Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\!!!_read_me_6c47cce7_!!!.txt
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\applicantform_en.doc
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
deletes volume shadow copies.
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- g:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini
- C:\users\public\documents\!!!_read_me_6c47cce7_!!!.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\!!!_read_me_6c47cce7_!!!.txt
- g:\!!!_read_me_6c47cce7_!!!.txt
- D:\!!!_read_me_6c47cce7_!!!.txt
- D:\$recycle.bin\!!!_read_me_6c47cce7_!!!.txt
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\!!!_read_me_6c47cce7_!!!.txt
- g:\$recycle.bin\!!!_read_me_6c47cce7_!!!.txt
- g:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\!!!_read_me_6c47cce7_!!!.txt
- g:\boot\!!!_read_me_6c47cce7_!!!.txt
- g:\boot\cs-cz\!!!_read_me_6c47cce7_!!!.txt
- g:\boot\da-dk\!!!_read_me_6c47cce7_!!!.txt
Sets the 'hidden' attribute to the following files
- g:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wbem\wmic.exe' shadowcopy delete' (with hidden window)
- '<SYSTEM32>\bcdedit.exe' /set {default} recoveryenabled No' (with hidden window)
- '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy IgnoreAllFailures' (with hidden window)
- '<SYSTEM32>\bcdedit.exe' /set {globalsettings} advancedoptions false' (with hidden window)
Executes the following
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\svchost.exe' -k swprv
- '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy IgnoreAllFailures
- '<SYSTEM32>\bcdedit.exe' /set {globalsettings} advancedoptions false
