Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\services\sppsvc] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\slui.exe' -Embedding
- '<SYSTEM32>\sppsvc.exe'
- '<SYSTEM32>\Wat\WatAdminSvc.exe' /run
- '<SYSTEM32>\Wat\WatAdminSvc.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\autD8AD.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_StopAC.bmp
- %TEMP%\autD88C.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_taClearAll.bmp
- %TEMP%\autD8BD.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_taAdd.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_StartAC.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_ShowAll.bmp
- %TEMP%\autD84B.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_saPlay.bmp
- %TEMP%\autD87C.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_SignIn.bmp
- %TEMP%\autD85C.tmp
- %TEMP%\autD8DD.tmp
- %TEMP%\autD95F.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_TimeRemaining.bmp
- %TEMP%\autD93F.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_usDownload.bmp
- %TEMP%\autD97F.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_usCheck.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_taSetCoords.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_taMap.bmp
- %TEMP%\autD8EE.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_taDel.bmp
- %TEMP%\autD92E.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_taMap_Add.bmp
- %TEMP%\autD90E.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_plClearList.bmp
- %TEMP%\autD6F9.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_plAdd.bmp
- %TEMP%\autD759.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_plDelete.bmp
- %TEMP%\autD758.tmp
- %TEMP%\autD6E9.tmp
- %TEMP%\autD6C8.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_mrRecoverNow.bmp
- %TEMP%\autD6B7.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_mrStop.bmp
- %TEMP%\autD6D8.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_mrStart.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_plExceeded.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_saBrowse.bmp
- %TEMP%\autD7FA.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_ResetAll.bmp
- %TEMP%\autD83A.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_saInsert.bmp
- %TEMP%\autD81A.tmp
- %TEMP%\autD7E9.tmp
- %TEMP%\autD77A.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_plInsert.bmp
- %TEMP%\autD76A.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_RefreshList.bmp
- %TEMP%\autD78B.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_plLoadList.bmp
- %TEMP%\autDA2C.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\7.bmp
- %TEMP%\autDB95.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\6.bmp
- %TEMP%\autDC14.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\8.bmp
- %TEMP%\autDBF4.tmp
- %TEMP%\autDB85.tmp
- %TEMP%\autDB54.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\3.bmp
- %TEMP%\autDB43.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\5.bmp
- %TEMP%\autDB64.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\4.bmp
- %TEMP%\error-soft\sbotac\Images\Passcode\9.bmp
- %WINDIR%\ServiceProfiles\LocalService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C24EC5BDAF13613245B4CECC3DE91DC6
- %WINDIR%\ServiceProfiles\LocalService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C24EC5BDAF13613245B4CECC3DE91DC6
- %TEMP%\error-soft\sbotac\Images\Passcode\Image.dll
- %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\Cab6C2C.tmp
- %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\Cab6BFB.tmp
- %WINDIR%\Temp\tmp4C7A.tmp
- %TEMP%\autDC85.tmp
- %TEMP%\autDC55.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\confirm.bmp
- %TEMP%\autDC34.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\confirm_ger.bmp
- %TEMP%\autDC65.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\confirm2.bmp
- %TEMP%\autDA8F.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_as2Stop.bmp
- %TEMP%\autDA7E.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_help.bmp
