Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'zkBujohS' = '"<LS_APPDATA>\Microsoft\mfEhmvsZ.exe"'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\zkBujohS.lnk
Infects the following executable files:
- C:\Far2\Plugins\arclite\7zCon.sfx
- C:\Far2\Plugins\FTP\lib\ftpProgress.fll
- C:\Far2\Plugins\FTP\lib\ftpDirList.fll
- C:\Far2\Plugins\arclite\7zS2con.sfx
- C:\Far2\Plugins\arclite\7zS2.sfx
- C:\Far2\Plugins\arclite\7zSD.sfx
- C:\Far2\Plugins\arclite\7z.sfx
Malicious functions:
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Modifies file system:
Creates the following files:
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\316caa4ec95ef271e1191a8404c8acad_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\33d76ad2-2096-4b31-863f-01671097726a
- <LS_APPDATA>\Microsoft\mfEhmvsZ.exe
- %APPDATA%\Microsoft\Protect\CREDHIST
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d9f6c67dd28240b5a5de7fa4b29827e4_23ef5514-3059-436f-a4a7-4cefaab20eb1
Sets the 'hidden' attribute to the following files:
- %APPDATA%\Microsoft\Protect\CREDHIST!________GEKTORg@PROTONMAIL.COM________.GEXOGEN
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\33d76ad2-2096-4b31-863f-01671097726a!________GEKTORg@PROTONMAIL.COM________.GEXOGEN
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred!________GEKTORg@PROTONMAIL.COM________.GEXOGEN
- %APPDATA%\Microsoft\Protect\CREDHIST
- %HOMEPATH%\Start Menu\Programs\Startup\zkBujohS.lnk
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\33d76ad2-2096-4b31-863f-01671097726a
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
Deletes the following files:
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\316caa4ec95ef271e1191a8404c8acad_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d9f6c67dd28240b5a5de7fa4b29827e4_23ef5514-3059-436f-a4a7-4cefaab20eb1
Moves the following files:
- from %APPDATA%\Microsoft\Media Player\0007F0B7.wpl to %APPDATA%\Microsoft\Media Player\0007F0B7.wpl!________GEKTORg@PROTONMAIL.COM________.GEXOGEN
- from %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~ to %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~!________GEKTORg@PROTONMAIL.COM________.GEXOGEN
- from %APPDATA%\Microsoft\Protect\CREDHIST to %APPDATA%\Microsoft\Protect\CREDHIST!________GEKTORg@PROTONMAIL.COM________.GEXOGEN
- from %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\33d76ad2-2096-4b31-863f-01671097726a to %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\33d76ad2-2096-4b31-863f-01671097726a!________GEKTORg@PROTONMAIL.COM________.GEXOGEN
- from %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred to %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred!________GEKTORg@PROTONMAIL.COM________.GEXOGEN
Substitutes the following files:
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\d9f6c67dd28240b5a5de7fa4b29827e4_23ef5514-3059-436f-a4a7-4cefaab20eb1
Modifies user data files (Trojan.Encoder).
