Trojan.Hosts.33237

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}' = ''

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\SASDIFSV] 'Start' = '00000001'
[<HKLM>\SYSTEM\ControlSet001\Services\SASDIFSV] 'ImagePath' = '%PROGRAM_FILES%\SUPERAntiSpyware\SASDIFSV.SYS'
[<HKLM>\SYSTEM\ControlSet001\Services\SASKUTIL] 'ImagePath' = '%PROGRAM_FILES%\SUPERAntiSpyware\SASKUTIL.SYS'
[<HKLM>\SYSTEM\ControlSet001\Services\!SASCORE] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\SASKUTIL] 'Start' = '00000001'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\SUPERAntiSpyware\SASCore.exe'
'%PROGRAM_FILES%\SUPERAntiSpyware\SUPERAntiSpyware.exe'
'%ALLUSERSPROFILE%\Application Data\Setup.exe' /silent
'%PROGRAM_FILES%\SUPERAntiSpyware\SASCore.exe' -install -name:!SASCORE -display:"SAS Core Service" -description:"SUPERAntiSpyware Core Service" -pipe:sascoreservicepipe

Запускает на исполнение:

'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\SUPERAntiSpyware\SASSEH.DLL"
'<SYSTEM32>\wbem\wmiadap.exe' /R /T
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\SUPERAntiSpyware\SASWINLO.DLL
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\SUPERAntiSpyware\SASCTXMN.DLL"

Изменения в файловой системе:

Создает следующие файлы:

%ALLUSERSPROFILE%\Start Menu\Programs\SUPERAntiSpyware\SUPERAntiSpyware Professional.lnk
%PROGRAM_FILES%\SUPERAntiSpyware\High Contrast Black.set
%PROGRAM_FILES%\SUPERAntiSpyware\SAS Default.set
%ALLUSERSPROFILE%\Start Menu\Programs\SUPERAntiSpyware\BootSafe.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\SUPERAntiSpyware\SUPERAntiSpyware Alternate Start.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\SUPERAntiSpyware\SUPERAntiSpyware Registration-Activation.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\SUPERAntiSpyware\SUPERAntiSpyware Help.lnk
%PROGRAM_FILES%\SUPERAntiSpyware\SAS_Preconfig.db3
%PROGRAM_FILES%\SUPERAntiSpyware\Uninstall.exe
%PROGRAM_FILES%\SUPERAntiSpyware\SUPERAntiSpyware.exe
%PROGRAM_FILES%\SUPERAntiSpyware\SASTask.exe
%PROGRAM_FILES%\SUPERAntiSpyware\SUPERDelete.exe
%PROGRAM_FILES%\SUPERAntiSpyware\sas_enum_cookies.exe
%ALLUSERSPROFILE%\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\superantispyware.db3
%ALLUSERSPROFILE%\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS_ALLUSER.DB3-journal
%APPDATA%\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS_CURRENTUSER.DB3
%APPDATA%\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS_CURRENTUSER.DB3-journal
%ALLUSERSPROFILE%\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS_ALLUSER.DB3
%TEMP%\aut4.tmp
%TEMP%\aut3.tmp
%TEMP%\aut2.tmp
%ALLUSERSPROFILE%\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SetupOptions.db3
%ALLUSERSPROFILE%\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SetupOptions.db3-journal
%ALLUSERSPROFILE%\Desktop\SUPERAntiSpyware Professional.lnk
%PROGRAM_FILES%\SUPERAntiSpyware\Uninstall.dat-journal
%APPDATA%\SUPERAntiSpyware.com\SUPERAntiSpyware\sas-data.tmp
%ALLUSERSPROFILE%\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\sas-data.tmp
%PROGRAM_FILES%\SUPERAntiSpyware\Uninstall.dat
%TEMP%\SUPERSetup\SupportCom_Chrome_V2.exe
%TEMP%\SUPERSetup\setup.dll
%TEMP%\SUPERSetup\gcapi_dll.dll
%TEMP%\SUPERSetup\side.bmp
%PROGRAM_FILES%\SUPERAntiSpyware\detect.wav
%PROGRAM_FILES%\SUPERAntiSpyware\BootSafe.exe
%TEMP%\SUPERSetup\setup.db3
%TEMP%\SUPERSetup\Thumbs.db
%ALLUSERSPROFILE%\Application Data\Setup.exe
%TEMP%\aut1.tmp
%TEMP%\SUPERSetup\top.bmp
%TEMP%\SUPERSetup\SAS_LaunchChromeSetup.exe
%TEMP%\SUPERSetup\eula.rtf
%TEMP%\SUPERSetup\promo.html
%PROGRAM_FILES%\SUPERAntiSpyware\SASCore.exe
%PROGRAM_FILES%\SUPERAntiSpyware\Plugins\sab_wab.dll
%PROGRAM_FILES%\SUPERAntiSpyware\Plugins\sab_mapi.dll
%PROGRAM_FILES%\SUPERAntiSpyware\SASCTXMN.DLL
%PROGRAM_FILES%\SUPERAntiSpyware\SSUpdate.exe
%PROGRAM_FILES%\SUPERAntiSpyware\SASKUTIL.SYS
%PROGRAM_FILES%\SUPERAntiSpyware\sasdifsv.sys
%ALLUSERSPROFILE%\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\PROCESSLISTRELATED.DB
%ALLUSERSPROFILE%\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\PROCESSLIST.BIN
%PROGRAM_FILES%\SUPERAntiSpyware\msvcr71.dll
%PROGRAM_FILES%\SUPERAntiSpyware\RUNSAS.EXE
%PROGRAM_FILES%\SUPERAntiSpyware\Plugins\sab_incr.dll
%PROGRAM_FILES%\SUPERAntiSpyware\SASSEH.DLL
%PROGRAM_FILES%\SUPERAntiSpyware\SASREPAIRS.STG