- %TEMP%\autDAAF.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_as2Reset.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_as2Start.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_icGo.bmp
- %TEMP%\autDA3D.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_usRun.bmp
- %TEMP%\autDA6D.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_as2Update.bmp
- %TEMP%\autDA4D.tmp
- %TEMP%\autDABF.tmp
- %TEMP%\autDB12.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\0.bmp
- %TEMP%\autDB02.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\2.bmp
- %TEMP%\autDB33.tmp
- %TEMP%\error-soft\sbotac\Images\Passcode\1.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csLeaveNote.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csAutoTrace.bmp
- %TEMP%\autDAD0.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csAutoMastery.bmp
- %TEMP%\autDAF1.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_plPartyLeader.bmp
- %TEMP%\autDAE1.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_LeaveParty.bmp
- %TEMP%\autCF32.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aiClear.bmp
- %TEMP%\autCE86.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aiDel.bmp
- %TEMP%\autCFA1.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_charstats.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aiCancel.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aiAdd.bmp
- %TEMP%\autCE54.tmp
- %TEMP%\error-soft\sbotac\Images\traffic.JPG
- %TEMP%\autCE75.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aiBrowse.bmp
- %TEMP%\autCE65.tmp
- %TEMP%\autCFFF.tmp
- %TEMP%\autD12D.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aiUp.bmp
- %TEMP%\autD10C.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_asDel.bmp
- %TEMP%\autD13D.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_asAdd.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aaiUpdate.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aiEdit.bmp
- %TEMP%\autD04E.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aiDown.bmp
- %TEMP%\autD07F.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aaiAdd.bmp
- %TEMP%\autD05F.tmp
- %TEMP%\error-soft\sbotac\Images\JGlv2.PNG
- %TEMP%\autCD8F.tmp
- %TEMP%\error-soft\sbotac\Images\JGlv1.PNG
- %TEMP%\autCDC0.tmp
- %TEMP%\error-soft\sbotac\Images\JGlv3.PNG
- %TEMP%\autCD9F.tmp
- %TEMP%\autCD7E.tmp
- %TEMP%\autCCE0.tmp
- %TEMP%\dmldokq
- %TEMP%\autCB4A.tmp
- %TEMP%\error-soft\sbotac\Images\Map.JPG
- %TEMP%\autCD5E.tmp
- %TEMP%\error-soft\sbotac\Images\BigMap.JPG
- %TEMP%\error-soft\sbotac\Images\JGlv4.PNG
- %TEMP%\error-soft\sbotac\Images\mapdot.PNG
- %TEMP%\autCE22.tmp
- %TEMP%\error-soft\sbotac\Images\DWlv4.PNG
- %TEMP%\autCE43.tmp
- %TEMP%\error-soft\sbotac\Images\mapdot_dc.PNG
- %TEMP%\autCE33.tmp
- %TEMP%\autCE12.tmp
- %TEMP%\autCDE1.tmp
- %TEMP%\error-soft\sbotac\Images\DWlv1.PNG
- %TEMP%\autCDD0.tmp
- %TEMP%\error-soft\sbotac\Images\DWlv3.PNG
- %TEMP%\autCDF1.tmp
- %TEMP%\error-soft\sbotac\Images\DWlv2.PNG
- %TEMP%\autD15D.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csRight.bmp
- %TEMP%\autD546.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csRemove.bmp
- %TEMP%\autD5B5.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csSaveChat.bmp
- %TEMP%\autD5A5.tmp
- %TEMP%\autD536.tmp
- %TEMP%\autD514.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csGoTo.bmp
- %TEMP%\autD513.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csLogs.bmp
- %TEMP%\autD525.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csLeft.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csSoundAlerts.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_HideAll.bmp
- %TEMP%\autD685.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_gsUnCheckAll.bmp
- %TEMP%\autD6A6.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_ibR.bmp
- %TEMP%\autD696.tmp
- %TEMP%\autD675.tmp
- %TEMP%\autD605.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_eplLeaveParty.bmp
- %TEMP%\autD5C6.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_gsCheckAll.bmp
- %TEMP%\autD654.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_GetHWID.bmp
- %TEMP%\autD23D.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_ClearLog2.bmp
