Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\OlacaritaUpdateTaskMachineUA.job
- %WINDIR%\Tasks\OlacaritaUpdateTaskMachineCore.job
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Olacarita_update] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\Olacarita\Update\OlacaritaUpdate.exe' /handoff "appguid={8951ED24-6362-47CC-8158-EF4C9E9F6578}&appname=Olacarita&needsadmin=True&lang=es&referral=0" /installsource taggedmi /sessionid "{297ACECE-C81E-4562-BCAA-371507A9FEF0}"
- '%PROGRAM_FILES%\Olacarita\Update\OlacaritaUpdate.exe' /svc
- '%PROGRAM_FILES%\Olacarita\Update\OlacaritaUpdate.exe' /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMjUuMCIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InsyOTdBQ0VDRS1DODFFLTQ1NjItQkNBQS0zNzE1MDdBOUZFRjB9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7Q0I3Qzc5RTUtOUE5MC00RkEwLUJGRTQtNjg0MDcwRjgwMDgyfSI-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjUuMSIgc3A9IlNlcnZpY2UgUGFjayAyIiBhcmNoPSJ4ODYiLz48YXBwIGFwcGlkPSJ7ODk1MUVEMjQtNjM2Mi00N0NDLTgxNTgtRUY0QzlFOUY2NTc4fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlcyIgYnJhbmQ9IiIgY2xpZW50PSIwIiBpbnN0YWxsYWdlPSItMSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcyMTkzMjgiIGV4dHJhY29kZTE9IjI2ODQzNTQ1OSIvPjwvYXBwPjwvcmVxdWVzdD4
- '%PROGRAM_FILES%\Olacarita\Update\OlacaritaUpdate.exe' /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMjUuMCIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InsyOTdBQ0VDRS1DODFFLTQ1NjItQkNBQS0zNzE1MDdBOUZFRjB9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7QTY1REY0MzItRjAwQy00MzdBLUEyNDAtOEJFQjczMUY3NUI1fSI-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjUuMSIgc3A9IlNlcnZpY2UgUGFjayAyIiBhcmNoPSJ4ODYiLz48YXBwIGFwcGlkPSJ7RUU1NDVDOUQtNDdFMC00M0NBLThGMTgtNDJDOUU1MkM2MDk0fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjI1LjAiIGxhbmc9ImVzIiBicmFuZD0iIiBjbGllbnQ9IjAiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-
- '%TEMP%\GUM1.tmp\OlacaritaUpdate.exe' /installsource taggedmi /install "appguid={8951ED24-6362-47CC-8158-EF4C9E9F6578}&appname=Olacarita&needsadmin=True&lang=es&referral=0"
- '%PROGRAM_FILES%\Olacarita\Update\OlacaritaUpdate.exe' /regsvc
- '%PROGRAM_FILES%\Olacarita\Update\OlacaritaUpdate.exe' /regserver
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' /V
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_ja.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_iw.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_ko.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_kn.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_id.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_hu.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_it.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_is.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_lt.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_no.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_nl.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_pt-BR.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_pl.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_ml.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_lv.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_ms.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_mr.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_hr.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_el.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_de.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_en-GB.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_en.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_ca.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_bn.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_da.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_cs.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_es.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_fr.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_fil.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_hi.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_gu.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_et.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_es-419.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_fi.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_fa.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\OlacaritaUpdateOnDemand.exe
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\OlacaritaUpdateBroker.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %WINDIR%\Installer\2526b.msi
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\psmachine.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\psuser.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\npOlacaritaUpdate3.dll
- %PROGRAM_FILES%\Olacarita\Update\OlacaritaUpdate.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %TEMP%\Cab7.tmp
- C:\Config.Msi\2526e.rbs
- %WINDIR%\Installer\MSI9.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %TEMP%\Cab5.tmp
- %TEMP%\Cab3.tmp
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\OlacaritaUpdateHelper.msi
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_sr.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_sl.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_sw.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_sv.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_ro.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_pt-PT.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_sk.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_ru.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_ta.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_vi.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_ur.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_zh-TW.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_zh-CN.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_th.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_te.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_uk.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_tr.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_bg.dll
- %TEMP%\GUM1.tmp\goopdateres_et.dll
- %TEMP%\GUM1.tmp\goopdateres_es-419.dll
- %TEMP%\GUM1.tmp\goopdateres_fi.dll
- %TEMP%\GUM1.tmp\goopdateres_fa.dll
- %TEMP%\GUM1.tmp\goopdateres_en.dll
- %TEMP%\GUM1.tmp\goopdateres_el.dll
- %TEMP%\GUM1.tmp\goopdateres_es.dll
- %TEMP%\GUM1.tmp\goopdateres_en-GB.dll
- %TEMP%\GUM1.tmp\goopdateres_fil.dll
- %TEMP%\GUM1.tmp\goopdateres_id.dll
- %TEMP%\GUM1.tmp\goopdateres_hu.dll
- %TEMP%\GUM1.tmp\goopdateres_it.dll
- %TEMP%\GUM1.tmp\goopdateres_is.dll
- %TEMP%\GUM1.tmp\goopdateres_gu.dll
- %TEMP%\GUM1.tmp\goopdateres_fr.dll
- %TEMP%\GUM1.tmp\goopdateres_hr.dll
- %TEMP%\GUM1.tmp\goopdateres_hi.dll
- %TEMP%\GUM1.tmp\goopdateres_de.dll
- %TEMP%\GUM1.tmp\OlacaritaUpdateHelper.msi
- %TEMP%\GUM1.tmp\npOlacaritaUpdate3.dll
- %TEMP%\GUM1.tmp\OlacaritaUpdateOnDemand.exe
- %TEMP%\GUM1.tmp\OlacaritaUpdateBroker.exe
- %TEMP%\GUM1.tmp\OlacaritaUpdate.exe
- %TEMP%\GUT2.tmp
- %TEMP%\GUM1.tmp\goopdate.dll
- %TEMP%\GUM1.tmp\OlacaritaCrashHandler.exe
- %TEMP%\GUM1.tmp\psmachine.dll
- %TEMP%\GUM1.tmp\goopdateres_ca.dll
- %TEMP%\GUM1.tmp\goopdateres_bn.dll
- %TEMP%\GUM1.tmp\goopdateres_da.dll
- %TEMP%\GUM1.tmp\goopdateres_cs.dll
- %TEMP%\GUM1.tmp\goopdateres_am.dll
- %TEMP%\GUM1.tmp\psuser.dll
- %TEMP%\GUM1.tmp\goopdateres_bg.dll
- %TEMP%\GUM1.tmp\goopdateres_ar.dll
- %TEMP%\GUM1.tmp\goopdateres_th.dll
- %TEMP%\GUM1.tmp\goopdateres_te.dll
- %TEMP%\GUM1.tmp\goopdateres_uk.dll
- %TEMP%\GUM1.tmp\goopdateres_tr.dll
- %TEMP%\GUM1.tmp\goopdateres_sv.dll
- %TEMP%\GUM1.tmp\goopdateres_sr.dll
- %TEMP%\GUM1.tmp\goopdateres_ta.dll
- %TEMP%\GUM1.tmp\goopdateres_sw.dll
- %TEMP%\GUM1.tmp\goopdateres_ur.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\OlacaritaCrashHandler.exe
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdate.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_ar.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\goopdateres_am.dll
- %TEMP%\GUM1.tmp\goopdateres_zh-CN.dll
- %TEMP%\GUM1.tmp\goopdateres_vi.dll
- %PROGRAM_FILES%\Olacarita\Update\1.3.25.0\OlacaritaUpdate.exe
- %TEMP%\GUM1.tmp\goopdateres_zh-TW.dll
- %TEMP%\GUM1.tmp\goopdateres_sl.dll
- %TEMP%\GUM1.tmp\goopdateres_lv.dll
- %TEMP%\GUM1.tmp\goopdateres_lt.dll
- %TEMP%\GUM1.tmp\goopdateres_mr.dll
- %TEMP%\GUM1.tmp\goopdateres_ml.dll
- %TEMP%\GUM1.tmp\goopdateres_ja.dll
- %TEMP%\GUM1.tmp\goopdateres_iw.dll
- %TEMP%\GUM1.tmp\goopdateres_ko.dll
- %TEMP%\GUM1.tmp\goopdateres_kn.dll
- %TEMP%\GUM1.tmp\goopdateres_ms.dll
- %TEMP%\GUM1.tmp\goopdateres_ro.dll
- %TEMP%\GUM1.tmp\goopdateres_pt-PT.dll
- %TEMP%\GUM1.tmp\goopdateres_sk.dll
- %TEMP%\GUM1.tmp\goopdateres_ru.dll
- %TEMP%\GUM1.tmp\goopdateres_no.dll
- %TEMP%\GUM1.tmp\goopdateres_nl.dll
- %TEMP%\GUM1.tmp\goopdateres_pt-BR.dll
- %TEMP%\GUM1.tmp\goopdateres_pl.dll
Удаляет следующие файлы:
- C:\Config.Msi\2526e.rbs
- %WINDIR%\Installer\2526b.msi
- %WINDIR%\Installer\2526d.ipi
- %WINDIR%\Installer\MSI9.tmp
- %TEMP%\Cab3.tmp
- %TEMP%\Cab5.tmp
- %TEMP%\Cab7.tmp
Сетевая активность:
Подключается к:
- 'ol###rita.com':80
- 'localhost':1044
- 'localhost':1056
- 'ol###rita.com':443
- 'ca#####.digicert.com':80
- 'wp#d':80
- 'localhost':1042
- 'www.download.windowsupdate.com':80
TCP:
Запросы HTTP GET:
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- ca#####.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- wp#d/wpad.dat
- ca#####.digicert.com/DigiCertAssuredIDRootCA.crt
Запросы HTTP POST:
- ol###rita.com/omaha/tools/service/update2/?w=#############################################################################################################################################################################
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK ol###rita.com
- DNS ASK wp#d
- DNS ASK ca#####.digicert.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
