Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\Microsoft Update.lnk
Malicious functions:
Creates and executes the following:
- '%TEMP%\PQRKGT.exe'
Modifies file system:
Creates the following files:
- <LS_APPDATA>\DonationCoder_ScreenshotCaptor_InstallInfo.dat
- <SYSTEM32>\DonationCoder_ScreenshotCaptor_InstallInfo.dat
- %TEMP%\DonationCoder_ScreenshotCaptor_InstallInfo.dat
- %APPDATA%\DonationCoder\Keys\DonationCoder_ScreenshotCaptor_InstallInfo.dat
- %ALLUSERSPROFILE%\Application Data\DonationCoder\DcUpdater\RedirectFiles\ScreenshotCaptor.dcupdateredirect
- %TEMP%\bqcqlsz
- %TEMP%\aut1.tmp
- %TEMP%\PQRKGT.exe
- %TEMP%\aut2.tmp
Deletes the following files:
- %TEMP%\aut2.tmp
- %TEMP%\bqcqlsz
- %TEMP%\aut1.tmp
Network activity:
Connects to:
- 'os####ker.hopto.org':81
UDP:
- DNS ASK os####ker.hopto.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
