Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'XO1XADpO01' = '"<Full path to file>"'
Creates the following files on removable media
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\samieee_obiee_presentation.pptx
- <Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
- <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
- <Drive name for removable media>:\weeklysheet1215.doc
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\indogerman2010.pptx
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\restore-my-files.txt
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\hypothyroidism_slides.pptx
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- D:\restore-my-files.txt
- C:\far2\addons\colors\custom_highlighting\restore-my-files.txt
- C:\far2\addons\colors\default_highlighting\restore-my-files.txt
- C:\far2\addons\colors\restore-my-files.txt
- C:\far2\addons\restore-my-files.txt
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- '<LOCALNET>.74.254':445
- '<LOCALNET>.74.196':445
- '<LOCALNET>.74.209':135
- '<LOCALNET>.74.210':135
- '<LOCALNET>.74.211':135
- '<LOCALNET>.74.212':135
- '<LOCALNET>.74.213':135
- '<LOCALNET>.74.214':135
- '<LOCALNET>.74.197':445
- '<LOCALNET>.74.198':445
- '<LOCALNET>.74.199':445
- '<LOCALNET>.74.200':445
- '<LOCALNET>.74.207':135
- '<LOCALNET>.74.208':135
- '<LOCALNET>.74.201':445
- '<LOCALNET>.74.210':445
- '<LOCALNET>.74.202':445
- '<LOCALNET>.74.204':445
- '<LOCALNET>.74.205':445
- '<LOCALNET>.74.206':445
- '<LOCALNET>.74.226':135
- '<LOCALNET>.74.227':135
- '<LOCALNET>.74.228':135
- '<LOCALNET>.74.229':135
- '<LOCALNET>.74.207':445
- '<LOCALNET>.74.208':445
- '<LOCALNET>.74.221':135
- '<LOCALNET>.74.222':135
- '<LOCALNET>.74.223':135
- '<LOCALNET>.74.224':135
- '<LOCALNET>.74.225':135
- '<LOCALNET>.74.203':445
- '<LOCALNET>.74.209':445
- '<LOCALNET>.74.195':445
- '<LOCALNET>.74.194':135
- '<LOCALNET>.74.189':445
- '<LOCALNET>.74.188':445
- '<LOCALNET>.74.187':445
- '<LOCALNET>.74.186':445
- '<LOCALNET>.74.185':445
- '<LOCALNET>.74.202':135
- '<LOCALNET>.74.184':445
- '<LOCALNET>.74.226':445
- '<LOCALNET>.74.183':445
- '<LOCALNET>.74.200':135
- '<LOCALNET>.74.199':135
- '<LOCALNET>.74.198':135
- '<LOCALNET>.74.197':135
- '<LOCALNET>.74.182':445
- '<LOCALNET>.74.220':135
- '<LOCALNET>.74.194':445
- '<LOCALNET>.74.195':135
- '<LOCALNET>.74.196':135
- '<LOCALNET>.74.191':445
- '<LOCALNET>.74.192':445
- '<LOCALNET>.74.193':445
- '<LOCALNET>.74.203':135
- '<LOCALNET>.74.204':135
- '<LOCALNET>.74.205':135
- '<LOCALNET>.74.206':135
- '<LOCALNET>.74.215':135
- '<LOCALNET>.74.216':135
- '<LOCALNET>.74.217':135
- '<LOCALNET>.74.218':135
- '<LOCALNET>.74.219':135
- '<LOCALNET>.74.190':445
- '<LOCALNET>.74.211':445
- '<LOCALNET>.74.212':445
- '<LOCALNET>.74.213':445
- '<LOCALNET>.74.233':445
- '<LOCALNET>.74.234':445
- '<LOCALNET>.74.235':445
- '<LOCALNET>.74.236':445
- '<LOCALNET>.74.237':445
- '<LOCALNET>.74.238':445
- '<LOCALNET>.74.239':445
- '<LOCALNET>.74.240':445
- '<LOCALNET>.74.251':135
- '<LOCALNET>.74.250':135
- '<LOCALNET>.74.249':135
- '<LOCALNET>.74.248':135
- '<LOCALNET>.74.247':135
- '<LOCALNET>.74.231':445
- '<LOCALNET>.74.254':135
- '<LOCALNET>.74.253':135
- '<LOCALNET>.74.241':445
- '<LOCALNET>.74.242':445
- '<LOCALNET>.74.243':445
- '<LOCALNET>.74.244':445
- '<LOCALNET>.74.245':445
- '<LOCALNET>.74.246':445
- '<LOCALNET>.74.247':445
- '<LOCALNET>.74.248':445
- '<LOCALNET>.74.249':445
- '<LOCALNET>.74.250':445
- '<LOCALNET>.74.251':445
- '<LOCALNET>.74.253':445
- '<LOCALNET>.74.252':445
- '<LOCALNET>.74.252':135
- '<LOCALNET>.74.230':445
- '<LOCALNET>.74.232':445
- '<LOCALNET>.74.241':135
- '<LOCALNET>.74.214':445
- '<LOCALNET>.74.238':135
- '<LOCALNET>.74.215':445
- '<LOCALNET>.74.216':445
- '<LOCALNET>.74.217':445
- '<LOCALNET>.74.218':445
- '<LOCALNET>.74.219':445
- '<LOCALNET>.74.220':445
- '<LOCALNET>.74.230':135
- '<LOCALNET>.74.231':135
- '<LOCALNET>.74.232':135
- '<LOCALNET>.74.233':135
- '<LOCALNET>.74.234':135
- '<LOCALNET>.74.235':135
- '<LOCALNET>.74.236':135
- '<LOCALNET>.74.237':135
- '<LOCALNET>.74.239':135
- '<LOCALNET>.74.246':135
- '<LOCALNET>.74.240':135
- '<LOCALNET>.74.221':445
- '<LOCALNET>.74.222':445
- '<LOCALNET>.74.223':445
- '<LOCALNET>.74.224':445
- '<LOCALNET>.74.225':445
- '<LOCALNET>.74.201':135
- '<LOCALNET>.74.227':445
- '<LOCALNET>.74.228':445
- '<LOCALNET>.74.229':445
- '<LOCALNET>.74.242':135
- '<LOCALNET>.74.243':135
- '<LOCALNET>.74.244':135
- '<LOCALNET>.74.245':135
- '<LOCALNET>.74.181':445
- '<LOCALNET>.74.180':445
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...
