Trojan.DownLoader30.3275

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'StartCatMr' = '"%ProgramFiles%\MOTEX\LanScope Cat MR\Startmr.exe"'

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\LSPSERVICE_MR] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\LSPSERVICE_MR] 'ImagePath' = '%ProgramFiles%\MOTEX\LanScope Cat MR\LspSrvAny.exe'
[<HKLM>\SYSTEM\CurrentControlSet\Services\LSPSERVICE_MR] 'ImagePath' = '"%ProgramFiles%\MOTEX\LanScope Cat MR\LspSrvAny.exe"'
[<HKLM>\SYSTEM\CurrentControlSet\Services\Cdrom] 'Start' = '00000001'

Malicious functions

To bypass firewall, removes or modifies the following registry keys

[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\MOTEX\LanScope Cat MR\Lspcmr.exe' = '%ProgramFiles%\M...
[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\MOTEX\LanScope Cat MR\Lspcmr.exe' = '%ProgramFiles%...

Executes the following

'<SYSTEM32>\netsh.exe' firewall add allowedprogram program = "%ProgramFiles%\MOTEX\LanScope Cat MR\Lspcmr.exe" name = "LanScope Cat MR" profile = ALL

Modifies file system

Creates the following files

%TEMP%\mrinst_decmp_utf8.log
%ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_alzlog_mr_0000.ini
%ProgramFiles%\motex\lanscope cat mr\_nicinfo.txt
nul
%ProgramFiles%\motex\lanscope cat mr\_netsh.bat
%TEMP%\mrinst_mr_utf8.log
%TEMP%\mrinst_start_utf8.log
%WINDIR%\setmr.exe
%WINDIR%\mru.ini
%TEMP%\mrinst_set_utf8.log
%TEMP%\templspcat\mr.ini
%TEMP%\templspcat\mrconf.ini
%TEMP%\templspcat\spflog.dll
%ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_forbidap_mr_0000.ini
%TEMP%\templspcat\setmr.exe
%TEMP%\templspcat\msg
%TEMP%\templspcat\lspweb64.dll
%TEMP%\templspcat\lspweb.dll
%TEMP%\templspcat\lspwaomozilla.sf
%TEMP%\templspcat\lspwaomozilla.rsa
%TEMP%\templspcat\lspwaomanifest.mf
%TEMP%\templspcat\lspwaoinstall.rdf
%TEMP%\templspcat\lspwaoie.dll
%TEMP%\templspcat\lspwaoicon64.png
%TEMP%\templspcat\startmr.exe
%TEMP%\templspcat\lspmladdin2x86.msi
%ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_prnlog_mr_0000.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\analyzelog\20190809\lspalz_utf8_0000.txt
%ProgramFiles%\motex\lanscope cat mr\tracelog\cdv_20190809_utf8.txt
%ProgramFiles%\motex\lanscope cat mr\locallog\uno_lonloflog_mr.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\uno_devlog_mr.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\uno_walog_mr.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\uno_eventmr_mr.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\uno_prnlog_mr.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\uno_forbidap_mr.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\uno_aptsk_mr.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_ddllog_mr_0000.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_cdlrlylog_mr_0000.ini
%TEMP%\templspcat\lspwaoicon48.png
%ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_aptsk_mr_0000.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_wualog_mr_0000.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\ontimestamp_utf8.txt
