Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'blue_skull' = '<Full path to file>'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'empty'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
blocks the following features:
- User Account Control (UAC)
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im explorer.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\000814251_video_01.avi
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
Modifies file system
Creates the following files
- C:\norm9.wav
- %TEMP%\wormlocker2.0.exe
- %HOMEPATH%\desktop\worm_tool.sys
- %HOMEPATH%\downloads\worm_tool.sys
Modifies the following files
- %HOMEPATH%\desktop\000814251_video_01.avi
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\icq.lnk
- %HOMEPATH%\desktop\mail.ru agent.lnk
- %HOMEPATH%\desktop\qip 2012.lnk
- %HOMEPATH%\desktop\telegram.lnk
- %HOMEPATH%\desktop\total commander 64 bit.lnk
Modifies user data files (Trojan.Encoder).
Network activity
Connects to
- 'gi##ub.com':443
- 'ra#.####ubusercontent.com':443
- 'cd#.##scordapp.com':443
TCP
Other
- 'gi##ub.com':443
- 'ra#.####ubusercontent.com':443
- 'cd#.##scordapp.com':443
UDP
- DNS ASK gi##ub.com
- DNS ASK ra#.####ubusercontent.com
- DNS ASK cd#.##scordapp.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\wormlocker2.0.exe'
- '<SYSTEM32>\cmd.exe' /k taskkill /f /im explorer.exe' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /k taskkill /f /im explorer.exe
