Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\d0068197bb5a41fea16a220c45390606.mp4
- <Drive name for removable media>:\roozenedowebinar.pptx
- <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
- <Drive name for removable media>:\middaugh_keynote.pptx
- <Drive name for removable media>:\gruenspecht_02172016.pptx
- <Drive name for removable media>:\waterresourcesag.pptx
- <Drive name for removable media>:\hypothyroidism_slides.pptx
- <Drive name for removable media>:\sacs_presentation_sacs_qep_improving_rt_education_final.ppt
- <Drive name for removable media>:\sim_gametheory_to_finance.ppt
- <Drive name for removable media>:\file1.ppt
- <Drive name for removable media>:\ksearch_esa_talk.ppt
- <Drive name for removable media>:\accountsreceivable.ppt
- <Drive name for removable media>:\mappingconcepthubberlin.ppt
- <Drive name for removable media>:\breakpoint.png
- <Drive name for removable media>:\asm.png
- <Drive name for removable media>:\background.png
- <Drive name for removable media>:\bg_search_box.png
- <Drive name for removable media>:\calibre.png
- <Drive name for removable media>:\dissolveanother.png
- <Drive name for removable media>:\7790_preview.pdf
- <Drive name for removable media>:\bc01.pdf
- <Drive name for removable media>:\fil_20060629111052.pdf
- <Drive name for removable media>:\ff_ot_user_guide.pdf
- <Drive name for removable media>:\51.mp4
- <Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
- <Drive name for removable media>:\samieee_obiee_presentation.pptx
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\j0wudfst.0.cs
- %TEMP%\j0wudfst.cmdline
- %TEMP%\j0wudfst.out
- %TEMP%\cscec22.tmp
- %TEMP%\resec33.tmp
- %TEMP%\j0wudfst.dll
- %TEMP%\fsb3rcan.0.cs
- %TEMP%\fsb3rcan.cmdline
- %TEMP%\fsb3rcan.out
- %TEMP%\csc25d7.tmp
- %TEMP%\res25e8.tmp
- %TEMP%\fsb3rcan.dll
- D:\b42ccc-readme.txt
Deletes the following files
- %TEMP%\resec33.tmp
- %TEMP%\cscec22.tmp
- %TEMP%\j0wudfst.cmdline
- %TEMP%\j0wudfst.dll
- %TEMP%\j0wudfst.0.cs
- %TEMP%\j0wudfst.out
- %TEMP%\j0wudfst.pdb
- %TEMP%\res25e8.tmp
- %TEMP%\csc25d7.tmp
- %TEMP%\fsb3rcan.out
- %TEMP%\fsb3rcan.dll
- %TEMP%\fsb3rcan.0.cs
- %TEMP%\fsb3rcan.pdb
- %TEMP%\fsb3rcan.cmdline
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\j0wudfst.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEC33.tmp" "%TEMP%\CSCEC22.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fsb3rcan.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES25E8.tmp" "%TEMP%\CSC25D7.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\j0wudfst.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEC33.tmp" "%TEMP%\CSCEC22.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fsb3rcan.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES25E8.tmp" "%TEMP%\CSC25D7.tmp"