%ProgramFiles%\motex\lanscope cat mr\locallog\lontimestamp_utf8.txt
%ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_smllog_ev_0000.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_itclog_ev_0000.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_walog_ev_0000.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_eventmr_ev_0000.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_thrlog_mr_0000.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_cdvlog_mr_0000.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_lonloflog_mr_0000.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_devlog_mr_0000.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_invalmlog_mr_0000.ini
%ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_eventmr_mr_0000.ini
%TEMP%\templspcat\lspwaogctomr.json
%TEMP%\templspcat\lspwaogctomr.exe
%TEMP%\templspcat\lspwaoff.xul
%TEMP%\templspcat\dwfi6891_x86.sys
%TEMP%\templspcat\lspcuninst.exe.manifest
%TEMP%\templspcat\lspcuninst.exe
%TEMP%\templspcat\lspcfm.exe
%TEMP%\templspcat\lspcdw.dll
%TEMP%\templspcat\lspbits.exe
%TEMP%\templspcat\lspbho64.dll
%TEMP%\templspcat\lspbho.dll
%TEMP%\templspcat\dwpd6891_x86.sys
%TEMP%\templspcat\dwpd6891_x64.sys
%TEMP%\templspcat\dwpd6891_1607_x86.sys
%ProgramFiles%\motex\mrscripts\getpatch.vbs
%TEMP%\templspcat\lspdnd.dll
%TEMP%\templspcat\dwfi6891_x64.sys
%TEMP%\templspcat\dwfi6891_1607_x86.sys
%TEMP%\templspcat\dwfi6891_1607_x64.sys
%TEMP%\templspcat\dwco6891_x86.sys
%TEMP%\templspcat\dwco6891_x64.sys
%TEMP%\templspcat\dwco6891_1607_x86.sys
%TEMP%\templspcat\dwco6891_1607_x64.sys
%TEMP%\templspcat\dsofile.dll
%TEMP%\templspcat\cmr.exe
%TEMP%\templspcat\4theyesdk6891.dll
%TEMP%\templspcat\$
%TEMP%\templspcat\dwpd6891_1607_x64.sys
%ProgramFiles%\motex\lanscope cat mr\locallog\0000\uno_cdllog_mr_0000.ini
%TEMP%\templspcat\lspdnd64.dll
%TEMP%\templspcat\lspfilter_2k.sys
%TEMP%\templspcat\lspevmon.exe
%TEMP%\templspcat\lspwaoff.js
%TEMP%\templspcat\lspwaoconfig.cfg
%TEMP%\templspcat\lspwaochrome.manifest
%TEMP%\templspcat\lsputil.dll
%TEMP%\templspcat\lspstop.exe
%TEMP%\templspcat\lspsrvany.exe
%TEMP%\templspcat\lsprelay.exe
%TEMP%\templspcat\lspquest.exe
%TEMP%\templspcat\lspoffdevq.exe
%TEMP%\templspcat\lspoffdev.exe
%TEMP%\templspcat\lspevmon64.exe
%TEMP%\templspcat\lspmladdin4x86.msi
%TEMP%\templspcat\lspdevconf.exe
%TEMP%\templspcat\lspmladdin2x64.msi
%TEMP%\templspcat\lsphook64.dll
%TEMP%\templspcat\lsphook.dll
%TEMP%\templspcat\lspfilter_xp.sys
%TEMP%\templspcat\lspfilter_win7_x64.sys
%TEMP%\templspcat\lspfilter_win7.sys
%TEMP%\templspcat\lspfilter_vista_x64.sys
%TEMP%\templspcat\lspfilter_vista.sys
%TEMP%\templspcat\lspfilter_2k3_x64.sys
%TEMP%\templspcat\lspfilter_2k3.sys
%TEMP%\templspcat\lspmladdin4x64.msi
%ProgramFiles%\motex\mrscripts\_patchlist.txt

Sets the 'hidden' attribute to the following files

%WINDIR%\mru.ini

Deletes the following files

%ProgramFiles%\motex\lanscope cat mr\_netsh.bat
%ProgramFiles%\motex\lanscope cat mr\nicinfo.txt
%ProgramFiles%\motex\mrscripts\patchlist.txt
%ProgramFiles%\motex\mrscripts\getpatch.vbs

Moves the following files

from %TEMP%\templspcat\$ to %WINDIR%\templspcatmr\$
from %WINDIR%\templspcatmr\lspcdw.dll to %ProgramFiles%\motex\lanscope cat mr\lspcdw.dll
from %WINDIR%\templspcatmr\lspcfm.exe to %ProgramFiles%\motex\lanscope cat mr\lspcfm.exe
from %WINDIR%\templspcatmr\lspcuninst.exe to %ProgramFiles%\motex\lanscope cat mr\lspcuninst.exe
from %WINDIR%\templspcatmr\lspcuninst.exe.manifest to %ProgramFiles%\motex\lanscope cat mr\lspcuninst.exe.manifest
from %WINDIR%\templspcatmr\lspdevconf.exe to %ProgramFiles%\motex\lanscope cat mr\lspdevconf.exe
from %WINDIR%\templspcatmr\lspdnd.dll to %ProgramFiles%\motex\lanscope cat mr\lspdnd.dll
from %WINDIR%\templspcatmr\lspevmon.exe to %ProgramFiles%\motex\lanscope cat mr\lspevmon.exe
from %WINDIR%\templspcatmr\dwfi6891_1607_x86.sys to %ProgramFiles%\motex\lanscope cat mr\dwfi6891_1607_x86.sys
from %WINDIR%\templspcatmr\lspevmon64.exe to %ProgramFiles%\motex\lanscope cat mr\lspevmon64.exe
from %WINDIR%\templspcatmr\lspfilter_2k.sys to %ProgramFiles%\motex\lanscope cat mr\lspfilter_2k.sys
from %WINDIR%\templspcatmr\lspfilter_2k3.sys to %ProgramFiles%\motex\lanscope cat mr\lspfilter_2k3.sys
from %WINDIR%\templspcatmr\lspfilter_2k3_x64.sys to %ProgramFiles%\motex\lanscope cat mr\lspfilter_2k3_x64.sys
from %WINDIR%\templspcatmr\lspfilter_vista.sys to %ProgramFiles%\motex\lanscope cat mr\lspfilter_vista.sys
from %WINDIR%\templspcatmr\lspfilter_vista_x64.sys to %ProgramFiles%\motex\lanscope cat mr\lspfilter_vista_x64.sys
from %WINDIR%\templspcatmr\lspbits.exe to %ProgramFiles%\motex\lanscope cat mr\lspbits.exe
from %WINDIR%\templspcatmr\lspbho64.dll to %ProgramFiles%\motex\lanscope cat mr\lspbho64.dll
from %WINDIR%\templspcatmr\lspbho.dll to %ProgramFiles%\motex\lanscope cat mr\lspbho.dll
from %WINDIR%\templspcatmr\dwpd6891_x86.sys to %ProgramFiles%\motex\lanscope cat mr\dwpd6891_x86.sys
from %WINDIR%\templspcatmr\dwpd6891_x64.sys to %ProgramFiles%\motex\lanscope cat mr\dwpd6891_x64.sys
from %WINDIR%\templspcatmr\dwpd6891_1607_x86.sys to %ProgramFiles%\motex\lanscope cat mr\dwpd6891_1607_x86.sys
from %WINDIR%\templspcatmr\dwpd6891_1607_x64.sys to %ProgramFiles%\motex\lanscope cat mr\dwpd6891_1607_x64.sys
from %WINDIR%\templspcatmr\dwfi6891_x86.sys to %ProgramFiles%\motex\lanscope cat mr\dwfi6891_x86.sys
from %WINDIR%\templspcatmr\dwfi6891_x64.sys to %ProgramFiles%\motex\lanscope cat mr\dwfi6891_x64.sys
from %WINDIR%\templspcatmr\lspdnd64.dll to %ProgramFiles%\motex\lanscope cat mr\lspdnd64.dll
from %WINDIR%\templspcatmr\dwfi6891_1607_x64.sys to %ProgramFiles%\motex\lanscope cat mr\dwfi6891_1607_x64.sys
from %WINDIR%\templspcatmr\dwco6891_x86.sys to %ProgramFiles%\motex\lanscope cat mr\dwco6891_x86.sys
from %WINDIR%\templspcatmr\dwco6891_x64.sys to %ProgramFiles%\motex\lanscope cat mr\dwco6891_x64.sys
from %WINDIR%\templspcatmr\dwco6891_1607_x86.sys to %ProgramFiles%\motex\lanscope cat mr\dwco6891_1607_x86.sys
from %WINDIR%\templspcatmr\dwco6891_1607_x64.sys to %ProgramFiles%\motex\lanscope cat mr\dwco6891_1607_x64.sys
from %WINDIR%\templspcatmr\dsofile.dll to %ProgramFiles%\motex\lanscope cat mr\dsofile.dll
