Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '"%APPDATA%\Microsoft\Windows\ctfmon.exe" *'
Creates the following files on removable media
- <Drive name for removable media>:\!!! your files are encrypted !!!.txt
- <Drive name for removable media>:\waterresourcesag.pptx
- <Drive name for removable media>:\asaprojectcompetition.pptx
- <Drive name for removable media>:\hypothyroidism_slides.pptx
- <Drive name for removable media>:\middaugh_keynote.pptx
- <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
- <Drive name for removable media>:\samieee_obiee_presentation.pptx
- <Drive name for removable media>:\gruenspecht_02172016.pptx
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\2.jpeg
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\testee.cer
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\pushkin.jpeg
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\parnas_01.jpeg
- %HOMEPATH%\desktop\howto-index.html
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\alert.html
- %HOMEPATH%\desktop\adadsi.html
- %HOMEPATH%\desktop\64bit_notes.htm
- %HOMEPATH%\desktop\3.jpeg
- %HOMEPATH%\desktop\210252809.jpeg
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\tree_view.htm
Modifies file system
Creates the following files
- %TEMP%\696dce23.buran
- unc\raabpv\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi.30fe2769-5c2c-284c-2d4d-8969b3979b94
- unc\raabpv\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi
- unc\raabpv\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\!!! your files are encrypted !!!.txt
- unc\raabpv\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.30fe2769-5c2c-284c-2d4d-8969b3979b94
- unc\raabpv\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini
- C:\far2\addons\colors\default_highlighting\!!! your files are encrypted !!!.txt
- unc\raabpv\users\all users\adobe\arm\s\!!! your files are encrypted !!!.txt
- unc\raabpv\users\all users\adobe\arm\s\armmanifest.msi.30fe2769-5c2c-284c-2d4d-8969b3979b94
- unc\raabpv\users\all users\adobe\arm\s\armmanifest.msi
- unc\raabpv\users\all users\adobe\arm\reader_15.007.20033\!!! your files are encrypted !!!.txt
- unc\raabpv\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab
- unc\raabpv\users\all users\adobe\arm\reader_15.007.20033\readerdcmanifest.msi.30fe2769-5c2c-284c-2d4d-8969b3979b94
- C:\far2\addons\colors\custom_highlighting\!!! your files are encrypted !!!.txt
- C:\far2\addons\colors\!!! your files are encrypted !!!.txt
- C:\far2\addons\!!! your files are encrypted !!!.txt
- unc\raabpv\users\all users\!!! your files are encrypted !!!.txt
- unc\raabpv\users\all users\ntuser.pol.30fe2769-5c2c-284c-2d4d-8969b3979b94
- unc\raabpv\users\all users\ntuser.pol
- C:\far2\!!! your files are encrypted !!!.txt
- %HOMEPATH%\desktop\!!! your files are encrypted !!!.txt
- %TEMP%\530d2c8e.buran
- %APPDATA%\microsoft\windows\ctfmon.exe
- unc\raabpv\users\all users\adobe\arm\reader_15.007.20033\readerdcmanifest.msi
- unc\raabpv\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab.30fe2769-5c2c-284c-2d4d-8969b3979b94
Sets the 'hidden' attribute to the following files
- unc\raabpv\users\all users\ntuser.pol.30fe2769-5c2c-284c-2d4d-8969b3979b94
Deletes the following files
- %TEMP%\696dce23.buran
- %TEMP%\530d2c8e.buran
Moves the following files
- from unc\raabpv\users\all users\ntuser.pol to unc\raabpv\users\all users\ntuser.pol.30fe2769-5c2c-284c-2d4d-8969b3979b94
- from unc\raabpv\users\all users\adobe\arm\reader_15.007.20033\readerdcmanifest.msi to unc\raabpv\users\all users\adobe\arm\reader_15.007.20033\readerdcmanifest.msi.30fe2769-5c2c-284c-2d4d-8969b3979b94
- from unc\raabpv\users\all users\adobe\arm\s\armmanifest.msi to unc\raabpv\users\all users\adobe\arm\s\armmanifest.msi.30fe2769-5c2c-284c-2d4d-8969b3979b94
- from unc\raabpv\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini to unc\raabpv\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.30fe2769-5c2c-284c-2d4d-8969b3979b94
- from unc\raabpv\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi to unc\raabpv\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi.30fe2769-5c2c-284c-2d4d-8969b3979b94
- from unc\raabpv\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab to unc\raabpv\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab.30fe2769-5c2c-284c-2d4d-8969b3979b94
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'ip###ger.org':443
TCP
HTTP GET requests
- http://ip##gger.ru/xxxxxx
UDP
- DNS ASK ip##gger.ru
- DNS ASK ip###ger.org
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\ctfmon.exe' *
- '%WINDIR%\syswow64\cmd.exe' /e:on /c md "%APPDATA%\Microsoft\Windows" & copy "<Full path to file>" "%APPDATA%\Microsoft\Windows\ctfmon.exe" & reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ctfmon.exe" /t...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /e:on /c md "%APPDATA%\Microsoft\Windows" & copy "<Full path to file>" "%APPDATA%\Microsoft\Windows\ctfmon.exe" & reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ctfmon.exe" /t...
- '%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "ctfmon.exe" /t REG_SZ /F /D "\"%APPDATA%\Microsoft\Windows\ctfmon.exe\" *"
