HackTool.MSIL.SharpStay.A

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It does not have any information-stealing capability.

Arrival Details

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagation

This Hacking Tool does not have any propagation routine.

Backdoor Routine

This Hacking Tool does not have any backdoor routine.

Rootkit Capabilities

This Hacking Tool does not have rootkit capabilities.

Information Theft

This Hacking Tool does not have any information-stealing capability.

Other Details

This Hacking Tool accepts the following parameters:

• [action=ElevatedRegistryKey] [keyname={name of the key}] [keypath={Registry Key Path}] [command={Registry value}] → Adds a registry key that requires elevated privileges.
• [action=UserRegistryKey] [keyname={name of the key}] [keypath={Registry Key Path}] [command={Registry value}] → Adds a registry key for the current user.
• [action=UserInitMprLogonScriptKey] [command={File Path}] → Sets a logon script.
• [action=ElevatedUserInitKey] [command={File Path}] → Sets a logon script that requires elevated privileges.
• [action=ScheduledTask] [taskname={Task Name}] [command={File Path}] [runasuser={username}] [triggertype=logon] [author={author}] [description={description}] [logonuser={username}] → Creates a scheduled task.
• [action=ScheduledTaskAction] [taskname={Task Name}] [command={File Path}] [folder={directory}] [actionid={actionid}] → Adds an action to an existing scheduled task.
• [action=SchTaskCOMHijack] [clsid={CLSID}] [dllpath={DLL file path}] → Hijacks a COM handler for a scheduled task.
• [action=CreateService] [servicename={Service Name}] [command={File Path}] → Creates a new service.
• [action=WMIEventSub] [command={File Path}] [eventname={Event Name}] [attime=startup] → Sets up a WMI event.
• [action=JunctionFolder] [dllpath={DLL file path}] [guid={GUID}] → Creates a junction folder.
• [action=NewLNK] [filepath={File Path}] [lnkname={LNK File Name}] [lnktarget={File Path}] [lnkicon={Icon File Path}] → Creates a new shortcut (LNK file).
• [action=BackdoorLNK] [command={File Path}] [lnkpath={File Path}] → Creates a backdoor shortcut.
• action=ListTaskNames → Lists the names of scheduled tasks.
• action=ListScheduledTasks → Lists all scheduled tasks.
• action=ListRunningServices → Lists all running services.
• action=GetScheduledTaskCOMHandler → Retrieves COM handlers for scheduled tasks.

NOTES:

It does not exploit any vulnerability.