Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\services\sppsvc] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\slui.exe' -Embedding
- '<SYSTEM32>\sppsvc.exe'
- '<SYSTEM32>\Wat\WatAdminSvc.exe' /run
- '<SYSTEM32>\Wat\WatAdminSvc.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\autDBF7.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_StopAC.bmp
- %TEMP%\autDBE7.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_taClearAll.bmp
- %TEMP%\autDC08.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_taAdd.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_StartAC.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_ShowAll.bmp
- %TEMP%\autDB76.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_saPlay.bmp
- %TEMP%\autDB98.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_SignIn.bmp
- %TEMP%\autDB87.tmp
- %TEMP%\autDC18.tmp
- %TEMP%\autDD17.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_TimeRemaining.bmp
- %TEMP%\autDD06.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_usDownload.bmp
- %TEMP%\autDD28.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_usCheck.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_taSetCoords.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_taMap.bmp
- %TEMP%\autDC29.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_taDel.bmp
- %TEMP%\autDCF6.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_taMap_Add.bmp
- %TEMP%\autDC3A.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_plClearList.bmp
- %TEMP%\autDA34.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_plAdd.bmp
- %TEMP%\autDA55.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_plDelete.bmp
- %TEMP%\autDA45.tmp
- %TEMP%\autDA24.tmp
- %TEMP%\autD8CA.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_mrRecoverNow.bmp
- %TEMP%\autD8BA.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_mrStop.bmp
- %TEMP%\autDA13.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_mrStart.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_plExceeded.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_saBrowse.bmp
- %TEMP%\autDAE7.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_ResetAll.bmp
- %TEMP%\autDB66.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_saInsert.bmp
- %TEMP%\autDAF7.tmp
- %TEMP%\autDAD6.tmp
- %TEMP%\autDA77.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_plInsert.bmp
- %TEMP%\autDA66.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_RefreshList.bmp
- %TEMP%\autDA87.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_plLoadList.bmp
- %TEMP%\autDE70.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\7.bmp
- %TEMP%\autDFBA.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\6.bmp
- %TEMP%\autE0A6.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\8.bmp
- %TEMP%\autE096.tmp
- %TEMP%\autDFAA.tmp
- %TEMP%\autDF88.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\3.bmp
- %TEMP%\autDF78.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\5.bmp
- %TEMP%\autDF99.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\4.bmp
- %TEMP%\error-soft\sbotac\Images\Passcode\9.bmp
- %WINDIR%\ServiceProfiles\LocalService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C24EC5BDAF13613245B4CECC3DE91DC6
- %WINDIR%\ServiceProfiles\LocalService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C24EC5BDAF13613245B4CECC3DE91DC6
- %TEMP%\error-soft\sbotac\Images\Passcode\Image.dll
- %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\Cab6E10.tmp
- %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\Cab6DEE.tmp
- %WINDIR%\Temp\tmp4FF3.tmp
- %TEMP%\autE0E9.tmp
- %TEMP%\autE0C7.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\confirm.bmp
- %TEMP%\autE0B7.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\confirm_ger.bmp
- %TEMP%\autE0D8.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\confirm2.bmp
- %TEMP%\autDED3.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_as2Stop.bmp
- %TEMP%\autDEC2.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_help.bmp
