LoxoScam
Copyright © MegaSecurity
By ?
Informations
| Author | ? |
| Family | LoxoScam |
| Category | Remote Access |
| Version | LoxoScam |
| Language | Delphi |
Additional Information
dropped files:
c:\WINDOWS\Extrac32.hlp Size: 451.072 bytes
c:\WINDOWS\sys.bat Size: 274 bytes
c:\WINDOWS\SystemDll.exe Size: 451.072 bytes
changed file:
c:\AUTOEXEC.BAT
startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices "SystemDll"
data: SystemDll.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "LoadPowerProfile"
old data: Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
new data: Rundll.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices "LoadPowerProfile"
old data: Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
new data: Rundll.exe powrprof.dll,LoadCurrentPwrScheme
tested on Windows 98
May 05, 2005If you recognize any personal information on this page and wish to have it removed or redacted, please contact us at jplesueur@phrozen.io. We are committed to protecting your privacy in accordance with GDPR regulations.