
'localhost':49195
'localhost':49187
'localhost':49201
'localhost':49197
'localhost':49189
'localhost':49247
'localhost':49243
'localhost':49241
'localhost':49255
'localhost':49249
'localhost':49257
'localhost':49259
'localhost':49261
'localhost':49253
'localhost':49239
'localhost':49270
'localhost':49305
'localhost':49271
'localhost':49303
'localhost':49301
'localhost':49300
'localhost':49298
'localhost':49295
'localhost':49291
'localhost':49294
'localhost':49292
'localhost':49290
'localhost':49288
'localhost':49286
'localhost':49285
'localhost':49283
'localhost':49280
'localhost':49279
'localhost':49276
'localhost':49277
'localhost':49275
'localhost':49273
'localhost':49260
'localhost':49268
'localhost':49258
'localhost':49210
'localhost':49206
'localhost':49204
'localhost':49202
'localhost':49200
'localhost':49198
'localhost':49196
'localhost':49194
'localhost':49192
'localhost':49190
'localhost':49188
'localhost':49186
'localhost':49184
'localhost':49182
'dl###.#ebaojiasu.com':443
'localhost':49180
'localhost':49179
'ap######n-js.yebaojiasu.com':443
'localhost':49177
'localhost':49176
'localhost':49208
'localhost':49212
'localhost':49254
'localhost':49214
'localhost':49252
'localhost':49250
'localhost':49248
'localhost':49234
'localhost':49232
'localhost':49230
'localhost':49228
'localhost':49226
'localhost':49246
'localhost':49244
'localhost':49242
'localhost':49240
'localhost':49238
'localhost':49236
'localhost':49224
'localhost':49222
'localhost':49220
'localhost':49218
'localhost':49216
'localhost':49256
'localhost':49306

UDP

DNS ASK ap######n-js.yebaojiasu.com
DNS ASK dl###.#ebaojiasu.com
DNS ASK ne#####b.yebaojiasu.com
DNS ASK da#####i.yebaojiasu.com
DNS ASK ap######uct.yebaojiasu.com

Miscellaneous

Adds a root certificate

Creates and executes the following

'%TEMP%\launcher.exe' -launcher=<Current directory>\?-install=%ProgramFiles(x86)%\YBPlatform
'%ProgramFiles(x86)%\ybplatform\yebao.exe' -startby=launcher?-startkey=22
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="yebao" dir=in program="%ProgramFiles(x86)%\YBPlatform\YeBao.exe"' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="yebao" dir=out program="%ProgramFiles(x86)%\YBPlatform\YeBao.exe"' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="yebao" dir=in program="%ProgramFiles(x86)%\YBPlatform\YeBao.exe" action=allow' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="yebao" dir=out program="%ProgramFiles(x86)%\YBPlatform\YeBao.exe" action=allow' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C ipconfig /flushdns
'%WINDIR%\syswow64\cmd.exe' /C sc stop PandaSpeed64
'%WINDIR%\syswow64\sc.exe' stop PandaSpeed64
'%WINDIR%\syswow64\cmd.exe' /C sc stop netfilter2
'%WINDIR%\syswow64\sc.exe' stop netfilter2
'%WINDIR%\syswow64\cmd.exe' /C sc stop xfilter
'%WINDIR%\syswow64\sc.exe' stop xfilter
'%WINDIR%\syswow64\cmd.exe' /C sc stop xyovlfknl
'%WINDIR%\syswow64\sc.exe' stop xyovlfknl
'%WINDIR%\syswow64\cmd.exe' /C sc stop ylpacket
'%WINDIR%\syswow64\cmd.exe' /C sc stop vkedivppkvv
'%WINDIR%\syswow64\cmd.exe' /C sc stop akdriversys
'%WINDIR%\syswow64\sc.exe' stop akdriversys
'%WINDIR%\syswow64\cmd.exe' /C sc stop tgdriversys
'%WINDIR%\syswow64\sc.exe' stop tgdriversys
'%WINDIR%\syswow64\cmd.exe' /C sc stop sdknetfilter
'%WINDIR%\syswow64\sc.exe' stop sdknetfilter
'%WINDIR%\syswow64\cmd.exe' /C sc stop aaanfil
'%WINDIR%\syswow64\sc.exe' stop aaanfil
'%WINDIR%\syswow64\cmd.exe' /C sc stop uuwfp
'%WINDIR%\syswow64\sc.exe' stop uuwfp
'%WINDIR%\syswow64\sc.exe' stop uupacket
'%WINDIR%\syswow64\cmd.exe' /C sc stop uupacket
'%WINDIR%\syswow64\sc.exe' stop xunyoufilter
'%WINDIR%\syswow64\cmd.exe' /C sc stop baozi
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="yebao" dir=in program="%ProgramFiles(x86)%\YBPlatform\YeBao.exe"
'%WINDIR%\syswow64\cmd.exe' /C sc stop lgdcatcher
'%WINDIR%\syswow64\sc.exe' stop lgdcatcher
'%WINDIR%\syswow64\cmd.exe' /C sc stop lgdcatchertdi
'%WINDIR%\syswow64\sc.exe' stop baozi
'%WINDIR%\syswow64\sc.exe' stop lgdcatchertdi
'%WINDIR%\syswow64\cmd.exe' /C sc stop ylwfp
'%WINDIR%\syswow64\cmd.exe' /C sc stop crazybirdnf
'%WINDIR%\syswow64\sc.exe' stop vkedivppkvv
'%WINDIR%\syswow64\sc.exe' stop ylwfp
'%WINDIR%\syswow64\cmd.exe' /C sc stop netwfp
'%WINDIR%\syswow64\sc.exe' stop netwfp
'%WINDIR%\syswow64\cmd.exe' /C sc stop ProxyDrvA0
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="yebao" dir=out program="%ProgramFiles(x86)%\YBPlatform\YeBao.exe"
'%WINDIR%\syswow64\sc.exe' stop ProxyDrvA0
'%WINDIR%\syswow64\cmd.exe' /C sc stop vkdpi
'%WINDIR%\syswow64\sc.exe' stop vkdpi
'%WINDIR%\syswow64\cmd.exe' /C sc stop xunyoufilter
'%WINDIR%\syswow64\ipconfig.exe' /flushdns
'%WINDIR%\syswow64\sc.exe' stop ylpacket
'%WINDIR%\syswow64\sc.exe' stop crazybirdnf

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial