Trojan.KeyLogger.38116

Technical Information

Malicious functions:

Executes the following:

'<SYSTEM32>\regsvr32.exe' atl.dll /s

Installs hooks to intercept notifications

on keystrokes:

Handler for all processes: <Current directory>\cfgdll.dll

Modifies file system:

Creates the following files:

<Current directory>\coc\67.bmp
<Current directory>\coc\68.bmp
<Current directory>\coc\65.bmp
<Current directory>\coc\66.bmp
<Current directory>\coc\71.bmp
<Current directory>\coc\72.bmp
<Current directory>\coc\69.bmp
<Current directory>\coc\70.bmp
<Current directory>\coc\64.bmp
<Current directory>\coc\58.bmp
<Current directory>\coc\59.bmp
<Current directory>\coc\56.bmp
<Current directory>\coc\57.bmp
<Current directory>\coc\62.bmp
<Current directory>\coc\63.bmp
<Current directory>\coc\60.bmp
<Current directory>\coc\61.bmp
<Current directory>\coc\73.bmp
<Current directory>\coc\83(1).bmp
<Current directory>\coc\83.bmp
<Current directory>\coc\82.bmp
<Current directory>\coc\82-2.bmp
<Current directory>\coc\85.bmp
<Current directory>\coc\86.bmp
<Current directory>\coc\83-2.bmp
<Current directory>\coc\84.bmp
<Current directory>\coc\82(1).bmp
<Current directory>\coc\76.bmp
<Current directory>\coc\77.bmp
<Current directory>\coc\74.bmp
<Current directory>\coc\75.bmp
<Current directory>\coc\80.bmp
<Current directory>\coc\81.bmp
<Current directory>\coc\78.bmp
<Current directory>\coc\79.bmp
<Current directory>\coc\55.bmp
<Current directory>\coc\31.bmp
<Current directory>\coc\32.bmp
<Current directory>\coc\29.bmp
<Current directory>\coc\30.bmp
<Current directory>\coc\35.bmp
<Current directory>\coc\36.bmp
<Current directory>\coc\33.bmp
<Current directory>\coc\34.bmp
<Current directory>\coc\28.bmp
<Current directory>\coc\24.bmp
<Current directory>\coc\25.bmp
<Current directory>\coc\22.bmp
<Current directory>\coc\23.bmp
<Current directory>\coc\26-2.bmp
<Current directory>\coc\27.bmp
<Current directory>\coc\26.bmp
<Current directory>\coc\26-1.bmp
<Current directory>\coc\37.bmp
<Current directory>\coc\49.bmp
<Current directory>\coc\50.bmp
<Current directory>\coc\47.bmp
<Current directory>\coc\48.bmp
<Current directory>\coc\53.bmp
<Current directory>\coc\54.bmp
<Current directory>\coc\51.bmp
<Current directory>\coc\52.bmp
<Current directory>\coc\46.bmp
<Current directory>\coc\40.bmp
<Current directory>\coc\41.bmp
<Current directory>\coc\38.bmp
<Current directory>\coc\39.bmp
<Current directory>\coc\44.bmp
<Current directory>\coc\45.bmp
<Current directory>\coc\42.bmp
<Current directory>\coc\43.bmp
<Current directory>\coc\87.bmp
<Current directory>\coc\abz_4.bmp
<Current directory>\coc\abz_5.bmp
<Current directory>\coc\abz_2.bmp
<Current directory>\coc\abz_3.bmp
<Current directory>\coc\abz_8.bmp
<Current directory>\coc\abz_9.bmp
<Current directory>\coc\abz_6.bmp
<Current directory>\coc\abz_7.bmp
<Current directory>\coc\abz_1.bmp
<Current directory>\coc\360gg.bmp
<Current directory>\coc\360µЇґ°.bmp
<Current directory>\coc\203.bmp
<Current directory>\coc\204.bmp
<Current directory>\coc\926bsЖф¶Ї.bmp
<Current directory>\coc\926bsЖф¶Ї1.bmp
<Current directory>\coc\360µЇґ°јУ1.bmp
<Current directory>\coc\360µЗВј.bmp
<Current directory>\coc\abz_a.bmp
<Current directory>\coc\bsЦШЖф11.bmp
<Current directory>\coc\bsЦШЖф111.bmp
<Current directory>\coc\BSЦШЖф.bmp
<Current directory>\coc\bsЦШЖф1.bmp
<Current directory>\coc\bug1.bmp
<Current directory>\coc\bug2.bmp
<Current directory>\coc\bsЦШЖф1111.bmp
<Current directory>\coc\BSЦШЖфН·Пс1.bmp
<Current directory>\coc\bsЙѕіэ.bmp
<Current directory>\coc\bbz_3.bmp
<Current directory>\coc\bbz_4.bmp
<Current directory>\coc\bbz_1.bmp
<Current directory>\coc\bbz_2.bmp
<Current directory>\coc\bsqdtj.bmp
<Current directory>\coc\bsЖф¶Ї1213.bmp
<Current directory>\coc\bbz_5.bmp
<Current directory>\coc\bbz_6.bmp
<Current directory>\coc\202.bmp
<Current directory>\coc\99.bmp
<Current directory>\coc\100.bmp
<Current directory>\coc\97.bmp
<Current directory>\coc\98.bmp
<Current directory>\coc\103.bmp
<Current directory>\coc\104.bmp
<Current directory>\coc\101.bmp
<Current directory>\coc\102.bmp
<Current directory>\coc\96.bmp
<Current directory>\coc\90.bmp
<Current directory>\coc\91.bmp
<Current directory>\coc\88.bmp
<Current directory>\coc\89.bmp
<Current directory>\coc\94.bmp
<Current directory>\coc\95.bmp
<Current directory>\coc\92.bmp
<Current directory>\coc\93.bmp
<Current directory>\coc\105.bmp
<Current directory>\coc\117.bmp
<Current directory>\coc\118.bmp
<Current directory>\coc\115.bmp
<Current directory>\coc\116.bmp
<Current directory>\coc\121.bmp
<Current directory>\coc\201.bmp
<Current directory>\coc\119.bmp
<Current directory>\coc\120.bmp
<Current directory>\coc\114.bmp
<Current directory>\coc\108.bmp
<Current directory>\coc\109.bmp
<Current directory>\coc\106.bmp
<Current directory>\coc\107.bmp
<Current directory>\coc\112.bmp
<Current directory>\coc\113.bmp
<Current directory>\coc\110.bmp
<Current directory>\coc\111.bmp
<Current directory>\coc\21.bmp
<Current directory>\coc\3guohuo.bmp
<Current directory>\coc\4.bmp
<Current directory>\coc\2.bmp
<Current directory>\coc\3.bmp
<Current directory>\coc\4guohuo.bmp
<Current directory>\coc\4guohuo2.bmp
<Current directory>\coc\4-6±ѕЙП.bmp
<Current directory>\coc\4-6±ѕПВ.bmp
<Current directory>\coc\1.bmp
<Current directory>\coc\НіјЖ.txt
<Current directory>\coc\ПкЗйЧЦМе.txt
<Current directory>\coc\ЛСУгЧЦїв.txt
<Current directory>\coc\НЁУГ.txt
<Current directory>\coc\Фм±ш.txt
<Current directory>\coc\ХЅ№ыЧЦїв.txt
<Current directory>\coc\Р§ВК.txt
<Current directory>\coc\РЕПў.txt
<Current directory>\coc\5.bmp
<Current directory>\coc\7±ѕ-1.bmp
<Current directory>\coc\7±ѕ-2.bmp
<Current directory>\coc\7b-4.bmp
<Current directory>\coc\7guohuo.bmp
<Current directory>\coc\7Л®.bmp
<Current directory>\coc\08bsЖф¶Ї3.bmp
<Current directory>\coc\7±ѕЙП.bmp
<Current directory>\coc\7±ѕПВ.bmp
<Current directory>\coc\7b-3.bmp
<Current directory>\coc\6b-1.bmp
<Current directory>\coc\6guohuo.bmp
<Current directory>\coc\5guohuo.bmp
<Current directory>\coc\6.bmp
<Current directory>\coc\7b-1.bmp
<Current directory>\coc\7b-2.bmp
<Current directory>\coc\6ј¶БЄГЛ±ш.bmp
<Current directory>\coc\7.bmp
<Current directory>\coc\ЛСУг.txt
<Current directory>\ShieldModule.dat
%APPDATA%\mymacro\qdisp.dll
%TEMP%\BackGround.bmp
<Current directory>\cfgdll.dll
%APPDATA%\qmacro\shield\SD000.dat
%APPDATA%\qmacro\shield\SD001.dat
%TEMP%\2453.tmp
<Current directory>\<Virus name>.ini
%TEMP%\mymacro.zip
%TEMP%\mac2.tmp.Qtmp
%TEMP%\plugin.zip
%TEMP%\mymacro_errinfo.exe
%TEMP%\mac1.tmp
<Current directory>\plugin\WINDOW.DLL
<Current directory>\plugin\FILE.DLL
<Current directory>\plugin\SYS.DLL