from %WINDIR%\templspcatmr\cmr.exe to %ProgramFiles%\motex\lanscope cat mr\cmr.exe
from %WINDIR%\templspcatmr\lspfilter_win7.sys to %ProgramFiles%\motex\lanscope cat mr\lspfilter_win7.sys
from %WINDIR%\templspcatmr\lspquest.exe to %ProgramFiles%\motex\lanscope cat mr\lspquest.exe
from %ProgramFiles%\motex\lanscope cat mr\_nicinfo.txt to %ProgramFiles%\motex\lanscope cat mr\nicinfo.txt
from %WINDIR%\templspcatmr\lsphook.dll to %ProgramFiles%\motex\lanscope cat mr\lsphook.dll
from %WINDIR%\templspcatmr\lspwaogctomr.json to %ProgramFiles%\motex\lanscope cat mr\lspwaogctomr.json
from %WINDIR%\templspcatmr\lspwaoicon48.png to %ProgramFiles%\motex\lanscope cat mr\lspwaoicon48.png
from %WINDIR%\templspcatmr\lspwaoicon64.png to %ProgramFiles%\motex\lanscope cat mr\lspwaoicon64.png
from %WINDIR%\templspcatmr\lspwaoie.dll to %ProgramFiles%\motex\lanscope cat mr\lspwaoie.dll
from %WINDIR%\templspcatmr\lspwaoinstall.rdf to %ProgramFiles%\motex\lanscope cat mr\lspwaoinstall.rdf
from %WINDIR%\templspcatmr\lspwaomanifest.mf to %ProgramFiles%\motex\lanscope cat mr\lspwaomanifest.mf
from %WINDIR%\templspcatmr\lspwaomozilla.sf to %ProgramFiles%\motex\lanscope cat mr\lspwaomozilla.sf
from %WINDIR%\templspcatmr\lspfilter_win7_x64.sys to %ProgramFiles%\motex\lanscope cat mr\lspfilter_win7_x64.sys
from %WINDIR%\templspcatmr\lspweb.dll to %ProgramFiles%\motex\lanscope cat mr\lspweb.dll
from %WINDIR%\templspcatmr\lspweb64.dll to %ProgramFiles%\motex\lanscope cat mr\lspweb64.dll
from %WINDIR%\templspcatmr\spflog.dll to %ProgramFiles%\motex\lanscope cat mr\spflog.dll
from %WINDIR%\templspcatmr\startmr.exe to %ProgramFiles%\motex\lanscope cat mr\startmr.exe
from %WINDIR%\templspcatmr\mrconf.ini to %ProgramFiles%\motex\lanscope cat mr\mrconf.ini
from %ProgramFiles%\motex\lanscope cat mr\cmr.exe to %ProgramFiles%\motex\lanscope cat mr\lspcmr.exe
from %WINDIR%\templspcatmr\lspwaogctomr.exe to %ProgramFiles%\motex\lanscope cat mr\lspwaogctomr.exe
from %WINDIR%\templspcatmr\lspwaoff.xul to %ProgramFiles%\motex\lanscope cat mr\lspwaoff.xul
from %WINDIR%\templspcatmr\lspwaoff.js to %ProgramFiles%\motex\lanscope cat mr\lspwaoff.js
from %WINDIR%\templspcatmr\lspwaoconfig.cfg to %ProgramFiles%\motex\lanscope cat mr\lspwaoconfig.cfg
from %WINDIR%\templspcatmr\lspwaochrome.manifest to %ProgramFiles%\motex\lanscope cat mr\lspwaochrome.manifest
from %WINDIR%\templspcatmr\lsputil.dll to %ProgramFiles%\motex\lanscope cat mr\lsputil.dll
from %WINDIR%\templspcatmr\lspstop.exe to %ProgramFiles%\motex\lanscope cat mr\lspstop.exe
from %WINDIR%\templspcatmr\lspsrvany.exe to %ProgramFiles%\motex\lanscope cat mr\lspsrvany.exe
from %WINDIR%\templspcatmr\lsprelay.exe to %ProgramFiles%\motex\lanscope cat mr\lsprelay.exe
from %WINDIR%\templspcatmr\4theyesdk6891.dll to %ProgramFiles%\motex\lanscope cat mr\4theyesdk6891.dll
from %WINDIR%\templspcatmr\lspoffdevq.exe to %ProgramFiles%\motex\lanscope cat mr\lspoffdevq.exe
from %WINDIR%\templspcatmr\lspoffdev.exe to %ProgramFiles%\motex\lanscope cat mr\lspoffdev.exe
from %WINDIR%\templspcatmr\lspmladdin4x86.msi to %ProgramFiles%\motex\lanscope cat mr\lspmladdin4x86.msi
