Pardillo

Released 22 years, 11 months ago. December 2001

Copyright © MegaSecurity

By kidarcade (?)


Informations
Author kidarcade (?)
Family Pardillo
Category Remote Access
Version Pardillo
Released Date Dec 2001, 22 years, 11 months ago.
Additional Information
added:
HKEY_CLASSES_ROOT\htafile "NeverShowExt" 
HKEY_CLASSES_ROOT\htafile\DefaultIcon "(Default)" 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "EnableAutodial" 


added files:
c:\WINDOWS\$.tmp 
c:\WINDOWS\COMMAND.PIF 
c:\WINDOWS\update.bat 
c:\WINDOWS\Wininit.ini 

remark:
By visiting a prepared webpage a VBScript is executed.
This script does add values to the registry and does create and execute a bat file.
This bat file does start ftp.exe with the commands -v -i -n -s:%windir%\$.tmp.
$.temp contains the commands to  download  a file named 1.exe from ip 213.97.168.232 and execute it.

If you recognize any personal information on this page and wish to have it removed or redacted, please contact us at jplesueur@phrozen.io. We are committed to protecting your privacy in accordance with GDPR regulations.