Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ElcomSoft Distributed Agent' = '"c:\Arquivos de programas\Adobe\Agent\esda.exe" -n'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\ElcomSoftDistributedAgent] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\ElcomSoftDistributedAgent] 'ImagePath' = 'c:\Arquivos de programas\Adobe\Agent\esda.exe'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] 'C:\Arquivos de programas\Adobe\Agent\esda.exe' = 'C:\Arquivos de progr...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] 'C:\Arquivos de programas\Adobe\Agent\esda.exe' = 'C:\Arquivos de program...
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram program="c:\Arquivos de programas\Adobe\Agent\esda.exe" name="ElcomSoft Distributed Agent" mode=enable profile=all
Modifies file system:
Creates the following files:
- %ProgramFiles%\ElcomSoft\Common Files\elcom_lang.xml
- %ProgramFiles%\ElcomSoft\Common Files\elcom_xml.dll
- %ProgramFiles%\ElcomSoft\Common Files\elcom_partners.exml
- %ProgramFiles%\ElcomSoft\Common Files\esprp.exe
- %ProgramFiles%\ElcomSoft\Common Files\hiderun.exe
- %ProgramFiles%\ElcomSoft\Common Files\espr_pgp.dll
- %ProgramFiles%\ElcomSoft\Common Files\espr_pfx.dll
- %ProgramFiles%\ElcomSoft\Common Files\espr_syskey.dll
- %ProgramFiles%\ElcomSoft\Common Files\elcom_reg.dll
- %ProgramFiles%\ElcomSoft\Common Files\espr_wpapsk.dll
- C:\Arquivos de programas\Adobe\Agent\doc\agent_russian.chm
- C:\Arquivos de programas\Adobe\Agent\doc\agent_german.chm
- C:\Arquivos de programas\Adobe\Agent\esda.log
- %ALLUSERSPROFILE%\Documents\ElcomSoft\Distributed Password Recovery\esda.log
- C:\Arquivos de programas\Adobe\Agent\uninstall.exe
- C:\Arquivos de programas\Adobe\Agent\language\esda_german.lng
- C:\Arquivos de programas\Adobe\Agent\language\esda_english.lng
- C:\Arquivos de programas\Adobe\Agent\language\esda_japanese.lng
- C:\Arquivos de programas\Adobe\Agent\doc\agent_english.chm
- C:\Arquivos de programas\Adobe\Agent\language\esda_russian.lng
- C:\Arquivos de programas\Adobe\Agent\icu_license.html
- C:\Arquivos de programas\Adobe\Agent\license.txt
- %ProgramFiles%\ElcomSoft\Common Files\esmtpsnd.exe
- %ProgramFiles%\ElcomSoft\Common Files\openipc.dll
- %ProgramFiles%\ElcomSoft\Common Files\esdprn.dll
- %TEMP%\RarSFX0\agent_setup.ini
- %TEMP%\RarSFX0\agent.exe
- %TEMP%\nsw2.tmp\System.dll
- C:\Arquivos de programas\Adobe\Agent\GPUManager.exe
- C:\Arquivos de programas\Adobe\Agent\esda.exe
- %ProgramFiles%\ElcomSoft\Common Files\espr_office.dll
- %ProgramFiles%\ElcomSoft\Common Files\espr_nt.dll
- %ProgramFiles%\ElcomSoft\Common Files\espr_opendoc.dll
- %ProgramFiles%\ElcomSoft\Common Files\espr_pdf.dll
- %ProgramFiles%\ElcomSoft\Common Files\espr_oracle.dll
- %ProgramFiles%\ElcomSoft\Common Files\espr_dcc.dll
- %ProgramFiles%\ElcomSoft\Common Files\espr_crypt.dll
- %ProgramFiles%\ElcomSoft\Common Files\espr_intuit.dll
- %ProgramFiles%\ElcomSoft\Common Files\espr_notes.dll
- %ProgramFiles%\ElcomSoft\Common Files\espr_md5.dll
Sets the 'hidden' attribute to the following files:
- %TEMP%\RarSFX0\agent_setup.ini
Deletes the following files:
- %TEMP%\RarSFX0\agent_setup.ini
- %TEMP%\RarSFX0\agent.exe
- %TEMP%\nsw2.tmp\System.dll
Network activity:
Connects to:
- 'se##.no-ip.org':12127
UDP:
- DNS ASK se##.no-ip.org
Miscellaneous:
Searches for the following windows:
- ClassName: '#32770' WindowName: 'Distributed Agent 2.71.195 Uninstall '
- ClassName: '#32770' WindowName: 'Distributed Agent 2.71.195 Uninstall'
- ClassName: '#32770' WindowName: 'Uninstall Distributed Agent 2.71.195'
- ClassName: 'ElcomSoftDistributedAgentWndClassName' WindowName: 'ElcomSoftDistributedAgentWndName'
- ClassName: '#32770' WindowName: 'Uninstall Distributed Agent 2.71.195 '
- ClassName: '#32770' WindowName: 'Setup Distributed Agent 2.71.195 '
- ClassName: '#32770' WindowName: 'Installer Language'
- ClassName: 'EDIT' WindowName: ''
- ClassName: '#32770' WindowName: 'Distributed Agent 2.71.195 Setup'
- ClassName: '#32770' WindowName: 'Setup Distributed Agent 2.71.195'
- ClassName: '#32770' WindowName: 'Distributed Agent 2.71.195 Setup '
Creates and executes the following:
- 'C:\Arquivos de programas\Adobe\Agent\esda.exe'
- '%ProgramFiles%\ElcomSoft\Common Files\esprp.exe' -name=espr_server_0
- '%ProgramFiles%\ElcomSoft\Common Files\esprp.exe' -name=espr_server_1
- 'C:\Arquivos de programas\Adobe\Agent\esda.exe' -s
- '%TEMP%\RarSFX0\agent.exe'
- 'C:\Arquivos de programas\Adobe\Agent\esda.exe' -srv
- '%ProgramFiles%\ElcomSoft\Common Files\hiderun.exe' netsh.exe firewall add allowedprogram program="c:\Arquivos de programas\Adobe\Agent\esda.exe" name="ElcomSoft Distributed Agent" mode=enable profile=all
