TROJ_WATERTIGER-A.ZKGJ

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %System Root%\Users\Public\Default20180309.log -> Contains execution logs

(Nota: %System Root% es la carpeta raíz, normalmente C:\. También es la ubicación del sistema operativo).

Agrega los procesos siguientes:

• %ProgramData%\Intel\DAL\slmgr.exe

Otros detalles

Hace lo siguiente:

• It searches for the file desktop.db in the following directories:
  • {malware directory}
  • %ProgramData%\Microsoft
  • %Windows%
  
  Failure to find the file desktop.db, it will search for files that match the regular-expression "*7???.*" in the following folders:
  • %System Root%\Users\Public\Documents
  • %ProgramData%\Microsoft
  • %Windows%
  
  Once found, it does the following:
  • Modify the file's timestamp based on the timestamp of the file %Windows%\notepad.exe
  • Read, Decrypt and Execute the contents of the file.

(Nota: %System Root% es la carpeta raíz, normalmente C:\. También es la ubicación del sistema operativo).