TROJ_WATERTIGER-A.ZKGJ

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• %System Root%\Users\Public\Default20180309.log -> Contains execution logs

(Hinweis: %System Root% ist der Stammordner, normalerweise C:\. Dort befindet sich auch das Betriebssystem.)

Fügt die folgenden Prozesse hinzu:

• %ProgramData%\Intel\DAL\slmgr.exe

Andere Details

Es macht Folgendes:

• It searches for the file desktop.db in the following directories:
  • {malware directory}
  • %ProgramData%\Microsoft
  • %Windows%
  
  Failure to find the file desktop.db, it will search for files that match the regular-expression "*7???.*" in the following folders:
  • %System Root%\Users\Public\Documents
  • %ProgramData%\Microsoft
  • %Windows%
  
  Once found, it does the following:
  • Modify the file's timestamp based on the timestamp of the file %Windows%\notepad.exe
  • Read, Decrypt and Execute the contents of the file.

(Hinweis: %System Root% ist der Stammordner, normalerweise C:\. Dort befindet sich auch das Betriebssystem.)