Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Session Manager' = '%HOMEPATH%\ntoskrnl.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\windows session manager
Creates the following files on removable media
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\weeklysheet1215.doc
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\applicantform_en.doc
Modifies file system
Creates the following files
- %HOMEPATH%\install.bat
- C:\far2\documentation\how to decrypt files.hta
- C:\far2\encyclopedia\tap\how to decrypt files.txt
- C:\far2\encyclopedia\tap\how to decrypt files.hta
- C:\far2\encyclopedia\how to decrypt files.txt
- C:\far2\encyclopedia\how to decrypt files.hta
- C:\far2\fexcept\how to decrypt files.txt
- C:\far2\fexcept\how to decrypt files.hta
- C:\far2\plugins\align\how to decrypt files.txt
- C:\far2\documentation\rus\how to decrypt files.hta
- C:\far2\documentation\how to decrypt files.txt
- C:\far2\plugins\align\how to decrypt files.hta
- C:\far2\plugins\autowrap\how to decrypt files.txt
- C:\far2\plugins\autowrap\how to decrypt files.hta
- C:\far2\plugins\brackets\how to decrypt files.txt
- C:\far2\plugins\brackets\how to decrypt files.hta
- C:\far2\plugins\compare\how to decrypt files.txt
- C:\far2\plugins\compare\how to decrypt files.hta
- C:\far2\plugins\drawline\how to decrypt files.txt
- C:\far2\plugins\drawline\how to decrypt files.hta
- C:\far2\plugins\arclite\how to decrypt files.txt
- C:\far2\plugins\arclite\how to decrypt files.hta
- C:\far2\documentation\rus\how to decrypt files.txt
- C:\far2\documentation\eng\how to decrypt files.hta
- C:\far2\documentation\eng\how to decrypt files.txt
- D:\how to decrypt files.txt
- D:\how to decrypt files.hta
- C:\far2\addons\colors\custom_highlighting\how to decrypt files.txt
- C:\far2\addons\colors\custom_highlighting\how to decrypt files.hta
- C:\far2\addons\colors\default_highlighting\how to decrypt files.txt
- C:\far2\addons\colors\default_highlighting\how to decrypt files.hta
- C:\far2\addons\colors\how to decrypt files.txt
- C:\far2\addons\colors\how to decrypt files.hta
- C:\far2\addons\macros\how to decrypt files.txt
- %HOMEPATH%\log.txt
- C:\far2\addons\macros\how to decrypt files.hta
- C:\far2\addons\setup\how to decrypt files.hta
- C:\far2\addons\shell\how to decrypt files.txt
- C:\far2\addons\shell\how to decrypt files.hta
- C:\far2\addons\xlat\russian\how to decrypt files.txt
- C:\far2\addons\xlat\russian\how to decrypt files.hta
- C:\far2\addons\xlat\how to decrypt files.txt
- C:\far2\addons\xlat\how to decrypt files.hta
- C:\far2\addons\how to decrypt files.txt
- C:\far2\addons\how to decrypt files.hta
- C:\far2\addons\setup\how to decrypt files.txt
- C:\far2\plugins\editcase\how to decrypt files.txt
- C:\far2\plugins\editcase\how to decrypt files.hta
Moves itself
- from <Full path to file> to %HOMEPATH%\ntoskrnl.exe
Creates ransom message files (Trojan.Encoder).
Modifies user data files (Trojan.Encoder).
Network activity
TCP
HTTP POST requests
- http://88.##4.27.84/new/d3009a2110
- http://88.##4.27.84/info/d3009a2110
UDP
- DNS ASK 1.##.#.10.in-addr.arpa
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%HOMEPATH%\install.bat" "' (with hidden window)
- '%HOMEPATH%\ntoskrnl.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%HOMEPATH%\install.bat" "
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /TN "Windows Session Manager" /TR "%HOMEPATH%\ntoskrnl.exe" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Session Manager" /t REG_SZ /d "%HOMEPATH%\ntoskrnl.exe" /f
- '<SYSTEM32>\taskeng.exe' {7E500CD7-F285-4B37-9647-51C76C2EAEC5} S-1-5-21-1960123792-2022915161-3775307078-1001:xguqttyzhbv\user:Interactive:[1]
