Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\3f3f18-readme.txt
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\delete.avi
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
Modifies file system
Creates the following files
- %TEMP%\o2e6qpfi.0.cs
- %TEMP%\o2e6qpfi.cmdline
- %TEMP%\o2e6qpfi.out
- %TEMP%\csc68f3.tmp
- %TEMP%\res6904.tmp
- %TEMP%\o2e6qpfi.dll
- %TEMP%\j6o1jhwu.0.cs
- %TEMP%\j6o1jhwu.cmdline
- %TEMP%\j6o1jhwu.out
- %TEMP%\csc6ea0.tmp
- %TEMP%\res6eb1.tmp
- %TEMP%\j6o1jhwu.dll
- C:\totalcmd\3f3f18-readme.txt
- D:\3f3f18-readme.txt
Deletes the following files
- %TEMP%\res6904.tmp
- %TEMP%\csc68f3.tmp
- %TEMP%\o2e6qpfi.out
- %TEMP%\o2e6qpfi.0.cs
- %TEMP%\o2e6qpfi.cmdline
- %TEMP%\o2e6qpfi.pdb
- %TEMP%\o2e6qpfi.dll
- %TEMP%\res6eb1.tmp
- %TEMP%\csc6ea0.tmp
- %TEMP%\j6o1jhwu.dll
- %TEMP%\j6o1jhwu.cmdline
- %TEMP%\j6o1jhwu.out
- %TEMP%\j6o1jhwu.pdb
- %TEMP%\j6o1jhwu.0.cs
Moves the following files
- from %ProgramFiles(x86)%\opera\resources.pri to %ProgramFiles(x86)%\opera\resources.pri.3f3f18
- from %ProgramFiles(x86)%\qip 2012\unins000.dat to %ProgramFiles(x86)%\qip 2012\unins000.dat.3f3f18
- from %ProgramFiles(x86)%\qip 2012\unins000.msg to %ProgramFiles(x86)%\qip 2012\unins000.msg.3f3f18
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm.3f3f18
- from %ProgramFiles(x86)%\opera\server_tracking_data to %ProgramFiles(x86)%\opera\server_tracking_data.3f3f18
- from %ProgramFiles(x86)%\mirc\readme.txt to %ProgramFiles(x86)%\mirc\readme.txt.3f3f18
- from %ProgramFiles(x86)%\mirc\versions.txt to %ProgramFiles(x86)%\mirc\versions.txt.3f3f18
- from %ProgramFiles(x86)%\opera\installation_status.xml to %ProgramFiles(x86)%\opera\installation_status.xml.3f3f18
- from %ProgramFiles(x86)%\mirc\ircintro.chm to %ProgramFiles(x86)%\mirc\ircintro.chm.3f3f18
- from %ProgramFiles(x86)%\mirc\mirc.chm to %ProgramFiles(x86)%\mirc\mirc.chm.3f3f18
- from %ProgramFiles(x86)%\winamp\whatsnew.txt to %ProgramFiles(x86)%\winamp\whatsnew.txt.3f3f18
- from %ProgramFiles(x86)%\winamp\install.ini to %ProgramFiles(x86)%\winamp\install.ini.3f3f18
- from %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm to %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm.3f3f18
- from %ProgramFiles(x86)%\winamp\components\ssdp.w6c to %ProgramFiles(x86)%\winamp\components\ssdp.w6c.3f3f18
- from %ProgramFiles(x86)%\microsoft office\office10\trigram.lex to %ProgramFiles(x86)%\microsoft office\office10\trigram.lex.3f3f18
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\o2e6qpfi.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6904.tmp" "%TEMP%\CSC68F3.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\j6o1jhwu.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6EB1.tmp" "%TEMP%\CSC6EA0.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\o2e6qpfi.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6904.tmp" "%TEMP%\CSC68F3.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\j6o1jhwu.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6EB1.tmp" "%TEMP%\CSC6EA0.tmp"
