Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'XO1XADpO01' = '"%TEMP%\3B2D.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent f29ef12526085ad0
- %WINDIR%\tasks\ihthsg.job
Creates the following files on removable media
- <Drive name for removable media>:\restore-my-files.txt
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\holycrosschurchinstructions.docx
- <Drive name for removable media>:\thlps_keeper_mayer_1965.docx
- <Drive name for removable media>:\issi2013_template_for_posters.docx
- <Drive name for removable media>:\sdszfo.docx
- <Drive name for removable media>:\garden.htm
- <Drive name for removable media>:\alert.htm
- <Drive name for removable media>:\trivial-merge.htm
- <Drive name for removable media>:\browse.htm
- <Drive name for removable media>:\iisstart.htm
- <Drive name for removable media>:\ituneshelpunavailable.htm
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\d47f.tmp
- %APPDATA%\riwwuff
- %APPDATA%\wcjvwbc
- %TEMP%\2616.exe
- %TEMP%\3b2d.exe
- %TEMP%\5236.exe
- %ALLUSERSPROFILE%\aehkorv\ihthsg.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\riwwuff
- %APPDATA%\wcjvwbc
Deletes itself.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
TCP
HTTP GET requests
- http://bm####serv437.xyz/socks111.exe
- http://bm####serv437.xyz/lb777.exe
- http://bm####serv437.xyz/tau111.exe
HTTP POST requests
- http://at####t20cx.best/statweb577/
UDP
- DNS ASK re###at35xm.xyz
- DNS ASK de###ot2cx.club
- DNS ASK at####t20cx.best
- DNS ASK bm####serv437.xyz
Miscellaneous
Creates and executes the following
- '%TEMP%\2616.exe'
- '%TEMP%\3b2d.exe'
- '%TEMP%\5236.exe'
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...
