Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\clip_1080_5sec_10mbps_h264.mp4
- <Drive name for removable media>:\parnas_01.jpeg
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\contosoroot.cer
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\split.avi
Modifies file system
Creates the following files
- D:\e3b466-readme.txt
- %PROGRAMDATA%\e3b466-readme.txt
- %ProgramFiles(x86)%\steam\skins\e3b466-readme.txt
- %ProgramFiles(x86)%\microsoft office\office10\e3b466-readme.txt
- %ProgramFiles(x86)%\msbuild\e3b466-readme.txt
- C:\far2\addons\e3b466-readme.txt
- %APPDATA%\mra\e3b466-readme.txt
- %ProgramFiles(x86)%\steam\html5app\e3b466-readme.txt
- %ProgramFiles(x86)%\qip 2012\skins\qip\e3b466-readme.txt
- %PROGRAMDATA%\oracle\java\installcache_x64\e3b466-readme.txt
- %APPDATA%\winamp\e3b466-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\e3b466-readme.txt
- C:\totalcmd\language\e3b466-readme.txt
- C:\users\all users\microsoft toolkit\e3b466-readme.txt
- %ProgramFiles(x86)%\microsoft office\office14\1033\e3b466-readme.txt
- %ProgramFiles(x86)%\steam\remoteui\static\e3b466-readme.txt
- %PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\cache\e3b466-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\e3b466-readme.txt
- %ProgramFiles(x86)%\steam\config\e3b466-readme.txt
- %ProgramFiles(x86)%\google\chrome\application\e3b466-readme.txt
- C:\far2\fexcept\e3b466-readme.txt
- %ProgramFiles(x86)%\steam\steamapps\e3b466-readme.txt
- %PROGRAMDATA%\microsoft\mf\e3b466-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\e3b466-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\e3b466-readme.txt
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\e3b466-readme.txt
- %CommonProgramFiles(x86)%\adobe\helpcfg\en_us\e3b466-readme.txt
- %ProgramFiles(x86)%\k-lite codec pack\info\e3b466-readme.txt
- %APPDATA%\ghisler\e3b466-readme.txt
- %HOMEPATH%\searches\e3b466-readme.txt
- %APPDATA%\telegram desktop\e3b466-readme.txt
- %ProgramFiles(x86)%\k-lite codec pack\tools\e3b466-readme.txt
- %PROGRAMDATA%\microsoft\assistance\client\1.0\en-us\e3b466-readme.txt
- %HOMEPATH%\contacts\e3b466-readme.txt
- C:\users\public\libraries\e3b466-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\e3b466-readme.txt
- C:\totalcmd\e3b466-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\e3b466-readme.txt
- C:\users\public\pictures\sample pictures\e3b466-readme.txt
- C:\far2\e3b466-readme.txt
- C:\users\public\music\sample music\e3b466-readme.txt
- C:\users\all users\microsoft toolkit\settings.xml
- C:\users\all users\sun\java\java update\jaureglist.xml
- %HOMEPATH%\favorites\msn websites\e3b466-readme.txt
- C:\users\public\recorded tv\sample media\e3b466-readme.txt
- %ProgramFiles(x86)%\steam\e3b466-readme.txt
- %HOMEPATH%\desktop\e3b466-readme.txt
- %ProgramFiles(x86)%\winamp\e3b466-readme.txt
- %ProgramFiles(x86)%\k-lite codec pack\icaros\e3b466-readme.txt
- %LOCALAPPDATA%\msfree inc\e3b466-readme.txt
- C:\far2\documentation\rus\e3b466-readme.txt
- %PROGRAMDATA%\microsoft\windows\start menu\programs\steam\e3b466-readme.txt
- %PROGRAMDATA%\microsoft\crypto\rsa\s-1-5-18\e3b466-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\e3b466-readme.txt
- C:\users\public\videos\sample videos\e3b466-readme.txt
- %ProgramFiles(x86)%\qip 2012\e3b466-readme.txt
- %PROGRAMDATA%\microsoft\user account pictures\e3b466-readme.txt
- %LOCALAPPDATA%\applicationhistory\e3b466-readme.txt
- %ProgramFiles(x86)%\mirc\e3b466-readme.txt
- %HOMEPATH%\favorites\microsoft websites\e3b466-readme.txt
- %ProgramFiles(x86)%\opera\e3b466-readme.txt
- %CommonProgramFiles(x86)%\java\java update\e3b466-readme.txt
