Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '00000000'
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- %TEMP%\aut3a6.tmp
- C:\webtmp\webprint.txt
- %LOCALAPPDATA%\microsoft\credentials\50966d5bbf97f553215e272c9480a3e5
- %HOMEPATH%\rdp6\mypdfprinting\clientenvironment.ini
- %HOMEPATH%\rdp6\tscredentials.exe
- %TEMP%\aut1346.tmp
- %HOMEPATH%\rdp6\bkgscpink.bmp
- %TEMP%\aut620.tmp
- %HOMEPATH%\rdp6\bkgscgreen.bmp
- %TEMP%\aut610.tmp
- %HOMEPATH%\rdp6\bkgscblue.bmp
- %TEMP%\aut5f0.tmp
- C:\webtmp\alreadyopen.ini
- %HOMEPATH%\rdp6\bkgsc.bmp
- %HOMEPATH%\rdp6\ico2.ico
- %TEMP%\aut522.tmp
- %HOMEPATH%\rdp6\languk.ini
- %TEMP%\aut502.tmp
- %HOMEPATH%\rdp6\connectionclient.exe
- %TEMP%\aut436.tmp
- %HOMEPATH%\rdp6\<File name>.txt
- %TEMP%\aut416.tmp
- %HOMEPATH%\rdp6\mstsc.exe
- %TEMP%\aut3e6.tmp
- %HOMEPATH%\rdp6\mstscax.dll
- %TEMP%\aut5df.tmp
- %HOMEPATH%\rdp6\mypdfprinting\alreadyprinted.ini
Deletes the following files
- %TEMP%\aut3a6.tmp
- %HOMEPATH%\rdp6\mypdfprinting\clientenvironment.ini
- C:\webtmp\webprint.txt
- %LOCALAPPDATA%\microsoft\credentials\50966d5bbf97f553215e272c9480a3e5
- %HOMEPATH%\rdp6\bkgsc.bmp
- %TEMP%\aut1346.tmp
- %TEMP%\aut620.tmp
- %HOMEPATH%\rdp6\mypdfprinting\alreadyprinted.ini
- %TEMP%\aut610.tmp
- %TEMP%\aut5df.tmp
- %TEMP%\aut522.tmp
- %TEMP%\aut502.tmp
- %TEMP%\aut436.tmp
- %TEMP%\aut416.tmp
- %TEMP%\aut3e6.tmp
- %TEMP%\aut5f0.tmp
- C:\webtmp\alreadyopen.ini
Substitutes the following files
- %HOMEPATH%\rdp6\bkgsc.bmp
Network activity
Connects to
- '25.##.233.104':3389
Miscellaneous
Creates and executes the following
- '%HOMEPATH%\rdp6\connectionclient.exe' -server 25.73.233.104 -user kosevo2 -psw kosevo2k2 -domain dzks -alttab 0 -printer off -com off -smartcard off -preview on -remoteapp off -seamless on -wallp green -disk on -usb on -directx on ...
- '%HOMEPATH%\rdp6\tscredentials.exe' ##.##.###.### /######
- '%HOMEPATH%\rdp6\tscredentials.exe' ##.##.###.### "####\#######" #########
- '%HOMEPATH%\rdp6\tscredentials.exe' ##.##.###.### /######' (with hidden window)
- '%HOMEPATH%\rdp6\tscredentials.exe' ##.##.###.### "####\#######" #########' (with hidden window)
