Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\read_me.txt
- <Drive name for removable media>:\babyboymaintonotesbackground_pal.wmv.adhubllka
- <Drive name for removable media>:\babyboymaintoscenesbackground.wmv.adhubllka
- <Drive name for removable media>:\excel_example.xls.adhubllka
- <Drive name for removable media>:\removedtitles_records.xls.adhubllka
- <Drive name for removable media>:\productos.xls.adhubllka
- <Drive name for removable media>:\suspendedcompanies.xlsx.adhubllka
- <Drive name for removable media>:\cee_mmsprogram_summary_public.xlsx.adhubllka
- <Drive name for removable media>:\trtf_matrix2012_oct.xlsx.adhubllka
- <Drive name for removable media>:\highly_cited_2001.xlsx.adhubllka
- <Drive name for removable media>:\fiche_inscription_2015.zip.adhubllka
- <Drive name for removable media>:\price.zip.adhubllka
- <Drive name for removable media>:\calculatorworksheet.zip.adhubllka
- <Drive name for removable media>:\dashborder_144.bmp.adhubllka
- <Drive name for removable media>:\contractualdeadlines.zip.adhubllka
- <Drive name for removable media>:\1sm_price.zip.adhubllka
- <Drive name for removable media>:\excel_example.zip.adhubllka
- <Drive name for removable media>:\archer.avi.adhubllka.adhubllka
- <Drive name for removable media>:\split.avi.adhubllka.adhubllka
- <Drive name for removable media>:\default.bmp.adhubllka.adhubllka
- <Drive name for removable media>:\coffee.bmp.adhubllka.adhubllka
- <Drive name for removable media>:\sdkfailsafeemulator.cer.adhubllka.adhubllka
- <Drive name for removable media>:\contoso_1.cer.adhubllka.adhubllka
- <Drive name for removable media>:\contoso.cer.adhubllka.adhubllka
- <Drive name for removable media>:\sdksampleprivdeveloper.cer.adhubllka.adhubllka
- <Drive name for removable media>:\hanni_umami_chapter.doc.adhubllka.adhubllka
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc.adhubllka.adhubllka
- <Drive name for removable media>:\babyboymaintoscenesbackground_pal.wmv.adhubllka
- <Drive name for removable media>:\flower_trans_matte.wmv.adhubllka
- <Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe.adhubllka
- <Drive name for removable media>:\dotnetfx45_full_setup.exe.adhubllka
- <Drive name for removable media>:\aoc_saq_d_v3_merchant.docx.adhubllka
- <Drive name for removable media>:\dotnetfx45_full_setup.exe
- <Drive name for removable media>:\chromesetup.exe
- <Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe
- <Drive name for removable media>:\middaugh_keynote.pptx
- <Drive name for removable media>:\waterresourcesag.pptx
- <Drive name for removable media>:\hypothyroidism_slides.pptx
- <Drive name for removable media>:\indogerman2010.pptx
- <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
- <Drive name for removable media>:\archer.avi.adhubllka
- <Drive name for removable media>:\split.avi.adhubllka
- <Drive name for removable media>:\default.bmp.adhubllka
- <Drive name for removable media>:\coffee.bmp.adhubllka
- <Drive name for removable media>:\sdszfo.docx.adhubllka.adhubllka
- <Drive name for removable media>:\removedtitles_records.zip.adhubllka
- <Drive name for removable media>:\dashborder_96.bmp.adhubllka
- <Drive name for removable media>:\contosoroot_1.cer.adhubllka
- <Drive name for removable media>:\sdkfailsafeemulator.cer.adhubllka
- <Drive name for removable media>:\contoso_1.cer.adhubllka
- <Drive name for removable media>:\contoso.cer.adhubllka
- <Drive name for removable media>:\testcertificate.cer.adhubllka
- <Drive name for removable media>:\sdksampleprivdeveloper.cer.adhubllka
- <Drive name for removable media>:\hanni_umami_chapter.doc.adhubllka
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc.adhubllka
- <Drive name for removable media>:\sdszfo.docx.adhubllka
- <Drive name for removable media>:\file_p_00000000_1371597592.docx.adhubllka
- <Drive name for removable media>:\hadac_newsletter_july_2010_final.docx.adhubllka
- <Drive name for removable media>:\glidescope_review_rev_010.docx.adhubllka
- <Drive name for removable media>:\skypesetup.exe
- <Drive name for removable media>:\dashborder_120.bmp.adhubllka
- <Drive name for removable media>:\hadac_newsletter_july_2010_final.docx.adhubllka.adhubllka
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\contosoroot.cer
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\ituneshelpunavailable.htm