<Current directory>\plugin\REGDLL.DLL
%APPDATA%\qmacro\shield\SD002.dat
<Current directory>\coc\єЛРД.txt
<Current directory>\coc\јУЛЩ.txt
<Current directory>\coc\·Е±ш.txt
<Current directory>\coc\ёЯј¶.txt
<Current directory>\coc\ѕи±шЧЦїв.txt
<Current directory>\coc\Йэј¶.txt
<Current directory>\coc\јаїШ.txt
<Current directory>\coc\ѕи±ш.txt
<Current directory>\coc\µ±З°ЧКФґ.txt
%APPDATA%\qmacro\shield\Shield.ini
<Current directory>\plugin\SYS.ini
%APPDATA%\qmacro\shield\SD003.dat
%APPDATA%\qmacro\shield\SD004.dat
<Current directory>\coc\±шУЄ.txt
<Current directory>\coc\ґтУг.txt
<Current directory>\coc\±.txt
<Current directory>\coc\±шБ¦.txt
<Current directory>\coc\08bsЙѕіэ1.bmp
<Current directory>\coc\10±ѕПВ.bmp
<Current directory>\coc\10Л®.bmp
<Current directory>\coc\10±ѕ-4.bmp
<Current directory>\coc\10±ѕЙП.bmp
<Current directory>\coc\11Л®.bmp
<Current directory>\coc\11Л®1.bmp
<Current directory>\coc\11.bmp
<Current directory>\coc\11fen.bmp
<Current directory>\coc\10±ѕ-3.bmp
<Current directory>\coc\10b-2.bmp
<Current directory>\coc\10b-3.bmp
<Current directory>\coc\10.bmp
<Current directory>\coc\10b-1.bmp
<Current directory>\coc\10±ѕ-1.bmp
<Current directory>\coc\10±ѕ-2.bmp
<Current directory>\coc\10b-4.bmp
<Current directory>\coc\10fen.bmp
<Current directory>\coc\11Л®И«Въ.bmp
<Current directory>\coc\16-4.bmp
<Current directory>\coc\17.bmp
<Current directory>\coc\16.bmp
<Current directory>\coc\16-3.bmp
<Current directory>\coc\19-1.bmp
<Current directory>\coc\20.bmp
<Current directory>\coc\18.bmp
<Current directory>\coc\19.bmp
<Current directory>\coc\15-1.bmp
<Current directory>\coc\12Л®.bmp
<Current directory>\coc\12Л®1.bmp
<Current directory>\coc\12.bmp
<Current directory>\coc\12fen.bmp
<Current directory>\coc\14.bmp
<Current directory>\coc\15.bmp
<Current directory>\coc\12Л®2.bmp
<Current directory>\coc\13.bmp
<Current directory>\coc\9Л®1.bmp
<Current directory>\coc\8±ѕПВ.bmp
<Current directory>\coc\8Л®.bmp
<Current directory>\coc\8±ѕ-3.bmp
<Current directory>\coc\8±ѕЙП.bmp
<Current directory>\coc\09BSЖф¶Ї11.bmp
<Current directory>\coc\09BSЖф¶Ї12.bmp
<Current directory>\coc\8Л®-1.bmp
<Current directory>\coc\09bsbaikuang.bmp
<Current directory>\coc\8±ѕ-2.bmp
<Current directory>\coc\8b-1.bmp
<Current directory>\coc\8b-2.bmp
<Current directory>\coc\08bsЙѕіэ2.bmp
<Current directory>\coc\8.bmp
<Current directory>\coc\8guohuo.bmp
<Current directory>\coc\8±ѕ-1.bmp
<Current directory>\coc\8b-3.bmp
<Current directory>\coc\8fen.bmp
<Current directory>\coc\09bsЦШЖф1.bmp
<Current directory>\coc\9±ѕ-6.bmp
<Current directory>\coc\9±ѕ-7.bmp
<Current directory>\coc\9±ѕ-4.bmp
<Current directory>\coc\9±ѕ-5.bmp
<Current directory>\coc\9·ЁК¦Лю.bmp
<Current directory>\coc\9Л®.bmp
<Current directory>\coc\9±ѕЙП.bmp
<Current directory>\coc\9±ѕПВ.bmp
<Current directory>\coc\9±ѕ-3.bmp
<Current directory>\coc\9b-2.bmp
<Current directory>\coc\9bsЙѕіэ.bmp
<Current directory>\coc\9.bmp
<Current directory>\coc\9b-1.bmp
<Current directory>\coc\9±ѕ-1.bmp
<Current directory>\coc\9±ѕ-2.bmp
<Current directory>\coc\9bsЙѕіэ2.bmp
<Current directory>\coc\9fen.bmp

Deletes the following files:

<Current directory>\ShieldModule.dat
%TEMP%\mymacro.zip
%TEMP%\plugin.zip

Moves the following files:

from %TEMP%\BackGround.bmp to %TEMP%\b34background.bmp

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial