Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\SASKUTIL] 'Start' = '00000001'
- [HKLM\System\CurrentControlSet\Services\SASKUTIL] 'ImagePath' = '<Current directory>\SASKUTIL64.SYS'
- [HKLM\System\CurrentControlSet\Services\SASDIFSV] 'Start' = '00000001'
- [HKLM\System\CurrentControlSet\Services\SASDIFSV] 'ImagePath' = '<Current directory>\SASDIFSV64.SYS'
Creates the following services
- 'SASKUTIL' <Current directory>\SASKUTIL64.SYS
- 'SASDIFSV' <Current directory>\SASDIFSV64.SYS
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\sas-data.tmp
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\update\ba8a11c302c6a1eff44d6fb71bc2a3f0
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\update\b3e9dfd17cf864d552e03445a7d3133c
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\update\a01d955e1485454b56413cc4c40f547f
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\update\a3dfb0a3ed079bd1ffa861a994a978e3
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\update\e16c0b7410e922b939e9a5dc9f3530ab
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\update\597ffe9b5af6941b418695d334f67942
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\update\e284907472a538b478b39b9cfe8f9542
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\update\5e1ed3b34c6a787a1fc271ea0bdb33b0
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\update\b3c09d4d3f96dbf7ee3514b50630601f
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\update\b5c6995f064181586529fc7b1f9d056b
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\update\3eca58c9fd3dfdee1596fc2cd4a9cfdc
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\update\5591e601b246b72c817e10e541eb39cf
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\update\fd2cab0990f84dea05e0afb36d4cf1bb
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\update\e30153f58dcecfd59b14f62f7dfc7175
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\update\efc9ea7aa080142234062f49c1ed2aa0
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\sc_res_2.db3
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\sc_res_2.db3-journal
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\update\a48bbf8aa311f6fbca3d36e2fffc88e2
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\update.dat
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\applogs\superantispyware-10-22-2023( 17-25-43 ).sdb
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\sas_alluser.db3
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\sas_alluser.db3-journal
- %APPDATA%\superantispyware.com\superantispyware\sas_currentuser.db3
- %APPDATA%\superantispyware.com\superantispyware\sas_currentuser.db3-journal
- %APPDATA%\superantispyware.com\superantispyware\sas-data.tmp
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\update\5fb5e4a2474ede1bc3df2c1e0b5cc6b3
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\update\d9abee51476014a793cb14d0cfe7167d
Deletes the following files
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\sas-data.tmp
- %APPDATA%\superantispyware.com\superantispyware\sas-data.tmp
- %APPDATA%\superantispyware.com\superantispyware\sas_currentuser.db3-journal
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\sas_alluser.db3-journal
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\sc_res_2.db3-journal
Substitutes the following files
- %APPDATA%\superantispyware.com\superantispyware\sas_currentuser.db3-journal
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\sas_alluser.db3-journal
- %ALLUSERSPROFILE%\superantispyware.com\superantispyware\sc_res_2.db3-journal
Network activity
Connects to
- 'su#####tispyware.com':80
TCP
HTTP GET requests
- http://cd#.####rantispyware.com/sascomponents/%7B0D3C4F0D-1C11-47BC-AD1C-BAB98712DBFB%7D.sas
- http://cd#.####rantispyware.com/sascomponents/D9ABEE51476014A793CB14D0CFE7167D
- http://cd#.####rantispyware.com/sascomponents/5FB5E4A2474EDE1BC3DF2C1E0B5CC6B3
- http://cd#.####rantispyware.com/sascomponents/BA8A11C302C6A1EFF44D6FB71BC2A3F0
- http://cd#.####rantispyware.com/sascomponents/B3E9DFD17CF864D552E03445A7D3133C
- http://cd#.####rantispyware.com/sascomponents/A01D955E1485454B56413CC4C40F547F
- http://cd#.####rantispyware.com/sascomponents/A3DFB0A3ED079BD1FFA861A994A978E3
- http://cd#.####rantispyware.com/sascomponents/E16C0B7410E922B939E9A5DC9F3530AB
- http://cd#.####rantispyware.com/sascomponents/597FFE9B5AF6941B418695D334F67942
- http://cd#.####rantispyware.com/appdata/sas/public/20000002.XML
- http://cd#.####rantispyware.com/sascomponents/E284907472A538B478B39B9CFE8F9542
- http://cd#.####rantispyware.com/sascomponents/B3C09D4D3F96DBF7EE3514B50630601F
- http://cd#.####rantispyware.com/sascomponents/B5C6995F064181586529FC7B1F9D056B
- http://cd#.####rantispyware.com/sascomponents/3ECA58C9FD3DFDEE1596FC2CD4A9CFDC
- http://cd#.####rantispyware.com/sascomponents/5591E601B246B72C817E10E541EB39CF
- http://cd#.####rantispyware.com/sascomponents/FD2CAB0990F84DEA05E0AFB36D4CF1BB
- http://cd#.####rantispyware.com/sascomponents/E30153F58DCECFD59B14F62F7DFC7175
- http://cd#.####rantispyware.com/sascomponents/EFC9EA7AA080142234062F49C1ED2AA0
- http://cd#.####rantispyware.com/sascomponents/A48BBF8AA311F6FBCA3D36E2FFFC88E2
- http://cd#.####rantispyware.com/sascomponents/5E1ED3B34C6A787A1FC271EA0BDB33B0
- http://cd#.####rantispyware.com/appdata/sas/public/new.17825.SAS
HTTP POST requests
- http://www.su#####tispyware.com/application.php
UDP
- DNS ASK su#####tispyware.com
- DNS ASK cd#.####rantispyware.com
Miscellaneous
Searches for the following windows
- ClassName: 'SUPERANTISPYWARE' WindowName: ''
- ClassName: '{06CD588E-4BD7-4ab9-9938-0949231C9484}' WindowName: ''
