Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'XO1XADpO01' = '"%TEMP%\5798.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\nvngxupdatecheckdaily_{6eefbfb0-bfb0-bfb0-bfb0-6eefbfb0bfb0}
Creates the following files on removable media
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\samieee_obiee_presentation.pptx
- <Drive name for removable media>:\gruenspecht_02172016.pptx
- <Drive name for removable media>:\middaugh_keynote.pptx
- <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
- <Drive name for removable media>:\waterresourcesag.pptx
- <Drive name for removable media>:\hypothyroidism_slides.pptx
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\roozenedowebinar.pptx
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\restore-my-files.txt
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\asaprojectcompetition.pptx
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\d47f.tmp
- C:\far2\fexcept\restore-my-files.txt
- C:\far2\plugins\align\restore-my-files.txt
- C:\far2\plugins\arclite\restore-my-files.txt
- C:\far2\plugins\autowrap\restore-my-files.txt
- C:\far2\plugins\brackets\restore-my-files.txt
- C:\far2\plugins\compare\restore-my-files.txt
- C:\far2\plugins\drawline\restore-my-files.txt
- C:\far2\plugins\editcase\restore-my-files.txt
- C:\far2\plugins\emenu\restore-my-files.txt
- C:\far2\plugins\farcmds\restore-my-files.txt
- C:\far2\plugins\filecase\restore-my-files.txt
- C:\far2\plugins\ftp\restore-my-files.txt
- C:\far2\plugins\ftp\lib\restore-my-files.txt
- C:\far2\plugins\hlfviewer\restore-my-files.txt
- C:\far2\plugins\macroview\restore-my-files.txt
- C:\far2\encyclopedia\tap\restore-my-files.txt
- C:\far2\plugins\network\restore-my-files.txt
- C:\far2\encyclopedia\restore-my-files.txt
- C:\far2\documentation\eng\restore-my-files.txt
- %APPDATA%\rfjisjr
- %APPDATA%\dcgbfbw
- %TEMP%\5798.exe
- D:\restore-my-files.txt
- C:\far2\addons\colors\custom_highlighting\restore-my-files.txt
- C:\far2\addons\colors\default_highlighting\restore-my-files.txt
- C:\far2\addons\colors\restore-my-files.txt
- C:\far2\addons\restore-my-files.txt
- C:\far2\addons\macros\restore-my-files.txt
- C:\far2\addons\setup\restore-my-files.txt
- C:\far2\addons\shell\restore-my-files.txt
- C:\far2\addons\xlat\restore-my-files.txt
- %TEMP%\61da.exe
- C:\far2\addons\xlat\russian\restore-my-files.txt
- C:\far2\restore-my-files.txt
- C:\far2\documentation\rus\restore-my-files.txt
- C:\far2\plugins\proclist\restore-my-files.txt
Sets the 'hidden' attribute to the following files
- %APPDATA%\rfjisjr
- %APPDATA%\dcgbfbw
Substitutes the following files
- <Drive name for removable media>:\Static_Electricity_Easy_and_Quick_Activities.rtf
- <Drive name for removable media>:\removedtitles_records.xls
- <Drive name for removable media>:\calculatorworksheet.xls
- <Drive name for removable media>:\productos.xls
- <Drive name for removable media>:\trtf_matrix2012_oct.xlsx
Deletes itself.
Changes user data files extensions (Trojan.Encoder).
Network activity
TCP
HTTP GET requests
- http://hk####dvert475.xyz/lb777.exe
- http://hk####dvert475.xyz/socks111.exe
HTTP POST requests
- http://at###ot20x.xyz/statweb955/
UDP
- DNS ASK re###at35x.xyz
- DNS ASK de###ot2x.xyz
- DNS ASK at###ot20x.xyz
- DNS ASK hk####dvert475.xyz
Miscellaneous
Creates and executes the following
- '%TEMP%\5798.exe'
- '%TEMP%\61da.exe'
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...
