Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\testee.cer
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Modifies file system
Creates the following files
- C:\users\public\documents\rgnr_9e2d4d67.txt
- g:\boot\zh-tw\rgnr_9e2d4d67.txt
- g:\boot\zh-hk\rgnr_9e2d4d67.txt
- g:\boot\zh-cn\rgnr_9e2d4d67.txt
- g:\boot\tr-tr\rgnr_9e2d4d67.txt
- g:\boot\sv-se\rgnr_9e2d4d67.txt
- g:\boot\ru-ru\rgnr_9e2d4d67.txt
- g:\boot\pt-pt\rgnr_9e2d4d67.txt
- g:\boot\pt-br\rgnr_9e2d4d67.txt
- g:\boot\pl-pl\rgnr_9e2d4d67.txt
- g:\boot\nl-nl\rgnr_9e2d4d67.txt
- g:\boot\nb-no\rgnr_9e2d4d67.txt
- g:\boot\ko-kr\rgnr_9e2d4d67.txt
- g:\boot\ja-jp\rgnr_9e2d4d67.txt
- g:\boot\it-it\rgnr_9e2d4d67.txt
- g:\boot\hu-hu\rgnr_9e2d4d67.txt
- g:\boot\fr-fr\rgnr_9e2d4d67.txt
- g:\boot\fonts\rgnr_9e2d4d67.txt
- g:\boot\fi-fi\rgnr_9e2d4d67.txt
- g:\boot\es-es\rgnr_9e2d4d67.txt
- g:\boot\en-us\rgnr_9e2d4d67.txt
- g:\boot\el-gr\rgnr_9e2d4d67.txt
- g:\boot\de-de\rgnr_9e2d4d67.txt
- g:\boot\da-dk\rgnr_9e2d4d67.txt
- g:\boot\cs-cz\rgnr_9e2d4d67.txt
- g:\boot\rgnr_9e2d4d67.txt
- g:\boot\bootstat.dat
- g:\xeldz
Moves the following files
- from g:\boot\bootstat.dat to g:\boot\bootstat.dat.ragnar_9e2d4d67
- from g:\xeldz to g:\xeldz.ragnar_9e2d4d67
Modifies the following files
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\508softwareandos.doc
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wbem\wmic.exe' shadowcopy delete' (with hidden window)
- '<SYSTEM32>\vssadmin.exe' delete shadows /all /quiet' (with hidden window)