- %TEMP%\autDEE3.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_as2Reset.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_as2Start.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_icGo.bmp
- %TEMP%\autDE90.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_usRun.bmp
- %TEMP%\autDEB2.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_as2Update.bmp
- %TEMP%\autDEA1.tmp
- %TEMP%\autDEF4.tmp
- %TEMP%\autDF47.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\0.bmp
- %TEMP%\autDF36.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\2.bmp
- %TEMP%\autDF67.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\1.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csLeaveNote.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csAutoTrace.bmp
- %TEMP%\autDF05.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csAutoMastery.bmp
- %TEMP%\autDF26.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_plPartyLeader.bmp
- %TEMP%\autDF15.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_LeaveParty.bmp
- %TEMP%\autD1A2.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aiClear.bmp
- %TEMP%\autD192.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aiDel.bmp
- %TEMP%\autD368.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_charstats.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aiCancel.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aiAdd.bmp
- %TEMP%\autD170.tmp
- %TEMP%\error-soft\sbotac\Images\traffic.JPG
- %TEMP%\autD181.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aiBrowse.bmp
- %TEMP%\autD171.tmp
- %TEMP%\autD378.tmp
- %TEMP%\autD439.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aiUp.bmp
- %TEMP%\autD428.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_asDel.bmp
- %TEMP%\autD459.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_asAdd.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aaiUpdate.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aiEdit.bmp
- %TEMP%\autD389.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aiDown.bmp
- %TEMP%\autD3BA.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aaiAdd.bmp
- %TEMP%\autD3A9.tmp
- %TEMP%\error-soft\sbotac\Images\JGlv2.PNG
- %TEMP%\autD09B.tmp
- %TEMP%\error-soft\sbotac\Images\JGlv1.PNG
- %TEMP%\autD0CC.tmp
- %TEMP%\error-soft\sbotac\Images\JGlv3.PNG
- %TEMP%\autD0BB.tmp
- %TEMP%\autD08A.tmp
- %TEMP%\autCFFC.tmp
- %TEMP%\tgumqkp
- %TEMP%\autCE75.tmp
- %TEMP%\error-soft\sbotac\Images\Map.JPG
- %TEMP%\autD07A.tmp
- %TEMP%\error-soft\sbotac\Images\BigMap.JPG
- %TEMP%\error-soft\sbotac\Images\JGlv4.PNG
- %TEMP%\error-soft\sbotac\Images\mapdot.PNG
- %TEMP%\autD12E.tmp
- %TEMP%\error-soft\sbotac\Images\DWlv4.PNG
- %TEMP%\autD14F.tmp
- %TEMP%\error-soft\sbotac\Images\mapdot_dc.PNG
- %TEMP%\autD13F.tmp
- %TEMP%\autD11E.tmp
- %TEMP%\autD0FC.tmp
- %TEMP%\error-soft\sbotac\Images\DWlv1.PNG
- %TEMP%\autD0EC.tmp
- %TEMP%\error-soft\sbotac\Images\DWlv3.PNG
- %TEMP%\autD10D.tmp
- %TEMP%\error-soft\sbotac\Images\DWlv2.PNG
- %TEMP%\autD469.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csRight.bmp
- %TEMP%\autD7E5.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csRemove.bmp
- %TEMP%\autD806.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csSaveChat.bmp
- %TEMP%\autD7F6.tmp
- %TEMP%\autD777.tmp
- %TEMP%\autD756.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csGoTo.bmp
- %TEMP%\autD745.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csLogs.bmp
- %TEMP%\autD766.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csLeft.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csSoundAlerts.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_HideAll.bmp
- %TEMP%\autD888.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_gsUnCheckAll.bmp
- %TEMP%\autD8A9.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_ibR.bmp
- %TEMP%\autD899.tmp
- %TEMP%\autD877.tmp
- %TEMP%\autD856.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_eplLeaveParty.bmp
- %TEMP%\autD817.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_gsCheckAll.bmp
- %TEMP%\autD867.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_GetHWID.bmp
- %TEMP%\autD652.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_ClearLog2.bmp
