Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\8d87fd-readme.txt
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\parnas_01.jpeg
- <Drive name for removable media>:\4f0bf7ff71f28.jpeg
- <Drive name for removable media>:\1189.jpeg
- <Drive name for removable media>:\scan.mov
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\k81b2ica.0.cs
- %TEMP%\k81b2ica.cmdline
- %TEMP%\k81b2ica.out
- %TEMP%\csc1759.tmp
- %TEMP%\res1769.tmp
- %TEMP%\k81b2ica.dll
- %TEMP%\fpxadhd1.0.cs
- %TEMP%\fpxadhd1.cmdline
- %TEMP%\fpxadhd1.out
- %TEMP%\csc1a47.tmp
- %TEMP%\res1a57.tmp
- %TEMP%\fpxadhd1.dll
- D:\8d87fd-readme.txt
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\8d87fd-readme.txt
- C:\totalcmd\8d87fd-readme.txt
Deletes the following files
- %TEMP%\res1769.tmp
- %TEMP%\csc1759.tmp
- %TEMP%\k81b2ica.cmdline
- %TEMP%\k81b2ica.pdb
- %TEMP%\k81b2ica.dll
- %TEMP%\k81b2ica.out
- %TEMP%\k81b2ica.0.cs
- %TEMP%\res1a57.tmp
- %TEMP%\csc1a47.tmp
- %TEMP%\fpxadhd1.dll
- %TEMP%\fpxadhd1.pdb
- %TEMP%\fpxadhd1.0.cs
- %TEMP%\fpxadhd1.cmdline
- %TEMP%\fpxadhd1.out
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\k81b2ica.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1769.tmp" "%TEMP%\CSC1759.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fpxadhd1.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1A57.tmp" "%TEMP%\CSC1A47.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\k81b2ica.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1769.tmp" "%TEMP%\CSC1759.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fpxadhd1.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1A57.tmp" "%TEMP%\CSC1A47.tmp"
