Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
Modifies file system
Creates the following files
- <Current directory>0.txt
- <Current directory>-how-to-decrypt.txt
- <Current directory>count.txt
- C:\users\all users\microsoft\ilscache\ilrcache.xml
- C:\users\all users\microsoft\ilscache\imcrcache.xml
- C:\users\all users\microsoft\user account pictures\guest.bmp
- C:\users\all users\microsoft\user account pictures\user.bmp
- C:\users\all users\microsoft toolkit\settings.xml
- C:\users\all users\sun\java\java update\jaureglist.xml
Moves the following files
- from C:\users\all users\microsoft\ilscache\ilrcache.xml to C:\users\all users\microsoft\ilscache\ilrcache.xml.ment
- from C:\users\all users\microsoft\ilscache\imcrcache.xml to C:\users\all users\microsoft\ilscache\imcrcache.xml.ment
- from C:\users\all users\microsoft\user account pictures\guest.bmp to C:\users\all users\microsoft\user account pictures\guest.bmp.ment
- from C:\users\all users\microsoft\user account pictures\user.bmp to C:\users\all users\microsoft\user account pictures\user.bmp.ment
- from C:\users\all users\microsoft toolkit\settings.xml to C:\users\all users\microsoft toolkit\settings.xml.ment
- from C:\users\all users\sun\java\java update\jaureglist.xml to C:\users\all users\sun\java\java update\jaureglist.xml.ment
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit.exe /deletevalue {current} safeboot' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C sc config hades start= disabled' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C shutdown /r /f /t 0' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit.exe /deletevalue {current} safeboot
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet
- '%WINDIR%\syswow64\cmd.exe' /C sc config hades start= disabled
- '%WINDIR%\syswow64\cmd.exe' /C shutdown /r /f /t 0
- '%WINDIR%\syswow64\sc.exe' config hades start= disabled
- '%WINDIR%\syswow64\shutdown.exe' /r /f /t 0
Attempts to shut down the Windows operating system.