from %WINDIR%\templspcatmr\lspmladdin4x64.msi to %ProgramFiles%\motex\lanscope cat mr\lspmladdin4x64.msi
from %WINDIR%\templspcatmr\lspmladdin2x86.msi to %ProgramFiles%\motex\lanscope cat mr\lspmladdin2x86.msi
from %WINDIR%\templspcatmr\lspmladdin2x64.msi to %ProgramFiles%\motex\lanscope cat mr\lspmladdin2x64.msi
from %WINDIR%\templspcatmr\lsphook64.dll to %ProgramFiles%\motex\lanscope cat mr\lsphook64.dll
from %WINDIR%\templspcatmr\lspfilter_xp.sys to %ProgramFiles%\motex\lanscope cat mr\lspfilter_xp.sys
from %WINDIR%\templspcatmr\lspwaomozilla.rsa to %ProgramFiles%\motex\lanscope cat mr\lspwaomozilla.rsa
from %TEMP%\templspcat\startmr.exe to %WINDIR%\templspcatmr\startmr.exe
from %TEMP%\templspcat\lspwaomanifest.mf to %WINDIR%\templspcatmr\lspwaomanifest.mf
from %TEMP%\templspcat\lspbits.exe to %WINDIR%\templspcatmr\lspbits.exe
from %TEMP%\templspcat\lspcdw.dll to %WINDIR%\templspcatmr\lspcdw.dll
from %TEMP%\templspcat\lspcfm.exe to %WINDIR%\templspcatmr\lspcfm.exe
from %TEMP%\templspcat\lspcuninst.exe to %WINDIR%\templspcatmr\lspcuninst.exe
from %TEMP%\templspcat\lspcuninst.exe.manifest to %WINDIR%\templspcatmr\lspcuninst.exe.manifest
from %TEMP%\templspcat\lspdevconf.exe to %WINDIR%\templspcatmr\lspdevconf.exe
from %TEMP%\templspcat\lspdnd64.dll to %WINDIR%\templspcatmr\lspdnd64.dll
from %TEMP%\templspcat\dwfi6891_1607_x64.sys to %WINDIR%\templspcatmr\dwfi6891_1607_x64.sys
from %TEMP%\templspcat\lspevmon.exe to %WINDIR%\templspcatmr\lspevmon.exe
from %TEMP%\templspcat\lspevmon64.exe to %WINDIR%\templspcatmr\lspevmon64.exe
from %TEMP%\templspcat\lspfilter_2k.sys to %WINDIR%\templspcatmr\lspfilter_2k.sys
from %TEMP%\templspcat\lspfilter_2k3.sys to %WINDIR%\templspcatmr\lspfilter_2k3.sys
from %TEMP%\templspcat\lspfilter_2k3_x64.sys to %WINDIR%\templspcatmr\lspfilter_2k3_x64.sys
from %TEMP%\templspcat\lspfilter_vista.sys to %WINDIR%\templspcatmr\lspfilter_vista.sys
from %TEMP%\templspcat\lspbho64.dll to %WINDIR%\templspcatmr\lspbho64.dll
from %TEMP%\templspcat\lspbho.dll to %WINDIR%\templspcatmr\lspbho.dll
from %TEMP%\templspcat\dwpd6891_x86.sys to %WINDIR%\templspcatmr\dwpd6891_x86.sys
from %TEMP%\templspcat\dwpd6891_x64.sys to %WINDIR%\templspcatmr\dwpd6891_x64.sys
from %TEMP%\templspcat\dwpd6891_1607_x86.sys to %WINDIR%\templspcatmr\dwpd6891_1607_x86.sys
from %TEMP%\templspcat\dwpd6891_1607_x64.sys to %WINDIR%\templspcatmr\dwpd6891_1607_x64.sys
from %TEMP%\templspcat\dwfi6891_x86.sys to %WINDIR%\templspcatmr\dwfi6891_x86.sys
from %TEMP%\templspcat\dwfi6891_x64.sys to %WINDIR%\templspcatmr\dwfi6891_x64.sys
from %TEMP%\templspcat\dwfi6891_1607_x86.sys to %WINDIR%\templspcatmr\dwfi6891_1607_x86.sys
from %TEMP%\templspcat\lspdnd.dll to %WINDIR%\templspcatmr\lspdnd.dll
from %TEMP%\templspcat\dwco6891_x86.sys to %WINDIR%\templspcatmr\dwco6891_x86.sys
from %TEMP%\templspcat\dwco6891_x64.sys to %WINDIR%\templspcatmr\dwco6891_x64.sys
from %TEMP%\templspcat\dwco6891_1607_x86.sys to %WINDIR%\templspcatmr\dwco6891_1607_x86.sys
from %TEMP%\templspcat\dwco6891_1607_x64.sys to %WINDIR%\templspcatmr\dwco6891_1607_x64.sys
