Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'discord' = '%LOCALAPPDATA%\discord.exe'
Creates the following files on removable media
- <Drive name for removable media>:\usbdefender.exe
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\13.jpeg
- %HOMEPATH%\desktop\testee.cer
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\region-north-karelia.jpeg
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\tree_view.htm
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\168.jpeg
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\trivial-merge.htm
Modifies file system
Creates the following files
- %LOCALAPPDATA%\discord.exe
- %APPDATA%\id
- %APPDATA%\fondo_antiguo.jpg
- %HOMEPATH%\pictures\image2xtvdtimycfolfvjoaiqmdkud2ejur.jpg
- %HOMEPATH%\desktop\rexplonotes.txt
- %HOMEPATH%\downloads\rexplonotes.txt
- %HOMEPATH%\documents\rexplonotes.txt
- %HOMEPATH%\pictures\rexplonotes.txt
- %HOMEPATH%\music\rexplonotes.txt
- %HOMEPATH%\videos\rexplonotes.txt
- %APPDATA%\rexplonotes.txt
- %APPDATA%\usb_maker.bat
- D:\usbdefender.exe
Deletes the following files
- %HOMEPATH%\pictures\image2xtvdtimycfolfvjoaiqmdkud2ejur.jpg
Modifies the following files
- %HOMEPATH%\desktop\13.jpeg
- %HOMEPATH%\desktop\168.jpeg
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\icq.lnk
- %HOMEPATH%\desktop\mail.ru agent.lnk
- %HOMEPATH%\desktop\qip 2012.lnk
- %HOMEPATH%\desktop\telegram.lnk
- %HOMEPATH%\desktop\total commander 64 bit.lnk
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'su#########temprivate7.altervista.org':443
- 'microsoft.com':80
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'su#########temprivate7.altervista.org':443
UDP
- DNS ASK su#########temprivate7.altervista.org
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'SystemTray_Main' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c @echo off start mshta vbscript:Execute("window.moveTo -1000,-1000:Msgbox(""Your files are encrypted. You can try to recovery these using RExplo recovery tool. See RExplonotes.txt file for m...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\usb_maker.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\notepad.exe' %APPDATA%\RExplonotes.txt
- '%WINDIR%\syswow64\cmd.exe' /c @echo off start mshta vbscript:Execute("window.moveTo -1000,-1000:Msgbox(""Your files are encrypted. You can try to recovery these using RExplo recovery tool. See RExplonotes.txt file for m...
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\usb_maker.bat" "
