Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\video.mp4
- <Drive name for removable media>:\nwfieldnotes1966.docx
- <Drive name for removable media>:\hadac_newsletter_july_2010_final.docx
- <Drive name for removable media>:\correct.avi
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\microsoft office\office10\47a26f-readme.txt
- C:\users\public\libraries\47a26f-readme.txt
- D:\47a26f-readme.txt
- C:\far2\addons\47a26f-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\47a26f-readme.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\steam\47a26f-readme.txt
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\47a26f-readme.txt
- %HOMEPATH%\contacts\47a26f-readme.txt
Moves the following files
- from %ProgramFiles(x86)%\microsoft office\office10\thdic.lex to %ProgramFiles(x86)%\microsoft office\office10\thdic.lex.47a26f
- from %ProgramFiles(x86)%\microsoft office\office10\trigram.lex to %ProgramFiles(x86)%\microsoft office\office10\trigram.lex.47a26f
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest.47a26f
- from %ProgramFiles(x86)%\k-lite codec pack\info\faq.css to %ProgramFiles(x86)%\k-lite codec pack\info\faq.css.47a26f
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini.47a26f
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der.47a26f
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig.47a26f
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\base_uris.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\base_uris.js.47a26f
Modifies the following files
- <Drive name for removable media>:\correct.avi
- C:\far2\addons\readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini
- C:\far2\farspa.lng
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\steam\steam support center.url
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest
- %ProgramFiles(x86)%\k-lite codec pack\info\faq.css
- %HOMEPATH%\favorites\links\web slice gallery.url
- %HOMEPATH%\favorites\links\suggested sites.url
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\winre.wim
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\boot.sdi
- %HOMEPATH%\contacts\user.contact
- C:\users\public\libraries\recordedtv.library-ms
- %ProgramFiles(x86)%\microsoft office\office10\trigram.lex
- %ProgramFiles(x86)%\microsoft office\office10\thdic.lex
- C:\far2\changelog_eng
- C:\far2\changelog
- D:\install.log
- <Drive name for removable media>:\4f0bf7ff71f28.jpg
- <Drive name for removable media>:\parnas_01.jpg
- <Drive name for removable media>:\glidescope_review_rev_010.docx
- <Drive name for removable media>:\hadac_newsletter_july_2010_final.docx
- <Drive name for removable media>:\nwfieldnotes1966.docx
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\archer.avi
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig
- C:\far2\far.map
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