from %TEMP%\templspcat\dsofile.dll to %WINDIR%\templspcatmr\dsofile.dll
from %TEMP%\templspcat\cmr.exe to %WINDIR%\templspcatmr\cmr.exe
from %TEMP%\templspcat\4theyesdk6891.dll to %WINDIR%\templspcatmr\4theyesdk6891.dll
from %TEMP%\templspcat\lspfilter_vista_x64.sys to %WINDIR%\templspcatmr\lspfilter_vista_x64.sys
from %TEMP%\templspcat\lspoffdevq.exe to %WINDIR%\templspcatmr\lspoffdevq.exe
from %TEMP%\templspcat\setmr.exe to %WINDIR%\templspcatmr\setmr.exe
from %TEMP%\templspcat\lspfilter_xp.sys to %WINDIR%\templspcatmr\lspfilter_xp.sys
from %TEMP%\templspcat\lspwaogctomr.exe to %WINDIR%\templspcatmr\lspwaogctomr.exe
from %TEMP%\templspcat\lspwaogctomr.json to %WINDIR%\templspcatmr\lspwaogctomr.json
from %TEMP%\templspcat\lspwaoicon48.png to %WINDIR%\templspcatmr\lspwaoicon48.png
from %TEMP%\templspcat\lspwaoicon64.png to %WINDIR%\templspcatmr\lspwaoicon64.png
from %TEMP%\templspcat\lspwaoie.dll to %WINDIR%\templspcatmr\lspwaoie.dll
from %TEMP%\templspcat\lspwaoinstall.rdf to %WINDIR%\templspcatmr\lspwaoinstall.rdf
from %TEMP%\templspcat\lspwaomozilla.rsa to %WINDIR%\templspcatmr\lspwaomozilla.rsa
from %TEMP%\templspcat\lspfilter_win7.sys to %WINDIR%\templspcatmr\lspfilter_win7.sys
from %TEMP%\templspcat\lspwaomozilla.sf to %WINDIR%\templspcatmr\lspwaomozilla.sf
from %TEMP%\templspcat\lspweb.dll to %WINDIR%\templspcatmr\lspweb.dll
from %TEMP%\templspcat\lspweb64.dll to %WINDIR%\templspcatmr\lspweb64.dll
from %TEMP%\templspcat\mr.ini to %WINDIR%\templspcatmr\mr.ini
from %TEMP%\templspcat\mrconf.ini to %WINDIR%\templspcatmr\mrconf.ini
from %TEMP%\templspcat\msg to %WINDIR%\templspcatmr\msg
from %TEMP%\templspcat\lspwaoff.xul to %WINDIR%\templspcatmr\lspwaoff.xul
from %TEMP%\templspcat\lspwaoff.js to %WINDIR%\templspcatmr\lspwaoff.js
from %TEMP%\templspcat\lspwaoconfig.cfg to %WINDIR%\templspcatmr\lspwaoconfig.cfg
from %TEMP%\templspcat\lspwaochrome.manifest to %WINDIR%\templspcatmr\lspwaochrome.manifest
from %TEMP%\templspcat\lsputil.dll to %WINDIR%\templspcatmr\lsputil.dll
from %TEMP%\templspcat\lspstop.exe to %WINDIR%\templspcatmr\lspstop.exe
from %TEMP%\templspcat\lspsrvany.exe to %WINDIR%\templspcatmr\lspsrvany.exe
from %TEMP%\templspcat\lsprelay.exe to %WINDIR%\templspcatmr\lsprelay.exe
from %TEMP%\templspcat\lspquest.exe to %WINDIR%\templspcatmr\lspquest.exe
from %TEMP%\templspcat\spflog.dll to %WINDIR%\templspcatmr\spflog.dll
from %TEMP%\templspcat\lspoffdev.exe to %WINDIR%\templspcatmr\lspoffdev.exe
from %TEMP%\templspcat\lspmladdin4x86.msi to %WINDIR%\templspcatmr\lspmladdin4x86.msi
from %TEMP%\templspcat\lspmladdin4x64.msi to %WINDIR%\templspcatmr\lspmladdin4x64.msi
from %TEMP%\templspcat\lspmladdin2x86.msi to %WINDIR%\templspcatmr\lspmladdin2x86.msi
from %TEMP%\templspcat\lspmladdin2x64.msi to %WINDIR%\templspcatmr\lspmladdin2x64.msi
from %TEMP%\templspcat\lsphook64.dll to %WINDIR%\templspcatmr\lsphook64.dll
from %TEMP%\templspcat\lsphook.dll to %WINDIR%\templspcatmr\lsphook.dll
from %TEMP%\templspcat\lspfilter_win7_x64.sys to %WINDIR%\templspcatmr\lspfilter_win7_x64.sys
from %ProgramFiles%\motex\mrscripts\_patchlist.txt to %ProgramFiles%\motex\mrscripts\patchlist.txt

