Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'PC Spy Keylogger' = '%ProgramFiles(x86)%\PSK\ToolKeylogger.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'PC Spy Keylogger' = '%ProgramFiles(x86)%\PSK\ToolKeylogger.exe'
Malicious functions
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: %ProgramFiles(x86)%\PSK\DLLs\ToolKeyloggerDLL.dll
on window messages:
- Handler for all processes: %ProgramFiles(x86)%\PSK\DLLs\ToolKeyloggerDLL.dll
Modifies file system
Creates the following files
- %TEMP%\7zs195a.tmp\x.bat
- %ProgramFiles(x86)%\psk\home.url
- %ProgramFiles(x86)%\psk\help.url
- %ProgramFiles(x86)%\psk\buy.url
- %ProgramFiles(x86)%\psk\unins000.dat
- %ProgramFiles(x86)%\psk\toolkeylogger.xml
- %ProgramFiles(x86)%\kops\probot.exe
- %ProgramFiles(x86)%\kops\msinet.ocx
- %ProgramFiles(x86)%\kops\mswinsck.ocx
- %ProgramFiles(x86)%\kops\tabctl32.ocx
- %ProgramFiles(x86)%\psk\data\toolkeylogger\backup\uninstall\backup.reg
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bg0n0zou\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\604pwz7f\dnserrordiagoff_weboc[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\q1e129qo\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dzhkzdlo\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bg0n0zou\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\604pwz7f\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\q1e129qo\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dzhkzdlo\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\q1e129qo\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dzhkzdlo\info_48[1]
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pc spy keylogger\purchase.lnk
- %HOMEPATH%\desktop\probot.exe.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pc spy keylogger\homepage.lnk
- %WINDIR%\syswow64\is-utmrr.tmp
- %TEMP%\7zs195a.tmp\game.exe
- %TEMP%\7zs195a.tmp\pc.exe
- %TEMP%\7zs195a.tmp\total.exe
- %TEMP%\is-5gfgv.tmp\is-24dif.tmp
- %TEMP%\is-d3vb1.tmp\_shfoldr.dll
- %ProgramFiles(x86)%\psk\is-70bhp.tmp
- %ProgramFiles(x86)%\psk\is-kj06r.tmp
- %ProgramFiles(x86)%\psk\is-k35gb.tmp
- %ProgramFiles(x86)%\psk\is-tqu17.tmp
- %WINDIR%\syswow64\xptoolslicensecomponent\is-uli06.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pc spy keylogger\pc spy keylogger.lnk
- %ProgramFiles(x86)%\psk\dlls\is-j5si3.tmp
- %ProgramFiles(x86)%\psk\dlls\is-9p7ot.tmp
- %ProgramFiles(x86)%\psk\dlls\is-2nnt6.tmp
- %ProgramFiles(x86)%\psk\images\is-5f8tr.tmp
- %ProgramFiles(x86)%\psk\images\is-gj7pf.tmp
- %ProgramFiles(x86)%\psk\images\is-1eqsp.tmp
- %ProgramFiles(x86)%\psk\images\is-q0ubh.tmp
- %ProgramFiles(x86)%\psk\images\is-gabcj.tmp
- %ProgramFiles(x86)%\psk\images\is-g2v67.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pc spy keylogger\help online.lnk
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
Deletes the following files
- %TEMP%\is-d3vb1.tmp\_shfoldr.dll
- %TEMP%\is-5gfgv.tmp\is-24dif.tmp
- %TEMP%\7zs195a.tmp\game.exe
- %TEMP%\7zs195a.tmp\pc.exe
- %TEMP%\7zs195a.tmp\total.exe
- %TEMP%\7zs195a.tmp\x.bat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\q1e129qo\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dzhkzdlo\errorpagestrings[1]
Moves the following files
- from %ProgramFiles(x86)%\psk\is-70bhp.tmp to %ProgramFiles(x86)%\psk\unins000.exe
- from %ProgramFiles(x86)%\psk\is-kj06r.tmp to %ProgramFiles(x86)%\psk\toolkeylogger.exe
- from %ProgramFiles(x86)%\psk\is-k35gb.tmp to %ProgramFiles(x86)%\psk\toolkeylogger.language
- from %ProgramFiles(x86)%\psk\is-tqu17.tmp to %ProgramFiles(x86)%\psk\toolkeylogger.xml
- from %WINDIR%\syswow64\is-utmrr.tmp to %WINDIR%\syswow64\gdiplus.dll
- from %WINDIR%\syswow64\xptoolslicensecomponent\is-uli06.tmp to %WINDIR%\syswow64\xptoolslicensecomponent\licensemanager.dll
- from %ProgramFiles(x86)%\psk\dlls\is-j5si3.tmp to %ProgramFiles(x86)%\psk\dlls\jmail.dll
- from %ProgramFiles(x86)%\psk\dlls\is-9p7ot.tmp to %ProgramFiles(x86)%\psk\dlls\toolkeyloggerdll.dll
- from %ProgramFiles(x86)%\psk\dlls\is-2nnt6.tmp to %ProgramFiles(x86)%\psk\dlls\toolkeyloggerdll.language
- from %ProgramFiles(x86)%\psk\images\is-5f8tr.tmp to %ProgramFiles(x86)%\psk\images\application.gif
- from %ProgramFiles(x86)%\psk\images\is-gj7pf.tmp to %ProgramFiles(x86)%\psk\images\blockexe.gif
- from %ProgramFiles(x86)%\psk\images\is-1eqsp.tmp to %ProgramFiles(x86)%\psk\images\clipboard.gif
- from %ProgramFiles(x86)%\psk\images\is-q0ubh.tmp to %ProgramFiles(x86)%\psk\images\keystroke.gif
- from %ProgramFiles(x86)%\psk\images\is-gabcj.tmp to %ProgramFiles(x86)%\psk\images\password.gif
- from %ProgramFiles(x86)%\psk\images\is-g2v67.tmp to %ProgramFiles(x86)%\psk\images\screen.gif
Network activity
UDP
- DNS ASK ko##.#lcazer.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\7zs195a.tmp\pc.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-5gfgv.tmp\is-24dif.tmp' /SL4 $B0180 "%TEMP%\7zS195A.tmp\pc.exe" 1294740 51712 /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\7zs195a.tmp\total.exe' /s
- '%ProgramFiles(x86)%\psk\toolkeylogger.exe'
- '%TEMP%\7zs195a.tmp\game.exe' /s
- '%ProgramFiles(x86)%\kops\probot.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c .\x.bat
- '%WINDIR%\syswow64\regsvr32.exe' /s TABCTL32.OCX
- '%WINDIR%\syswow64\regsvr32.exe' /s MSINET.OCX
- '%WINDIR%\syswow64\regsvr32.exe' /s MSWINSCK.OCX
- '%WINDIR%\syswow64\regedit.exe' /e "%ProgramFiles(x86)%\PSK\Data\ToolKeylogger\Backup\Uninstall\Backup.reg" "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\PC Spy Keylogger_is1"
- '%WINDIR%\syswow64\regsvr32.exe' /s TABCTL32.OCX' (with hidden window)
- '%WINDIR%\syswow64\regsvr32.exe' /s MSINET.OCX' (with hidden window)
- '%WINDIR%\syswow64\regsvr32.exe' /s MSWINSCK.OCX' (with hidden window)
