Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss.exe' = '"%APPDATA%\Microsoft\Windows\csrss.exe" -start'
Creates the following files on removable media
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\asaprojectcompetition.pptx
- <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
- <Drive name for removable media>:\notepad.exe
- <Drive name for removable media>:\winmine.exe
- <Drive name for removable media>:\tcm851ax32.exe
- <Drive name for removable media>:\skypesetup.exe
- <Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe
- <Drive name for removable media>:\wrar520.exe
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\!!! all your files are encrypted !!!.txt
- <Drive name for removable media>:\middaugh_keynote.pptx
- <Drive name for removable media>:\hypothyroidism_slides.pptx
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Injects code into
the following system processes:
- %WINDIR%\syswow64\notepad.exe
Modifies file system
Creates the following files
- %TEMP%\af97840a.zeppelin
- C:\far2\plugins\align\!!! all your files are encrypted !!!.txt
- C:\far2\plugins\arclite\!!! all your files are encrypted !!!.txt
- C:\far2\plugins\autowrap\!!! all your files are encrypted !!!.txt
- C:\far2\plugins\brackets\!!! all your files are encrypted !!!.txt
- C:\far2\plugins\compare\!!! all your files are encrypted !!!.txt
- C:\far2\plugins\drawline\!!! all your files are encrypted !!!.txt
- C:\far2\plugins\editcase\!!! all your files are encrypted !!!.txt
- C:\far2\addons\!!! all your files are encrypted !!!.txt
- C:\far2\plugins\emenu\!!! all your files are encrypted !!!.txt
- C:\far2\plugins\filecase\!!! all your files are encrypted !!!.txt
- C:\far2\plugins\ftp\!!! all your files are encrypted !!!.txt
- C:\far2\plugins\ftp\lib\!!! all your files are encrypted !!!.txt
- C:\far2\plugins\hlfviewer\!!! all your files are encrypted !!!.txt
- C:\far2\plugins\macroview\!!! all your files are encrypted !!!.txt
- C:\far2\plugins\network\!!! all your files are encrypted !!!.txt
- C:\far2\plugins\proclist\!!! all your files are encrypted !!!.txt
- C:\far2\encyclopedia\tap\!!! all your files are encrypted !!!.txt
- C:\far2\fexcept\!!! all your files are encrypted !!!.txt
- C:\far2\encyclopedia\!!! all your files are encrypted !!!.txt
- C:\far2\documentation\rus\!!! all your files are encrypted !!!.txt
- C:\far2\documentation\eng\!!! all your files are encrypted !!!.txt
- %TEMP%\c0962ce2.zeppelin
- %TEMP%\~temp001.bat
- D:\$recycle.bin\.zeppelin
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.zeppelin
- C:\$recycle.bin\.zeppelin
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.zeppelin
- <Current directory>\.zeppelin
- C:\far2\plugins\tmppanel\!!! all your files are encrypted !!!.txt
- C:\far2\plugins\farcmds\!!! all your files are encrypted !!!.txt
- C:\far2\!!! all your files are encrypted !!!.txt
- C:\far2\addons\colors\custom_highlighting\!!! all your files are encrypted !!!.txt
- C:\far2\addons\colors\default_highlighting\!!! all your files are encrypted !!!.txt
- C:\far2\addons\macros\!!! all your files are encrypted !!!.txt
- C:\far2\addons\setup\!!! all your files are encrypted !!!.txt
- C:\far2\addons\shell\!!! all your files are encrypted !!!.txt
- C:\far2\addons\xlat\!!! all your files are encrypted !!!.txt
- C:\far2\addons\xlat\russian\!!! all your files are encrypted !!!.txt
- %APPDATA%\microsoft\windows\csrss.exe
- C:\far2\addons\colors\!!! all your files are encrypted !!!.txt
- C:\far2\pluginsdk\headers.c\!!! all your files are encrypted !!!.txt
Deletes the following files
- %TEMP%\af97840a.zeppelin
- %TEMP%\c0962ce2.zeppelin
Deletes itself.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
TCP
HTTP GET requests
- http://ge###tool.com/
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://ip###ger.org/1yTkr7.txt
- http://oc##.#ectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEGmjTouN%2FW5s3CDseaiw7qE%3D
- http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
UDP
- DNS ASK ge###tool.com
- DNS ASK ge###tatool.com
- DNS ASK microsoft.com
- DNS ASK ip###ger.org
- DNS ASK oc##.#ectigo.com
- DNS ASK oc##.thawte.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\csrss.exe' -start
- '%APPDATA%\microsoft\windows\csrss.exe' -agent 0
- '%APPDATA%\microsoft\windows\csrss.exe' -agent 1
- '%APPDATA%\microsoft\windows\csrss.exe' -agent 2
- '%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C %TEMP%\~temp001.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\notepad.exe'
- '%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet
- '%WINDIR%\syswow64\cmd.exe' /C %TEMP%\~temp001.bat
