Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Defender' = '%APPDATA%\Firewall and Security.{4026492F-2F69-46B8-B9BF-5654FC07E423}\defender.exe *'
Creates the following files on removable media
- <Drive name for removable media>:\---readme---.txt
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\ituneshelpunavailable.htm
- %HOMEPATH%\desktop\garden.htm
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\adadsi.html
- %HOMEPATH%\desktop\tree_view.html
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %TEMP%\0a8068fb.vega
- %APPDATA%\firewall and security.{4026492f-2f69-46b8-b9bf-5654fc07e423}\defender.exe
- %TEMP%\bd9c4d74.vega
- %HOMEPATH%\desktop\---readme---.txt
- D:\---readme---.txt
Deletes the following files
- %TEMP%\0a8068fb.vega
- %TEMP%\bd9c4d74.vega
Deletes itself.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%APPDATA%\firewall and security.{4026492f-2f69-46b8-b9bf-5654fc07e423}\defender.exe' *
- '%WINDIR%\syswow64\cmd.exe' /c md "%APPDATA%\Firewall and Security.{4026492F-2F69-46B8-B9BF-5654FC07E423}" & copy "<Full path to file>" "%APPDATA%\Firewall and Security.{4026492F-2F69-46B8-B9BF-5654FC07E423}\defender.exe"...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c for /l %x in (1,1,9999) do ( ping -n 3 127.1 & del "<Full path to file>" & if not exist "<Full path to file>" exit )' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c md "%APPDATA%\Firewall and Security.{4026492F-2F69-46B8-B9BF-5654FC07E423}" & copy "<Full path to file>" "%APPDATA%\Firewall and Security.{4026492F-2F69-46B8-B9BF-5654FC07E423}\defender.exe"...
- '%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Defender" /t REG_SZ /F /D "%APPDATA%\Firewall and Security.{4026492F-2F69-46B8-B9BF-5654FC07E423}\defender.exe *"
- '%WINDIR%\syswow64\cmd.exe' /c for /l %x in (1,1,9999) do ( ping -n 3 127.1 & del "<Full path to file>" & if not exist "<Full path to file>" exit )
- '%WINDIR%\syswow64\ping.exe' -n 3 127.1
