Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\dashborder_96.bmp
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\contosoroot.cer
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\contosoroot_1.cer
Modifies file system
Creates the following files
- %TEMP%\xxjdsok_.0.cs
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\83425a-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\83425a-readme.txt
- %HOMEPATH%\desktop\83425a-readme.txt
- C:\users\public\libraries\83425a-readme.txt
- %PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\cache\83425a-readme.txt
- C:\far2\83425a-readme.txt
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\83425a-readme.txt
- %TEMP%\a0jscdfy.dll
- %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\83425a-readme.txt
- %TEMP%\res70.tmp
- %TEMP%\a0jscdfy.out
- %TEMP%\a0jscdfy.cmdline
- %TEMP%\a0jscdfy.0.cs
- %TEMP%\xxjdsok_.dll
- %TEMP%\resfd53.tmp
- %TEMP%\cscfd43.tmp
- %TEMP%\xxjdsok_.out
- %TEMP%\xxjdsok_.cmdline
- %TEMP%\csc5f.tmp
- %HOMEPATH%\favorites\links\83425a-readme.txt
Deletes the following files
- %TEMP%\resfd53.tmp
- %TEMP%\cscfd43.tmp
- %TEMP%\xxjdsok_.pdb
- %TEMP%\xxjdsok_.0.cs
- %TEMP%\xxjdsok_.cmdline
- %TEMP%\xxjdsok_.out
- %TEMP%\xxjdsok_.dll
- %TEMP%\res70.tmp
- %TEMP%\csc5f.tmp
- %TEMP%\a0jscdfy.pdb
- %TEMP%\a0jscdfy.cmdline
- %TEMP%\a0jscdfy.dll
- %TEMP%\a0jscdfy.out
- %TEMP%\a0jscdfy.0.cs
Moves the following files
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest.83425a
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der.83425a
- from %ProgramFiles(x86)%\k-lite codec pack\icaros\icaros license.txt to %ProgramFiles(x86)%\k-lite codec pack\icaros\icaros license.txt.83425a
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xxjdsok_.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFD53.tmp" "%TEMP%\CSCFD43.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\a0jscdfy.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES70.tmp" "%TEMP%\CSC5F.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xxjdsok_.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFD53.tmp" "%TEMP%\CSCFD43.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\a0jscdfy.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES70.tmp" "%TEMP%\CSC5F.tmp"
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\svchost.exe' -k swprv
