Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrs.exe' = '%WINDIR%\csrs.exe'
Malicious functions
Searches for windows to
detect programs and games:
- ClassName: 'TibiaClient', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\stp.exe
- %TEMP%\ctfmoon.exe
- %WINDIR%\csrs.exe
- %WINDIR%\ctfmoon1.exe
Network activity
Connects to
- '18#.#65.245.114':80
TCP
HTTP GET requests
- http://www.ua####eylogger.pl/version.txt
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\stp.exe' -pxsw
- '%TEMP%\ctfmoon.exe'
- '%WINDIR%\ctfmoon1.exe'
