Win32/Escad

Installation

This threat can install itself to the following files on your PC:

• %TEMP% \install-sunny-leone-ii-screensaver.exe
• <system folder> \netmonsvc.dll
• <system folder> \rdmgr.dll
• <system folder> \remoteevtmanager.dll
• <system folder> \winsec.dll

It also installs the following configuration files:

• <system folder> \ansi.nls
• \dayipmr.tbl <system folder>
• <system folder> \pmsconfig.msi
• <system folder> \tmscompg.msi
• <system folder> \tlvc.nls

It can be registered as a service with any of the following service names:

• Service name: LocalMonNetwork
   
  In subkey: HKLM\SYSTEM\CurrentControlSet\Services\NetMonSvc\Parameters
  Sets value: "ServiceDll"
  With data: "<system folder>\netmonsvc.dll"
   
  In subkey: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Svchost
  Sets value: "LocalMonNetwork"
  With data: "netmonsvc"
  
• Service name: Windows Security
   
  In subkey: HKLM\SYSTEM\ControlSet001\Services\Windows Security\Parameters
  Sets value: "ServiceDll"
  With data: "%SystemRoot%\system32\winsec.dll"
   
  In subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
  Sets value: "Windows Security"
  With data: "windows security"
   
• Service name: rdsessionmgr
   
  In subkey: HKLM\SYSTEM\ControlSet001\Services\RDSessionMgr\Parameters
  Sets value: "ServiceDll"
  With data: "%SystemRoot%\system32\rdmgr.dll"
   
  In subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
  Sets value: "RDSessionMgr"
  With data: "rdsessionmgr"

Payload

Allows backdoor access and control

This threat can give a malicious hacker access and control of your PC. They can then perform a number of different actions, including:

• Acting as a proxy server
• Copying files and sending them to a remote IP address
• Downloading files remotely into the infected system
• Enumerating files in any folder
• Gathering machine information, such as your PC name, TCP connections, free disk space, and network adapter information
• Modifying firewall settings
• Modifying your IP settings 

Analysis by Marianne Mallen