Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\asos1
Modifies file system
Creates the following files
- %TEMP%\unpack1.log
- %TEMP%\splashtop\sos\launcher.txt
- %TEMP%\unpacksos\1\$dpx$.tmp\8e7d1b7c3edb284e9fea1bb7c5fc5106.tmp
- %TEMP%\unpacksos\1\$dpx$.tmp\1e6db7492b694c42bdd4909b84163bb1.tmp
- %TEMP%\unpacksos\1\$dpx$.tmp\893c46469247aa43901aad3e5017c0e4.tmp
- %TEMP%\unpacksos\1\$dpx$.tmp\d7a927f07f6bf144809f8b824f8741a7.tmp
- %TEMP%\unpacksos\1\$dpx$.tmp\f3c34ff53240ed4fae0caee458633456.tmp
- %TEMP%\unpacksos\1\$dpx$.tmp\d9414c6a08a458489c7fe358bc51c5ef.tmp
- %TEMP%\unpacksos\1\$dpx$.tmp\5f1231f080622843b1cef6f0b64933c8.tmp
- %TEMP%\unpacksos\1\$dpx$.tmp\f802fa99af0ca543b6b507aa1e9c5e09.tmp
- %TEMP%\unpacksos\1\$dpx$.tmp\706095f4dcb81a4d85ead5897d7b5e4d.tmp
- %TEMP%\unpacksos\1\$dpx$.tmp\03197bfca116cc48b44831c11e2583fa.tmp
- %TEMP%\unpacksos\1\$dpx$.tmp\227ebdf4c2258f44a8bb01f10899f4b9.tmp
- %TEMP%\unpacksos\1\$dpx$.tmp\efe4748a4d1b8247a1bf889664706d58.tmp
- %TEMP%\unpacksos\1\$dpx$.tmp\852c61cca107284b970e06c41e334c42.tmp
- %TEMP%\unpacksos\1\$dpx$.tmp\14f6a09d0fe995419aac8ee6d7a937be.tmp
- %TEMP%\unpacksos\1\$dpx$.tmp\ef72936b17b32a409f3399ff73fa2403.tmp
- %TEMP%\unpacksos\1\$dpx$.tmp\25a447fd0267ee48afcc7db9218d727b.tmp
- %TEMP%\unpacksos\1\$dpx$.tmp\2bf5efc6315f6149829c34b042bee537.tmp
- %TEMP%\unpacksos\1\$dpx$.tmp\5fa9b94b9fd4c64ab98d68592ad41801.tmp
- %TEMP%\unpacksos\1\default.sostheme
- %TEMP%\unpacksos\1\streamer1.cab
- %TEMP%\splashtop\sos\01_sysinfo.txt
- %TEMP%\splashtop\sos\01_splog.txt
Deletes the following files
- <SYSTEM32>\tasks\asos1
Moves the following files
- from %TEMP%\unpacksos\1\$dpx$.tmp\5fa9b94b9fd4c64ab98d68592ad41801.tmp to %TEMP%\unpacksos\1\acknowledgements.htm
- from %TEMP%\unpacksos\1\$dpx$.tmp\893c46469247aa43901aad3e5017c0e4.tmp to %TEMP%\unpacksos\1\p_unmount.bat
- from %TEMP%\unpacksos\1\$dpx$.tmp\d7a927f07f6bf144809f8b824f8741a7.tmp to %TEMP%\unpacksos\1\p_mount.bat
- from %TEMP%\unpacksos\1\$dpx$.tmp\f3c34ff53240ed4fae0caee458633456.tmp to %TEMP%\unpacksos\1\asos.xml
- from %TEMP%\unpacksos\1\$dpx$.tmp\d9414c6a08a458489c7fe358bc51c5ef.tmp to %TEMP%\unpacksos\1\srx264wrapper.dll
- from %TEMP%\unpacksos\1\$dpx$.tmp\5f1231f080622843b1cef6f0b64933c8.tmp to %TEMP%\unpacksos\1\srserver.pem
- from %TEMP%\unpacksos\1\$dpx$.tmp\f802fa99af0ca543b6b507aa1e9c5e09.tmp to %TEMP%\unpacksos\1\srserversos.exe
- from %TEMP%\unpacksos\1\$dpx$.tmp\706095f4dcb81a4d85ead5897d7b5e4d.tmp to %TEMP%\unpacksos\1\srmanagersos.exe
- from %TEMP%\unpacksos\1\$dpx$.tmp\03197bfca116cc48b44831c11e2583fa.tmp to %TEMP%\unpacksos\1\srfeaturesosnouia.exe
- from %TEMP%\unpacksos\1\$dpx$.tmp\227ebdf4c2258f44a8bb01f10899f4b9.tmp to %TEMP%\unpacksos\1\srfeaturesos.exe
- from %TEMP%\unpacksos\1\$dpx$.tmp\efe4748a4d1b8247a1bf889664706d58.tmp to %TEMP%\unpacksos\1\srchatsos.exe
- from %TEMP%\unpacksos\1\$dpx$.tmp\852c61cca107284b970e06c41e334c42.tmp to %TEMP%\unpacksos\1\srclient.pem
- from %TEMP%\unpacksos\1\$dpx$.tmp\14f6a09d0fe995419aac8ee6d7a937be.tmp to %TEMP%\unpacksos\1\launcher.exe
- from %TEMP%\unpacksos\1\$dpx$.tmp\ef72936b17b32a409f3399ff73fa2403.tmp to %TEMP%\unpacksos\1\libx264-116.dll
- from %TEMP%\unpacksos\1\$dpx$.tmp\25a447fd0267ee48afcc7db9218d727b.tmp to %TEMP%\unpacksos\1\libcelt-0.dll
- from %TEMP%\unpacksos\1\$dpx$.tmp\2bf5efc6315f6149829c34b042bee537.tmp to %TEMP%\unpacksos\1\dbghelp.dll
- from %TEMP%\unpacksos\1\$dpx$.tmp\1e6db7492b694c42bdd4909b84163bb1.tmp to %TEMP%\unpacksos\1\stprinter.cat
- from %TEMP%\unpacksos\1\$dpx$.tmp\8e7d1b7c3edb284e9fea1bb7c5fc5106.tmp to %TEMP%\unpacksos\1\stprinter.inf
Network activity
TCP
HTTP GET requests
- http://st#####dc.splashtop.com/api/fulong
UDP
- DNS ASK st##########s-win-3180.api.splashtop.com
- DNS ASK st#####dc.splashtop.com
- DNS ASK st###########os-srs-win-3180.api.splashtop.com
- DNS ASK 35########-107.relay.splashtop.com
Miscellaneous
Creates and executes the following
- '%TEMP%\unpacksos\1\launcher.exe' SRManagerSOS.exe 1
- '%TEMP%\unpacksos\1\srmanagersos.exe'
- '%TEMP%\unpacksos\1\srserversos.exe' -s
- '%TEMP%\unpacksos\1\srfeaturesos.exe'
- '<SYSTEM32>\cmd.exe' /c expand *.cab /f:* .\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /create /xml ASOS.xml /ru "system" /tn ASOS1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /change /tn ASOS1 /ru "system" /tr "'%TEMP%\unpacksos\1\\Launcher.exe' SRManagerSOS.exe 1 "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /run /tn ASOS1' (with hidden window)
- '%TEMP%\unpacksos\1\launcher.exe' SRManagerSOS.exe 1' (with hidden window)
- '%TEMP%\unpacksos\1\srmanagersos.exe' ' (with hidden window)
- '%TEMP%\unpacksos\1\srfeaturesos.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /delete /f /tn ASOS1' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c expand *.cab /f:* .\
- '<SYSTEM32>\expand.exe' *.cab /f:* .\
- '<SYSTEM32>\cmd.exe' /c schtasks /create /xml ASOS.xml /ru "system" /tn ASOS1
- '<SYSTEM32>\schtasks.exe' /create /xml ASOS.xml /ru "system" /tn ASOS1
- '<SYSTEM32>\cmd.exe' /c schtasks /change /tn ASOS1 /ru "system" /tr "'%TEMP%\unpacksos\1\\Launcher.exe' SRManagerSOS.exe 1 "
- '<SYSTEM32>\schtasks.exe' /change /tn ASOS1 /ru "system" /tr "'%TEMP%\unpacksos\1\\Launcher.exe' SRManagerSOS.exe 1 "
- '<SYSTEM32>\cmd.exe' /c schtasks /run /tn ASOS1
- '<SYSTEM32>\schtasks.exe' /run /tn ASOS1
- '<SYSTEM32>\cmd.exe' /c schtasks /delete /f /tn ASOS1
- '<SYSTEM32>\schtasks.exe' /delete /f /tn ASOS1
