Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Command Prompt (CMD)
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
modifies the following system settings:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\168.jpg
- %HOMEPATH%\desktop\trivial-merge.htm
- %HOMEPATH%\desktop\testee.cer
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\region-north-karelia.jpg
- %HOMEPATH%\desktop\region-north-karelia.jpeg
- %HOMEPATH%\desktop\parnas_01.jpeg
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\iisstart.html
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\contosoroot.cer
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\adadsi.html
- %HOMEPATH%\desktop\64bit_notes.htm
- %HOMEPATH%\desktop\3.jpeg
- %HOMEPATH%\desktop\210252809.jpeg
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
Modifies file system
Creates the following files
- %HOMEPATH%\desktop\pagame lo que me debes perra1.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra74.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra73.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra72.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra71.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra70.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra69.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra68.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra67.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra66.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra65.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra64.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra63.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra62.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra61.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra60.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra59.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra58.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra57.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra56.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra55.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra54.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra52.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra53.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra75.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra76.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra98.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra97.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra96.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra95.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra94.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra93.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra92.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra91.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra90.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra89.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra87.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra37.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra86.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra85.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra84.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra83.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra82.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra81.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra80.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra79.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra78.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra77.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra51.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra50.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra49.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra21.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra20.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra19.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra18.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra17.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra16.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra15.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra14.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra13.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra12.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra11.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra10.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra9.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra8.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra7.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra6.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra5.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra4.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra3.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra2.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra23.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra24.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra22.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra25.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra48.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra26.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra47.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra46.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra45.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra44.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra43.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra42.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra41.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra40.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra39.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra88.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra99.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra36.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra35.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra34.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra33.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra32.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra31.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra30.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra29.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra28.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra27.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra38.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra100.txt
Modifies the following files
- %HOMEPATH%\desktop\168.jpg
- %LOCALAPPDATA%\google\chrome\user data\default\cache\data_1
- %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cookie\cookies
- %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cookie\cookies-journal
- %LOCALAPPDATA%\adobe\color\acecache11.lst
- %LOCALAPPDATA%\google\chrome\user data\chrome_shutdown_ms.txt
- %LOCALAPPDATA%\adobe\color\profiles\wscrgb.icc
- %LOCALAPPDATA%\adobe\color\profiles\wsrgb.icc
- %LOCALAPPDATA%\applicationhistory\ngen.exe.2c05686e.ini
- C:\users\public\desktop\acrobat reader dc.lnk
- C:\users\public\desktop\google chrome.lnk
- C:\users\public\desktop\mirc.lnk
- C:\users\public\desktop\mozilla firefox.lnk
- C:\users\public\desktop\mozilla thunderbird.lnk
- C:\users\public\desktop\opera.lnk
- C:\users\public\desktop\steam.lnk
- C:\users\public\desktop\winamp.lnk
- %HOMEPATH%\desktop\total commander 64 bit.lnk
- %HOMEPATH%\desktop\telegram.lnk
- %HOMEPATH%\desktop\qip 2012.lnk
- %HOMEPATH%\desktop\mail.ru agent.lnk
- %HOMEPATH%\desktop\icq.lnk
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\adadsi.html
- %HOMEPATH%\desktop\64bit_notes.htm
- %HOMEPATH%\desktop\3.jpeg
- %HOMEPATH%\desktop\210252809.jpeg
- %LOCALAPPDATA%\google\chrome\user data\default\cache\f_000001
- %LOCALAPPDATA%\google\chrome\user data\default\cache\f_000003
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'di##ord.com':443
TCP
Other
- 'di##ord.com':443
UDP
- DNS ASK di##ord.com
