Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '00000000'
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- %TEMP%\aut20d8.tmp
- C:\webtmp\webprint.txt
- %LOCALAPPDATA%\microsoft\credentials\f0e6c632024a9aa4def19e0c4a57ed52
- %HOMEPATH%\rdp6\mypdfprinting\clientenvironment.ini
- %HOMEPATH%\rdp6\tscredentials.exe
- %TEMP%\aut2f11.tmp
- %HOMEPATH%\rdp6\bkgscpink.bmp
- %TEMP%\aut2296.tmp
- %HOMEPATH%\rdp6\bkgscgreen.bmp
- %TEMP%\aut2286.tmp
- %HOMEPATH%\rdp6\bkgscblue.bmp
- %TEMP%\aut2266.tmp
- C:\webtmp\alreadyopen.ini
- %HOMEPATH%\rdp6\bkgsc.bmp
- %HOMEPATH%\rdp6\ico2.ico
- %TEMP%\aut2244.tmp
- %HOMEPATH%\rdp6\languk.ini
- %TEMP%\aut2234.tmp
- %HOMEPATH%\rdp6\connectionclient.exe
- %TEMP%\aut2177.tmp
- %HOMEPATH%\rdp6\<File name>.txt
- %TEMP%\aut2157.tmp
- %HOMEPATH%\rdp6\mstsc.exe
- %TEMP%\aut2137.tmp
- %HOMEPATH%\rdp6\mstscax.dll
- %TEMP%\aut2265.tmp
- %HOMEPATH%\rdp6\mypdfprinting\alreadyprinted.ini
Deletes the following files
- %TEMP%\aut20d8.tmp
- %HOMEPATH%\rdp6\mypdfprinting\clientenvironment.ini
- C:\webtmp\webprint.txt
- %LOCALAPPDATA%\microsoft\credentials\f0e6c632024a9aa4def19e0c4a57ed52
- %HOMEPATH%\rdp6\bkgsc.bmp
- %TEMP%\aut2f11.tmp
- %TEMP%\aut2296.tmp
- %HOMEPATH%\rdp6\mypdfprinting\alreadyprinted.ini
- %TEMP%\aut2286.tmp
- %TEMP%\aut2265.tmp
- %TEMP%\aut2244.tmp
- %TEMP%\aut2234.tmp
- %TEMP%\aut2177.tmp
- %TEMP%\aut2157.tmp
- %TEMP%\aut2137.tmp
- %TEMP%\aut2266.tmp
- C:\webtmp\alreadyopen.ini
Substitutes the following files
- %HOMEPATH%\rdp6\bkgsc.bmp
Network activity
Connects to
- '20#.#7.95.238':3389
Miscellaneous
Creates and executes the following
- '%HOMEPATH%\rdp6\connectionclient.exe' -server 202.47.95.238 -user harders01 -psw Digerati1 -color 24 -alttab 0 -printer on -com off -smartcard off -preview on -remoteapp off -seamless on -wallp green -disk on -directx on -smartsizi...
- '%HOMEPATH%\rdp6\tscredentials.exe' ###.##.##.### /######
- '%HOMEPATH%\rdp6\tscredentials.exe' ###.##.##.### ######### #########
- '%HOMEPATH%\rdp6\tscredentials.exe' ###.##.##.### /######' (with hidden window)
- '%HOMEPATH%\rdp6\tscredentials.exe' ###.##.##.### ######### #########' (with hidden window)