- %ProgramFiles(x86)%\winamp\components\e3b466-readme.txt
- %ProgramFiles(x86)%\k-lite codec pack\icaros\resources\e3b466-readme.txt
Moves the following files
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig.e3b466
- from %APPDATA%\telegram desktop\log.txt to %APPDATA%\telegram desktop\log.txt.e3b466
- from %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-1.bin to %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-1.bin.e3b466
- from %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-0.bin to %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-0.bin.e3b466
- from %ProgramFiles(x86)%\steam\skins\skins_readme.txt to %ProgramFiles(x86)%\steam\skins\skins_readme.txt.e3b466
- from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets.e3b466
- from %ProgramFiles(x86)%\steam\html5app\keybinds.cfg to %ProgramFiles(x86)%\steam\html5app\keybinds.cfg.e3b466
- from %ProgramFiles(x86)%\microsoft office\office10\thdic.lex to %ProgramFiles(x86)%\microsoft office\office10\thdic.lex.e3b466
- from %ProgramFiles(x86)%\qip 2012\skins\qip\extended.cfg to %ProgramFiles(x86)%\qip 2012\skins\qip\extended.cfg.e3b466
- from %ProgramFiles(x86)%\qip 2012\skins\qip\fade.cfg to %ProgramFiles(x86)%\qip 2012\skins\qip\fade.cfg.e3b466
- from %APPDATA%\winamp\links.xml to %APPDATA%\winamp\links.xml.e3b466
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\adobepistd.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\adobepistd.otf.e3b466
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-bold.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-bold.otf.e3b466
- from %ProgramFiles(x86)%\winamp\components\ssdp.w6c to %ProgramFiles(x86)%\winamp\components\ssdp.w6c.e3b466
- from %ProgramFiles(x86)%\k-lite codec pack\icaros\resources\icarosdescriptions.propdesc to %ProgramFiles(x86)%\k-lite codec pack\icaros\resources\icarosdescriptions.propdesc.e3b466
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-boldoblique.otf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\font\courierstd-boldoblique.otf.e3b466
- from %ProgramFiles(x86)%\steam\remoteui\static\playercontrols.js to %ProgramFiles(x86)%\steam\remoteui\static\playercontrols.js.e3b466
- from %APPDATA%\ghisler\wincmd.ini to %APPDATA%\ghisler\wincmd.ini.e3b466
- from %ProgramFiles(x86)%\steam\steamapps\libraryfolders.vdf to %ProgramFiles(x86)%\steam\steamapps\libraryfolders.vdf.e3b466
- from %ProgramFiles(x86)%\steam\config\config.vdf to %ProgramFiles(x86)%\steam\config\config.vdf.e3b466
- from %ProgramFiles(x86)%\mirc\defaults\urls.ini to %ProgramFiles(x86)%\mirc\defaults\urls.ini.e3b466
- from %ProgramFiles(x86)%\google\chrome\application\debug.log to %ProgramFiles(x86)%\google\chrome\application\debug.log.e3b466
- from %ProgramFiles(x86)%\steam\html5app\package.json to %ProgramFiles(x86)%\steam\html5app\package.json.e3b466
- from %ProgramFiles(x86)%\k-lite codec pack\info\faq.css to %ProgramFiles(x86)%\k-lite codec pack\info\faq.css.e3b466
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pddom.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pddom.api.e3b466
- from %ProgramFiles(x86)%\steam\config\dialogconfig.vdf to %ProgramFiles(x86)%\steam\config\dialogconfig.vdf.e3b466
- from %ProgramFiles(x86)%\google\chrome\application\visualelementsmanifest.xml to %ProgramFiles(x86)%\google\chrome\application\visualelementsmanifest.xml.e3b466
- from %ProgramFiles(x86)%\steam\steam\legacydepotdata.vdf to %ProgramFiles(x86)%\steam\steam\legacydepotdata.vdf.e3b466
- from %ProgramFiles(x86)%\steam\remoteui\static\headsdown.js to %ProgramFiles(x86)%\steam\remoteui\static\headsdown.js.e3b466
