Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\systemupdate
Creates the following files on removable media
- <Drive name for removable media>:\how_to_recover_files.txt
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\1189.jpeg
- %HOMEPATH%\desktop\parnas_01.jpeg
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\ituneshelpunavailable.html
- %HOMEPATH%\desktop\ituneshelpunavailable.htm
- %HOMEPATH%\desktop\iisstart.htm
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\adadsi.html
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\3.jpeg
- %HOMEPATH%\desktop\168.jpeg
- %HOMEPATH%\desktop\13.jpeg
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\testcertificate.cer
Modifies file system
Creates the following files
- %APPDATA%\<File name>.exe
- %HOMEPATH%\desktop\how_to_recover_files.txt
- C:\users\default\how_to_recover_files.txt
- %HOMEPATH%\contacts\how_to_recover_files.txt
Modifies the following files
- C:\users\default\ntuser.dat.log1
- %HOMEPATH%\desktop\1189.jpeg
- %HOMEPATH%\contacts\user.contact
- %HOMEPATH%\desktop\13.jpeg
- %HOMEPATH%\desktop\168.jpeg
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\3.jpeg
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\adadsi.html
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\advice_process.htm
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- '<LOCALNET>.9.1':445
- '<LOCALNET>.9.1':139
Miscellaneous
Creates and executes the following
- '%APPDATA%\<File name>.exe'
- '%APPDATA%\<File name>.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c wmic SHADOWCOPY DELETE /nointeractive
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin DELETE BACKUP -deleteOldest
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin DELETE BACKUP -keepVersions:0
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin Delete Shadows /All /Quiet
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} recoveryenabled No
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\taskeng.exe' {5971F1E9-6CC3-487B-85C1-1183B9B1DA11} S-1-5-21-1238866942-1249195528-555854008-1000:olcghwkcdtk\user:Interactive:[1]
