Pardillo
Released 22 years, 9 months ago. December 2001
Copyright © MegaSecurity
By kidarcade (?)
Informations
| Author | kidarcade (?) |
| Family | Pardillo |
| Category | Remote Access |
| Version | Pardillo |
| Released Date | Dec 2001, 22 years, 9 months ago. |
Additional Information
added:
HKEY_CLASSES_ROOT\htafile "NeverShowExt"
HKEY_CLASSES_ROOT\htafile\DefaultIcon "(Default)"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "EnableAutodial"
added files:
c:\WINDOWS\$.tmp
c:\WINDOWS\COMMAND.PIF
c:\WINDOWS\update.bat
c:\WINDOWS\Wininit.ini
remark:
By visiting a prepared webpage a VBScript is executed.
This script does add values to the registry and does create and execute a bat file.
This bat file does start ftp.exe with the commands -v -i -n -s:%windir%\$.tmp.
$.temp contains the commands to download a file named 1.exe from ip 213.97.168.232 and execute it.If you recognize any personal information on this page and wish to have it removed or redacted, please contact us at jplesueur@phrozen.io. We are committed to protecting your privacy in accordance with GDPR regulations.