- from %ProgramFiles(x86)%\steam\remoteui\static\playercontrols.css to %ProgramFiles(x86)%\steam\remoteui\static\playercontrols.css.e3b466
- from %ProgramFiles(x86)%\mirc\defaults\mirc.ini to %ProgramFiles(x86)%\mirc\defaults\mirc.ini.e3b466
- from %APPDATA%\mra\installerlang.xml to %APPDATA%\mra\installerlang.xml.e3b466
- from %APPDATA%\winamp\demo.mp3 to %APPDATA%\winamp\demo.mp3.e3b466
- from %ProgramFiles(x86)%\steam\thirdpartylegalnotices.css to %ProgramFiles(x86)%\steam\thirdpartylegalnotices.css.e3b466
- from %ProgramFiles(x86)%\winamp\paths.ini to %ProgramFiles(x86)%\winamp\paths.ini.e3b466
- from %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml to %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml.e3b466
- from %ProgramFiles(x86)%\opera\installer_prefs.json to %ProgramFiles(x86)%\opera\installer_prefs.json.e3b466
- from %ProgramFiles(x86)%\steam\libx264-142.dll.md5 to %ProgramFiles(x86)%\steam\libx264-142.dll.md5.e3b466
- from %ProgramFiles(x86)%\steam\libav_h264-56.dll.md5 to %ProgramFiles(x86)%\steam\libav_h264-56.dll.md5.e3b466
- from %ProgramFiles(x86)%\winamp\pconfig.dcf to %ProgramFiles(x86)%\winamp\pconfig.dcf.e3b466
- from %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt to %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt.e3b466
- from %ProgramFiles(x86)%\winamp\install.ini to %ProgramFiles(x86)%\winamp\install.ini.e3b466
- from %ProgramFiles(x86)%\k-lite codec pack\icaros\icaros license.txt to %ProgramFiles(x86)%\k-lite codec pack\icaros\icaros license.txt.e3b466
- from %ProgramFiles(x86)%\opera\resources.pri to %ProgramFiles(x86)%\opera\resources.pri.e3b466
- from %ProgramFiles(x86)%\opera\server_tracking_data to %ProgramFiles(x86)%\opera\server_tracking_data.e3b466
- from %ProgramFiles(x86)%\mirc\readme.txt to %ProgramFiles(x86)%\mirc\readme.txt.e3b466
- from C:\users\all users\microsoft toolkit\settings.xml to C:\users\all users\microsoft toolkit\settings.xml.e3b466
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der.e3b466
- from %ProgramFiles(x86)%\qip 2012\unins000.msg to %ProgramFiles(x86)%\qip 2012\unins000.msg.e3b466
- from %ProgramFiles(x86)%\opera\installation_status.xml to %ProgramFiles(x86)%\opera\installation_status.xml.e3b466
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini.e3b466
- from %ProgramFiles(x86)%\mirc\ircintro.chm to %ProgramFiles(x86)%\mirc\ircintro.chm.e3b466
- from %ProgramFiles(x86)%\steam\libx264-142.dll.crypt to %ProgramFiles(x86)%\steam\libx264-142.dll.crypt.e3b466
- from %ProgramFiles(x86)%\winamp\whatsnew.txt to %ProgramFiles(x86)%\winamp\whatsnew.txt.e3b466
- from %ProgramFiles(x86)%\steam\steam.exe.old to %ProgramFiles(x86)%\steam\steam.exe.old.e3b466
- from %ProgramFiles(x86)%\mirc\mirc.chm to %ProgramFiles(x86)%\mirc\mirc.chm.e3b466
- from %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm to %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm.e3b466
- from %ProgramFiles(x86)%\mirc\versions.txt to %ProgramFiles(x86)%\mirc\versions.txt.e3b466
- from %ProgramFiles(x86)%\qip 2012\unins000.dat to %ProgramFiles(x86)%\qip 2012\unins000.dat.e3b466
- from %ProgramFiles(x86)%\k-lite codec pack\unins000.dat to %ProgramFiles(x86)%\k-lite codec pack\unins000.dat.e3b466
- from %ProgramFiles(x86)%\steam\libav_h264-56.dll.crypt to %ProgramFiles(x86)%\steam\libav_h264-56.dll.crypt.e3b466
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest.e3b466
- from %ProgramFiles(x86)%\microsoft office\office10\trigram.lex to %ProgramFiles(x86)%\microsoft office\office10\trigram.lex.e3b466
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin.e3b466
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\vssadmin.exe' delete shadows /all /quiet' (with hidden window)