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- C:\documents and settings\read_me.txt
- C:\users\public\read_me.txt
- C:\users\public\videos\sample videos\read_me.txt
- C:\users\public\recorded tv\read_me.txt
- C:\users\public\recorded tv\sample media\read_me.txt
- C:\users\public\pictures\sample pictures\read_me.txt
- C:\users\public\music\sample music\read_me.txt
- C:\users\public\libraries\read_me.txt
- C:\users\public\favorites\read_me.txt
- C:\users\public\downloads\read_me.txt
- C:\users\public\documents\read_me.txt
- C:\users\public\documents\my videos\read_me.txt
- C:\users\public\documents\my pictures\read_me.txt
- C:\users\public\documents\my music\read_me.txt
- C:\users\public\desktop\read_me.txt
- C:\users\default\read_me.txt
- C:\users\default\templates\read_me.txt
- C:\users\default\start menu\read_me.txt
- C:\users\default\sendto\read_me.txt
- C:\users\default\saved games\read_me.txt
- C:\users\default\recent\read_me.txt
- C:\users\default\printhood\read_me.txt
- C:\users\default\nethood\read_me.txt
- C:\users\default\local settings\read_me.txt
- %HOMEPATH%\application data\read_me.txt
- %HOMEPATH%\cookies\read_me.txt
- C:\read_me.txt
- %HOMEPATH%\desktop\read_me.txt
- <Current directory>\read_me.txt
- %HOMEPATH%\read_me.txt
- %HOMEPATH%\voip\read_me.txt
- %HOMEPATH%\templates\read_me.txt
- %HOMEPATH%\start menu\read_me.txt
- %HOMEPATH%\sendto\read_me.txt
- %HOMEPATH%\searches\read_me.txt
- %HOMEPATH%\saved games\read_me.txt
- %HOMEPATH%\recent\read_me.txt
- %HOMEPATH%\printhood\read_me.txt
- %HOMEPATH%\nethood\read_me.txt
- %HOMEPATH%\local settings\read_me.txt
- %HOMEPATH%\links\read_me.txt
- %HOMEPATH%\favorites\read_me.txt
- %HOMEPATH%\favorites\msn websites\read_me.txt
- %HOMEPATH%\favorites\microsoft websites\read_me.txt
- %HOMEPATH%\favorites\links for united states\read_me.txt
- %HOMEPATH%\favorites\links\read_me.txt
- %HOMEPATH%\downloads\read_me.txt
- %HOMEPATH%\documents\read_me.txt
- %HOMEPATH%\documents\my videos\read_me.txt
- %HOMEPATH%\documents\my pictures\read_me.txt
- %HOMEPATH%\documents\my music\read_me.txt
- C:\users\default\links\read_me.txt
- %HOMEPATH%\contacts\read_me.txt
- C:\users\default\favorites\read_me.txt
- C:\far2\plugins\filecase\read_me.txt
- C:\far2\plugins\emenu\read_me.txt
- C:\far2\plugins\editcase\read_me.txt
- C:\far2\plugins\drawline\read_me.txt
- C:\far2\plugins\compare\read_me.txt
- C:\far2\plugins\brackets\read_me.txt
- C:\far2\plugins\autowrap\read_me.txt
- C:\far2\plugins\arclite\read_me.txt
- C:\far2\plugins\align\read_me.txt
- C:\far2\fexcept\read_me.txt
- C:\far2\encyclopedia\read_me.txt
- C:\far2\encyclopedia\tap\read_me.txt
- C:\far2\documentation\read_me.txt
- C:\far2\documentation\rus\read_me.txt
- C:\far2\documentation\eng\read_me.txt
- C:\far2\addons\read_me.txt
- C:\far2\addons\xlat\read_me.txt
- C:\far2\addons\xlat\russian\read_me.txt
- C:\far2\addons\shell\read_me.txt
- C:\far2\addons\setup\read_me.txt
- C:\far2\addons\macros\read_me.txt
- C:\far2\addons\colors\read_me.txt
- C:\far2\addons\colors\default_highlighting\read_me.txt
- C:\far2\addons\colors\custom_highlighting\read_me.txt
- C:\far2\plugins\farcmds\read_me.txt
- C:\far2\plugins\ftp\lib\read_me.txt
- C:\users\default\documents\read_me.txt
- C:\far2\plugins\ftp\read_me.txt
- C:\users\default\documents\my videos\read_me.txt
- C:\users\default\documents\my pictures\read_me.txt
- C:\users\default\documents\my music\read_me.txt
- C:\users\default\desktop\read_me.txt
- C:\users\default\cookies\read_me.txt
- C:\users\default\application data\read_me.txt
- C:\totalcmd\read_me.txt
- C:\totalcmd\language\read_me.txt
- C:\recovery\read_me.txt
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\read_me.txt
- C:\perflogs\read_me.txt
- C:\perflogs\admin\read_me.txt
- C:\msocache\read_me.txt
- C:\far2\read_me.txt
- C:\far2\pluginsdk\read_me.txt
- C:\far2\pluginsdk\headers.pas\read_me.txt
- C:\far2\pluginsdk\headers.c\read_me.txt
- C:\far2\plugins\read_me.txt
- C:\far2\plugins\tmppanel\read_me.txt
- C:\far2\plugins\proclist\read_me.txt
- C:\far2\plugins\network\read_me.txt
- C:\far2\plugins\macroview\read_me.txt
- C:\far2\plugins\hlfviewer\read_me.txt
- C:\users\default\downloads\read_me.txt
- D:\read_me.txt
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