- %TEMP%\autD1EE.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_clOK.bmp
- %TEMP%\autD24D.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_aiOK.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_ClearLog1.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_asEnable.bmp
- %TEMP%\autD16E.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_asDisable.bmp
- %TEMP%\autD1DD.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_asInsert.bmp
- %TEMP%\autD1BD.tmp
- %TEMP%\autD25E.tmp
- %TEMP%\autD4F2.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csCastSkill.bmp
- %TEMP%\autD4E2.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_cSend.bmp
- %TEMP%\autD4F3.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csEdit.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_csSetAffinity.bmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_clSave.bmp
- %TEMP%\autD27E.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_CLOSE.bmp
- %TEMP%\autD2AF.tmp
- %TEMP%\error-soft\sbotac\Images\Buttons\button_CopyToClipboard.bmp
- %TEMP%\autD28F.tmp
Удаляет следующие файлы:
- %TEMP%\autD88C.tmp
- %TEMP%\autD8AD.tmp
- %TEMP%\autD8BD.tmp
- %TEMP%\autD84B.tmp
- %TEMP%\autD85C.tmp
- %TEMP%\autD87C.tmp
- %TEMP%\autD8DD.tmp
- %TEMP%\autD93F.tmp
- %TEMP%\autD95F.tmp
- %TEMP%\autD97F.tmp
- %TEMP%\autD8EE.tmp
- %TEMP%\autD90E.tmp
- %TEMP%\autD92E.tmp
- %TEMP%\autD83A.tmp
- %TEMP%\autD6E9.tmp
- %TEMP%\autD6F9.tmp
- %TEMP%\autD758.tmp
- %TEMP%\autD6B7.tmp
- %TEMP%\autD6C8.tmp
- %TEMP%\autD6D8.tmp
- %TEMP%\autD759.tmp
- %TEMP%\autD7E9.tmp
- %TEMP%\autD7FA.tmp
- %TEMP%\autD81A.tmp
- %TEMP%\autD76A.tmp
- %TEMP%\autD77A.tmp
- %TEMP%\autD78B.tmp
- %TEMP%\autDA2C.tmp
- %TEMP%\autDB95.tmp
- %TEMP%\autDBF4.tmp
- %TEMP%\autDC14.tmp
- %TEMP%\autDB54.tmp
- %TEMP%\autDB64.tmp
- %TEMP%\autDB85.tmp
- %TEMP%\autDC34.tmp
- %WINDIR%\Temp\tmp4C7A.tmp
- %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\Cab6BFB.tmp
- %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\Cab6C2C.tmp
- %TEMP%\autDC55.tmp
- %TEMP%\autDC65.tmp
- %TEMP%\autDC85.tmp
- %TEMP%\autDB43.tmp
- %TEMP%\autDA7E.tmp
- %TEMP%\autDA8F.tmp
- %TEMP%\autDAAF.tmp
- %TEMP%\autDA3D.tmp
- %TEMP%\autDA4D.tmp
- %TEMP%\autDA6D.tmp
- %TEMP%\autDABF.tmp
- %TEMP%\autDB02.tmp
- %TEMP%\autDB12.tmp
- %TEMP%\autDB33.tmp
- %TEMP%\autDAD0.tmp
- %TEMP%\autDAE1.tmp
- %TEMP%\autDAF1.tmp
- %TEMP%\autD6A6.tmp
- %TEMP%\autCE75.tmp
- %TEMP%\autCE86.tmp
- %TEMP%\autCF32.tmp
- %TEMP%\autCE43.tmp
- %TEMP%\autCE54.tmp
- %TEMP%\autCE65.tmp
- %TEMP%\autCFA1.tmp
- %TEMP%\autD07F.tmp
- %TEMP%\autD10C.tmp
- %TEMP%\autD12D.tmp
- %TEMP%\autCFFF.tmp
- %TEMP%\autD04E.tmp
- %TEMP%\autD05F.tmp
- %TEMP%\autCE33.tmp
- %TEMP%\autCD5E.tmp
- %TEMP%\autCD7E.tmp
- %TEMP%\autCD8F.tmp
- %TEMP%\autCB4A.tmp
- %TEMP%\dmldokq
- %TEMP%\autCCE0.tmp
- %TEMP%\autCD9F.tmp
- %TEMP%\autCDF1.tmp
- %TEMP%\autCE12.tmp
- %TEMP%\autCE22.tmp
- %TEMP%\autCDC0.tmp
- %TEMP%\autCDD0.tmp
- %TEMP%\autCDE1.tmp
- %TEMP%\autD13D.tmp
- %TEMP%\autD536.tmp
- %TEMP%\autD546.tmp
- %TEMP%\autD5A5.tmp
- %TEMP%\autD513.tmp
- %TEMP%\autD514.tmp
- %TEMP%\autD525.tmp
- %TEMP%\autD5B5.tmp
- %TEMP%\autD675.tmp
- %TEMP%\autD685.tmp
- %TEMP%\autD696.tmp
- %TEMP%\autD5C6.tmp
- %TEMP%\autD605.tmp
- %TEMP%\autD654.tmp
- %TEMP%\autD4F3.tmp
- %TEMP%\autD1DD.tmp
- %TEMP%\autD1EE.tmp
- %TEMP%\autD23D.tmp
- %TEMP%\autD15D.tmp
- %TEMP%\autD16E.tmp
- %TEMP%\autD1BD.tmp
- %TEMP%\autD24D.tmp
- %TEMP%\autD2AF.tmp
- %TEMP%\autD4E2.tmp
- %TEMP%\autD4F2.tmp
- %TEMP%\autD25E.tmp
- %TEMP%\autD27E.tmp
- %TEMP%\autD28F.tmp
Сетевая активность:
Подключается к:
- '20#.#6.232.182':80
- 'ct###.#indowsupdate.com':80
TCP:
Запросы HTTP GET:
- 20#.#6.232.182/fwlink/?Li###########
- ct###.#indowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?67##############
- 20#.#6.232.182/pki/crl/products/WinPCA.crl
- ct###.#indowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?27##############
- 20#.#6.232.182/pki/crl/products/microsoftrootcert.crl
UDP:
- DNS ASK www.microsoft.com
- DNS ASK go.###rosoft.com
- DNS ASK ct###.#indowsupdate.com
- DNS ASK crl.microsoft.com