Substitutes the following files

%ProgramFiles%\motex\lanscope cat mr\_nicinfo.txt
%ProgramFiles%\motex\lanscope cat mr\nicinfo.txt

Network activity

Connects to

'54.##8.226.187':38002

Miscellaneous

Searches for the following windows

ClassName: 'TMainForm' WindowName: 'LanScope Cat'

Creates and executes the following

'%WINDIR%\templspcatmr\setmr.exe' i smsg fmsg
'%ProgramFiles%\motex\lanscope cat mr\startmr.exe' smsg fmsg
'%ProgramFiles%\motex\lanscope cat mr\lspsrvany.exe' -Install /silent
'%ProgramFiles%\motex\lanscope cat mr\lspsrvany.exe'
'%ProgramFiles%\motex\lanscope cat mr\lspcmr.exe' smsg fmsg
'<SYSTEM32>\cscript.exe' "%ProgramFiles%\MOTEX\MRScripts\GetPatch.vbs"
'%ProgramFiles%\motex\lanscope cat mr\startmr.exe' smsg fmsg' (with hidden window)
'%ProgramFiles%\motex\lanscope cat mr\lspsrvany.exe' -Install /silent' (with hidden window)
'%ProgramFiles%\motex\lanscope cat mr\lspcmr.exe' smsg fmsg' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ipconfig /all >"%ProgramFiles%\MOTEX\lanscope cat mr\_NICInfo.txt"' (with hidden window)
'<SYSTEM32>\cscript.exe' "%ProgramFiles%\MOTEX\MRScripts\GetPatch.vbs"' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c "%ProgramFiles%\MOTEX\LanScope Cat MR\_netsh.bat"
'<SYSTEM32>\chcp.com' 65001
'<SYSTEM32>\ping.exe' localhost -n 2
'<SYSTEM32>\cmd.exe' /c ipconfig /all >"%ProgramFiles%\MOTEX\lanscope cat mr\_NICInfo.txt"
'<SYSTEM32>\ipconfig.exe' /all

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial