Technical Information
Modifies file system
Creates the following files
- %TEMP%\aut68e0.tmp
- %TEMP%\copytrading\copy\close.ico
- %TEMP%\aut8319.tmp
- %TEMP%\copytrading\copy\minimize.ico
- %TEMP%\aut8339.tmp
- %TEMP%\copytrading\copy\downline.png
- %TEMP%\aut8359.tmp
- %TEMP%\copytrading\copy\digifacewide regular.ttf
- %WINDIR%\fonts\digifacewide regular.ttf
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i6avs9q1\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\wtdi4dfz\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\gn1tmktp\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dtku1qjd\desktop.ini
- %APPDATA%\microsoft\windows\cookies\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022070220220703\index.dat
- %APPDATA%\microsoft\windows\iecompatcache\index.dat
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\p4p79gg0\103.92.25[1].xml
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\antiphishing\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\a1jwu4pl\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\y0xk3g5r\desktop.ini
- %TEMP%\aut82f8.tmp
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\2fftezcb\desktop.ini
- %TEMP%\copytrading\gold.png
- %TEMP%\copytrading\red.png
- <Current directory>\fai.ico
- %HOMEPATH%\desktop\f.a.i.copytrading.lnk
- <Current directory>\f.a.i.copytrading.lnk
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\4ccqlhop\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\9b8n49ua\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\5gjk09qo\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hl8z2xb8\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %TEMP%\aut82a6.tmp
- %TEMP%\copytrading\green.png
- %TEMP%\aut82b7.tmp
- %TEMP%\copytrading\null.png
- %TEMP%\aut82b8.tmp
- %TEMP%\aut82c9.tmp
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\gw8ozj0f\desktop.ini
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\y0xk3g5r\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\a1jwu4pl\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %APPDATA%\microsoft\windows\cookies\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dtku1qjd\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\gn1tmktp\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\2fftezcb\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\wtdi4dfz\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hl8z2xb8\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\5gjk09qo\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\9b8n49ua\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\4ccqlhop\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i6avs9q1\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\gw8ozj0f\desktop.ini
Deletes the following files
- %TEMP%\aut68e0.tmp
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i6avs9q1\style[1].css
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i6avs9q1\format[1].css
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i6avs9q1\css[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i6avs9q1\bootstrap.min[1].css
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i6avs9q1\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\gn1tmktp\bootstrap.min[1].js
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\gn1tmktp\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dtku1qjd\logo-login[1].png
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dtku1qjd\bg-blue[1].png
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dtku1qjd\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022070220220703\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\autobot_copytrade[1].txt
- %TEMP%\aut8359.tmp
- %TEMP%\aut8339.tmp
- %TEMP%\aut8319.tmp
- %TEMP%\aut82f8.tmp
- %TEMP%\aut82c9.tmp
- %TEMP%\aut82b8.tmp
- %TEMP%\aut82b7.tmp
- %TEMP%\aut82a6.tmp
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\wtdi4dfz\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\wtdi4dfz\jquery-1.10.2[1].js
Modifies the following files
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Windows\<INETFILES>\Content.IE5\desktop.ini
- %LOCALAPPDATA%\Microsoft\Windows\History\History.IE5\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022070220220703\index.dat
Network activity
Connects to
- '10#.#2.25.90':80
TCP
HTTP GET requests
- http://10#.#2.25.90/TOOL/AutoBot_CopyTrade.txt
- http://10#.#2.25.90/CopyTrading.html
- http://10#.#2.25.90/CopyTrading/css
- http://10#.#2.25.90/CopyTrading/format.css
- http://10#.#2.25.90/CopyTrading/bootstrap.min.css
- http://10#.#2.25.90/CopyTrading/style.css
- http://10#.#2.25.90/CopyTrading/jquery-1.10.2.js
- http://10#.#2.25.90/fonts/glyphicons-halflings-regular.eot?
- http://10#.#2.25.90/CopyTrading/bootstrap.min.js
- http://10#.#2.25.90/CopyTrading/phone.png
- http://10#.#2.25.90/CopyTrading/logo-login.png
- http://10#.#2.25.90/CopyTrading/images/bg-blue.png
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8' (with hidden window)
Executes the following
- '<SYSTEM32>\rundll32.exe' "<SYSTEM32>\WININET.dll",DispatchAPICall 1
- '<SYSTEM32>\cmd.exe' /C RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255
- '<SYSTEM32>\rundll32.exe' InetCpl.cpl,ClearMyTracksByProcess 255
- '%ProgramFiles%\internet explorer\iexplore.exe' -ResetDestinationList
- '<SYSTEM32>\cmd.exe' /C RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1
- '<SYSTEM32>\cmd.exe' /C RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8
- '<SYSTEM32>\rundll32.exe' InetCpl.cpl,ClearMyTracksByProcess 1
- '<SYSTEM32>\rundll32.exe' InetCpl.cpl,ClearMyTracksByProcess 8
