Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\join.avi.nermer
- <Drive name for removable media>:\archer.avi.nermer
- <Drive name for removable media>:\split.avi.nermer
- <Drive name for removable media>:\default.bmp.nermer
- <Drive name for removable media>:\dashborder_192.bmp.nermer
- <Drive name for removable media>:\dashborder_120.bmp.nermer
- <Drive name for removable media>:\dashborder_96.bmp.nermer
- <Drive name for removable media>:\dashborder_144.bmp.nermer
- <Drive name for removable media>:\contoso_1.cer.nermer
- <Drive name for removable media>:\pmd.cer.nermer
- <Drive name for removable media>:\testcertificate.cer.nermer
- <Drive name for removable media>:\ovp25012015.doc.nermer
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
deletes volume shadow copies.
Modifies file system
Creates the following files
- %WINDIR%\logs\windowsbackup\wbadmin.0.etl
- C:\totalcmd\wcmicons.inc.nermer
- C:\totalcmd\totalcmd64.exe.manifest.nermer
- C:\totalcmd\totalcmd.inc.nermer
- C:\far2\fareng.hlf.nermer
- C:\far2\farcze.lng.nermer
- C:\totalcmd\totalcmd.chm.nermer
- C:\totalcmd\tcuninst.wul.nermer
- C:\totalcmd\tcunin64.wul.nermer
- C:\totalcmd\size!.txt.nermer
- C:\totalcmd\sfxhead.sfx.nermer
- C:\totalcmd\wcuninst.wul.nermer
- C:\far2\far.map.nermer
- C:\totalcmd\keyboard.txt.nermer
- C:\far2\changelog_eng.nermer
- C:\totalcmd\history.txt.nermer
- C:\totalcmd\descript.ion.nermer
- C:\far2\addons\readme.txt.nermer
- C:\totalcmd\default.bar.nermer
- C:\far2\addons\descript.ion.nermer
- C:\far2\changelog.nermer
- D:\install.log.nermer
- %HOMEPATH%\desktop\protect_info.txt
- C:\totalcmd\no.bar.nermer
- C:\far2\fareng.lng.nermer
Deletes the following files
- <Drive name for removable media>:\ovp25012015.doc.nermer
Moves the following files
- from %WINDIR%\logs\windowsbackup\wbadmin.0.etl to %WINDIR%\logs\windowsbackup\wbadmin.1.etl
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- '18#.#06.144.18':80
TCP
HTTP POST requests
- http://18#.#06.144.18/repeater.php
Miscellaneous
Executes the following
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=c: /on=c: /maxsize=401MB
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=d: /on=d: /maxsize=401MB
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=e: /on=e: /maxsize=401MB
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=f: /on=f: /maxsize=401MB
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=g: /on=g: /maxsize=401MB
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=h: /on=h: /maxsize=401MB
- '<SYSTEM32>\vssadmin.exe' Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded
- '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTATEBACKUP
- '<SYSTEM32>\wbem\wmic.exe' SHADOWCOPY /nointeractive
