Autoit Survey Winlocker

I found this while looking at the files that the barracuda http bots were downloading.

First screen
CPA gateway
The only survey leads to a parked domain, my computer is locked forever
The winlocker is coded in autoit, so I decompiled it to an autoit script here:
The important parts are the three html files dropped to the disk. I have uploaded them in a paste here:
The survey gateway info is here:

Sample is here

You can find a tutorial on decompiling to autoscript here.

Categories: Uncategorized