- %TEMP%\autD603.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_clOK.bmp
- %TEMP%\autD663.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aiOK.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_ClearLog1.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_asEnable.bmp
- %TEMP%\autD5D1.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_asDisable.bmp
- %TEMP%\autD5F2.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_asInsert.bmp
- %TEMP%\autD5E2.tmp
- %TEMP%\autD673.tmp
- %TEMP%\autD733.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csCastSkill.bmp
- %TEMP%\autD6B6.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_cSend.bmp
- %TEMP%\autD734.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csEdit.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csSetAffinity.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_clSave.bmp
- %TEMP%\autD684.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_CLOSE.bmp
- %TEMP%\autD6A5.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_CopyToClipboard.bmp
- %TEMP%\autD694.tmp
Удаляет следующие файлы:
- %TEMP%\autDBE7.tmp
- %TEMP%\autDBF7.tmp
- %TEMP%\autDC08.tmp
- %TEMP%\autDB76.tmp
- %TEMP%\autDB87.tmp
- %TEMP%\autDB98.tmp
- %TEMP%\autDC18.tmp
- %TEMP%\autDD06.tmp
- %TEMP%\autDD17.tmp
- %TEMP%\autDD28.tmp
- %TEMP%\autDC29.tmp
- %TEMP%\autDC3A.tmp
- %TEMP%\autDCF6.tmp
- %TEMP%\autDB66.tmp
- %TEMP%\autDA24.tmp
- %TEMP%\autDA34.tmp
- %TEMP%\autDA45.tmp
- %TEMP%\autD8BA.tmp
- %TEMP%\autD8CA.tmp
- %TEMP%\autDA13.tmp
- %TEMP%\autDA55.tmp
- %TEMP%\autDAD6.tmp
- %TEMP%\autDAE7.tmp
- %TEMP%\autDAF7.tmp
- %TEMP%\autDA66.tmp
- %TEMP%\autDA77.tmp
- %TEMP%\autDA87.tmp
- %TEMP%\autDE70.tmp
- %TEMP%\autDFBA.tmp
- %TEMP%\autE096.tmp
- %TEMP%\autE0A6.tmp
- %TEMP%\autDF88.tmp
- %TEMP%\autDF99.tmp
- %TEMP%\autDFAA.tmp
- %TEMP%\autE0B7.tmp
- %WINDIR%\Temp\tmp4FF3.tmp
- %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\Cab6DEE.tmp
- %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\Cab6E10.tmp
- %TEMP%\autE0C7.tmp
- %TEMP%\autE0D8.tmp
- %TEMP%\autE0E9.tmp
- %TEMP%\autDF78.tmp
- %TEMP%\autDEC2.tmp
- %TEMP%\autDED3.tmp
- %TEMP%\autDEE3.tmp
- %TEMP%\autDE90.tmp
- %TEMP%\autDEA1.tmp
- %TEMP%\autDEB2.tmp
- %TEMP%\autDEF4.tmp
- %TEMP%\autDF36.tmp
- %TEMP%\autDF47.tmp
- %TEMP%\autDF67.tmp
- %TEMP%\autDF05.tmp
- %TEMP%\autDF15.tmp
- %TEMP%\autDF26.tmp
- %TEMP%\autD8A9.tmp
- %TEMP%\autD181.tmp
- %TEMP%\autD192.tmp
- %TEMP%\autD1A2.tmp
- %TEMP%\autD14F.tmp
- %TEMP%\autD170.tmp
- %TEMP%\autD171.tmp
- %TEMP%\autD368.tmp
- %TEMP%\autD3BA.tmp
- %TEMP%\autD428.tmp
- %TEMP%\autD439.tmp
- %TEMP%\autD378.tmp
- %TEMP%\autD389.tmp
- %TEMP%\autD3A9.tmp
- %TEMP%\autD13F.tmp
- %TEMP%\autD07A.tmp
- %TEMP%\autD08A.tmp
- %TEMP%\autD09B.tmp
- %TEMP%\autCE75.tmp
- %TEMP%\tgumqkp
- %TEMP%\autCFFC.tmp
- %TEMP%\autD0BB.tmp
- %TEMP%\autD10D.tmp
- %TEMP%\autD11E.tmp
- %TEMP%\autD12E.tmp
- %TEMP%\autD0CC.tmp
- %TEMP%\autD0EC.tmp
- %TEMP%\autD0FC.tmp
- %TEMP%\autD459.tmp
- %TEMP%\autD777.tmp
- %TEMP%\autD7E5.tmp
- %TEMP%\autD7F6.tmp
- %TEMP%\autD745.tmp
- %TEMP%\autD756.tmp
- %TEMP%\autD766.tmp
- %TEMP%\autD806.tmp
- %TEMP%\autD877.tmp
- %TEMP%\autD888.tmp
- %TEMP%\autD899.tmp
- %TEMP%\autD817.tmp
- %TEMP%\autD856.tmp
- %TEMP%\autD867.tmp
- %TEMP%\autD734.tmp
- %TEMP%\autD5F2.tmp
- %TEMP%\autD603.tmp
- %TEMP%\autD652.tmp
- %TEMP%\autD469.tmp
- %TEMP%\autD5D1.tmp
- %TEMP%\autD5E2.tmp
- %TEMP%\autD663.tmp
- %TEMP%\autD6A5.tmp
- %TEMP%\autD6B6.tmp
- %TEMP%\autD733.tmp
- %TEMP%\autD673.tmp
- %TEMP%\autD684.tmp
- %TEMP%\autD694.tmp
Сетевая активность:
Подключается к:
- '20#.#6.232.182':80
- 'ct###.#indowsupdate.com':80
TCP:
Запросы HTTP GET:
- 20#.#6.232.182/fwlink/?Li###########
- ct###.#indowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3f##############
- 20#.#6.232.182/pki/crl/products/WinPCA.crl
- ct###.#indowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?77##############
- 20#.#6.232.182/pki/crl/products/microsoftrootcert.crl
UDP:
- DNS ASK www.microsoft.com
- DNS ASK go.###rosoft.com
- DNS ASK ct###.#indowsupdate.com
- DNS ASK crl.microsoft.com