Присваивает атрибут 'скрытый' для следующих файлов:

%ALLUSERSPROFILE%\Application Data\Setup.exe

Удаляет следующие файлы:

%ALLUSERSPROFILE%\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS_ALLUSER.DB3-journal
%ALLUSERSPROFILE%\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SetupOptions.db3
%TEMP%\aut2.tmp
%ALLUSERSPROFILE%\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\sas-data.tmp
%APPDATA%\SUPERAntiSpyware.com\SUPERAntiSpyware\sas-data.tmp
%APPDATA%\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS_CURRENTUSER.DB3-journal
%TEMP%\SUPERSetup\setup.db3
<SYSTEM32>\wbem\Performance\WmiApRpl.ini
<SYSTEM32>\PerfStringBackup.TMP
%TEMP%\aut3.tmp
%TEMP%\aut4.tmp
%ALLUSERSPROFILE%\Application Data\Setup.exe
%TEMP%\SUPERSetup\eula.rtf
%TEMP%\SUPERSetup\gcapi_dll.dll
%TEMP%\SUPERSetup\promo.html
%TEMP%\aut1.tmp
%ALLUSERSPROFILE%\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SetupOptions.db3-journal
%PROGRAM_FILES%\SUPERAntiSpyware\Uninstall.dat-journal
%TEMP%\SUPERSetup\SupportCom_Chrome_V2.exe
%TEMP%\SUPERSetup\Thumbs.db
%TEMP%\SUPERSetup\top.bmp
%TEMP%\SUPERSetup\SAS_LaunchChromeSetup.exe
%TEMP%\SUPERSetup\setup.dll
%TEMP%\SUPERSetup\side.bmp

Изменяет файл HOSTS.

Сетевая активность:

Подключается к:

'ev####.#ebflowmetrics.com':80

TCP:

Запросы HTTP GET:

ev####.#ebflowmetrics.com/metrics.asmx/RecordEvent?sE###################################################################################################

UDP: