Trojan.DownLoader33.41848

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\SASKUTIL] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\SASKUTIL] 'ImagePath' = '<Current directory>\SASKUTIL64.SYS'
[<HKLM>\System\CurrentControlSet\Services\SASDIFSV] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\SASDIFSV] 'ImagePath' = '<Current directory>\SASDIFSV64.SYS'

Modifies file system

Creates the following files

%PROGRAMDATA%\superantispyware.com\superantispyware\sas-data.tmp
%PROGRAMDATA%\superantispyware.com\superantispyware\update\35da92670c06c15cf6f5c10708788554
%PROGRAMDATA%\superantispyware.com\superantispyware\update\981716d86ba53b87f9a4b9f837fc60c4
%PROGRAMDATA%\superantispyware.com\superantispyware\update\4d0dd97c0ab63c0d72a895b4db8b0553
%PROGRAMDATA%\superantispyware.com\superantispyware\update\3497c5e00ecd5fdb728e9b5093e2b831
%PROGRAMDATA%\superantispyware.com\superantispyware\update\5302d99fb38de4318738be8eb5504695
%PROGRAMDATA%\superantispyware.com\superantispyware\update\98e06cac2c508118450095e581202230
%PROGRAMDATA%\superantispyware.com\superantispyware\update\3289766038db2cb14d07dc84392138d5
%PROGRAMDATA%\superantispyware.com\superantispyware\update\58a38e75f3316a83c23df6173d41f2b5
%PROGRAMDATA%\superantispyware.com\superantispyware\update\2640b083bb33cc6095cb0e6e2f8acc98
%PROGRAMDATA%\superantispyware.com\superantispyware\update\99851aef40ccc89527358327fa3ac645
%PROGRAMDATA%\superantispyware.com\superantispyware\update\a01d955e1485454b56413cc4c40f547f
%PROGRAMDATA%\superantispyware.com\superantispyware\update\bb572c1a4a0963e317caf54e72f0b84c
%PROGRAMDATA%\superantispyware.com\superantispyware\update\a48bbf8aa311f6fbca3d36e2fffc88e2
%PROGRAMDATA%\superantispyware.com\superantispyware\update.dat
%PROGRAMDATA%\superantispyware.com\superantispyware\sc_res_2.db3
%PROGRAMDATA%\superantispyware.com\superantispyware\sc_res_2.db3-journal
%PROGRAMDATA%\superantispyware.com\superantispyware\applogs\superantispyware-5-16-2020( 13-17-0 ).sdb
%PROGRAMDATA%\superantispyware.com\superantispyware\sas_alluser.db3
%PROGRAMDATA%\superantispyware.com\superantispyware\sas_alluser.db3-journal
%APPDATA%\superantispyware.com\superantispyware\sas_currentuser.db3
%APPDATA%\superantispyware.com\superantispyware\sas_currentuser.db3-journal
%APPDATA%\superantispyware.com\superantispyware\sas-data.tmp
%PROGRAMDATA%\superantispyware.com\superantispyware\update\efc9ea7aa080142234062f49c1ed2aa0
%PROGRAMDATA%\superantispyware.com\superantispyware\update\b3e9dfd17cf864d552e03445a7d3133c

Deletes the following files

%PROGRAMDATA%\superantispyware.com\superantispyware\sas-data.tmp
%APPDATA%\superantispyware.com\superantispyware\sas-data.tmp
%APPDATA%\superantispyware.com\superantispyware\sas_currentuser.db3-journal
%PROGRAMDATA%\superantispyware.com\superantispyware\sas_alluser.db3-journal
%PROGRAMDATA%\superantispyware.com\superantispyware\sc_res_2.db3-journal

Substitutes the following files

%APPDATA%\superantispyware.com\superantispyware\sas_currentuser.db3-journal
%PROGRAMDATA%\superantispyware.com\superantispyware\sas_alluser.db3-journal
%PROGRAMDATA%\superantispyware.com\superantispyware\sc_res_2.db3-journal

Network activity

TCP

HTTP GET requests

http://cd#.####rantispyware.com/sascomponents/%7B0D3C4F0D-1C11-47BC-AD1C-BAB98712DBFB%7D.sas
http://cd#.####rantispyware.com/sascomponents/B3E9DFD17CF864D552E03445A7D3133C
http://cd#.####rantispyware.com/sascomponents/A01D955E1485454B56413CC4C40F547F
http://cd#.####rantispyware.com/sascomponents/35DA92670C06C15CF6F5C10708788554
http://cd#.####rantispyware.com/sascomponents/981716D86BA53B87F9A4B9F837FC60C4
http://cd#.####rantispyware.com/sascomponents/4D0DD97C0AB63C0D72A895B4DB8B0553
http://cd#.####rantispyware.com/sascomponents/3497C5E00ECD5FDB728E9B5093E2B831
http://cd#.####rantispyware.com/sascomponents/5302D99FB38DE4318738BE8EB5504695
http://cd#.####rantispyware.com/sascomponents/98E06CAC2C508118450095E581202230
http://cd#.####rantispyware.com/sascomponents/3289766038DB2CB14D07DC84392138D5
http://cd#.####rantispyware.com/sascomponents/58A38E75F3316A83C23DF6173D41F2B5
http://cd#.####rantispyware.com/sascomponents/2640B083BB33CC6095CB0E6E2F8ACC98
http://cd#.####rantispyware.com/sascomponents/99851AEF40CCC89527358327FA3AC645
http://cd#.####rantispyware.com/sascomponents/BB572C1A4A0963E317CAF54E72F0B84C
http://cd#.####rantispyware.com/sascomponents/EFC9EA7AA080142234062F49C1ED2AA0
http://cd#.####rantispyware.com/sascomponents/A48BBF8AA311F6FBCA3D36E2FFFC88E2
http://cd#.####rantispyware.com/appdata/sas/public/20000002.XML
http://cd#.####rantispyware.com/appdata/sas/public/new.16113.SAS