Attachments
(934.53 KiB) Downloaded 49 times
Last edited by EP_X0FF on Sat Jan 08, 2011 5:31 am, edited 1 time in total.
Reason: thread renamed to be more descriptive
Files:
* System32\sysanalizer\dll.exe (copy of original file)
* System32\sysanalizer\logs.dat
* System32\sysanalizer\plugin.dat
Reg Start:
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{J5TI3541-8564-5174-YJ71-14T58LY72400}
* StubPath = "C:\Windows\System32\sysanalizer\dll.exe Restart"
Injects code into Internet Explorer and calls home.
Units used:
WinSvc
System
SysInit
KWindows
UTypes
BUnitTranslations
UnitVariables
UnitCryptString
uRC4
kRC4
Utils
TlHelp32
EditSvr
UnitServices
UnitSandBox
DLLUnit
UnitInjectLibrary
