Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Control\SecurityProviders] 'SecurityProviders' = 'msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, credssp.dll'
- [<HKLM>\SYSTEM\ControlSet001\Control\Lsa] 'Security Packages' = 'kerberos\nmsv1_0\nschannel\nwdigest\ntspkg'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Executes the following:
- '%HOMEPATH%\RDP6\TsCredentials.exe' Server2008 UserOkw Qwerty1
- '%HOMEPATH%\RDP6\TsCredentials.exe' Server2008 /Delete
- '%HOMEPATH%\RDP6\ConnectionClient.exe' -server Server2008 -user UserOkw -psw Qwerty1 -color 32 -alttab 0 -printer on -com off -smartcard off -preview on -remoteapp on -seamless off -disk on -smartsizing 0 -localtb 32
Modifies file system:
Creates the following files:
- %HOMEPATH%\RDP6\bkgscpink.bmp
- %TEMP%\autB.tmp
- %HOMEPATH%\RDP6\TsCredentials.exe
- %TEMP%\autA.tmp
- %HOMEPATH%\RDP6\bkgscblue.bmp
- %TEMP%\aut9.tmp
- %HOMEPATH%\RDP6\bkgscgreen.bmp
- C:\webtmp\alreadyopen.ini
- %TEMP%\~DFFD4B.tmp
- %HOMEPATH%\RDP6\MyPDFprinting\alreadyprinted.ini
- C:\webtmp\webprint.txt
- %HOMEPATH%\RDP6\MyPDFprinting\clientenvironment.ini
- %APPDATA%\Microsoft\Protect\CREDHIST
- <LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\Credentials
- %TEMP%\aut8.tmp
- %TEMP%\aut3.tmp
- %HOMEPATH%\RDP6\<File name>.txt
- %TEMP%\aut4.tmp
- %HOMEPATH%\RDP6\mstsc.exe
- %TEMP%\aut1.tmp
- %HOMEPATH%\RDP6\mstscax.dll
- %TEMP%\aut2.tmp
- %HOMEPATH%\RDP6\ico2.ico
- %TEMP%\aut7.tmp
- %HOMEPATH%\RDP6\bkgsc.bmp
- %TEMP%\aut6.tmp
- %HOMEPATH%\RDP6\ConnectionClient.exe
- %TEMP%\aut5.tmp
- %HOMEPATH%\RDP6\languk.ini
Deletes the following files:
- %TEMP%\autA.tmp
- %TEMP%\aut9.tmp
- %TEMP%\aut8.tmp
- <LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\Credentials
- %HOMEPATH%\RDP6\bkgsc.bmp
- %TEMP%\autB.tmp
- %TEMP%\aut7.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut4.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
