Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'DECRYPTINFO' = '"%APPDATA%\!#_RESTORE_FILES_#!.inf"'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\desktop.ini
- %HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\desktop.ini
Malicious functions:
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Executes the following:
- '<SYSTEM32>\cmd.exe' /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\cmd.exe' /c bcdedit.exe /set {default} recoveryenabled No
- '<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet
Modifies file system:
Creates the following files:
- %APPDATA%\Microsoft\Address Book\!#_RESTORE_FILES_#!.inf
- %APPDATA%\Microsoft\Internet Explorer\!#_RESTORE_FILES_#!.inf
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\!#_RESTORE_FILES_#!.inf
- %APPDATA%\Microsoft\Media Player\!#_RESTORE_FILES_#!.inf
- %APPDATA%\Mozilla\Firefox\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Cookies\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Favorites\!#_RESTORE_FILES_#!.inf
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\!#_RESTORE_FILES_#!.inf
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\!#_RESTORE_FILES_#!.inf
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\Local Settings\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\Local Settings\History\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Recent\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\SendTo\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\My Documents\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\My Documents\My Music\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\My Documents\My Pictures\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Start Menu\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Start Menu\Programs\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Templates\!#_RESTORE_FILES_#!.inf
- C:\Far2\Addons\Colors\Custom Highlighting\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Start Menu\Programs\Accessories\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Local Settings\<INETFILES>\!#_RESTORE_FILES_#!.inf
- <LS_APPDATA>\Microsoft\Media Player\!#_RESTORE_FILES_#!.inf
- <LS_APPDATA>\Microsoft\Windows Media\9.0\!#_RESTORE_FILES_#!.inf
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Favorites\Links\!#_RESTORE_FILES_#!.inf
- <LS_APPDATA>\!#_RESTORE_FILES_#!.inf
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\!#_RESTORE_FILES_#!.inf
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Local Settings\History\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Local Settings\History\History.IE5\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\!#_RESTORE_FILES_#!.inf
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\!#_RESTORE_FILES_#!.inf
- <LS_APPDATA>\VMware\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Local Settings\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\DRM\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Documents\My Pictures\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Documents\My Videos\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Application Data\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\!#_RESTORE_FILES_#!.inf
- %APPDATA%\!#_RESTORE_FILES_#!.inf
- <Current directory>\!#_RESTORE_FILES_#!.inf
- C:\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Documents\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Documents\My Music\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\SendTo\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Start Menu\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Start Menu\Programs\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\Application Data\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\History\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Templates\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Cookies\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Application Data\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Cookies\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\History\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\!#_RESTORE_FILES_#!.inf
Moves the following files:
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\mimeTypes.rdf to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\mimeTypes.rdf.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\localstore.rdf to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\localstore.rdf.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\winscp.rnd to %APPDATA%\winscp.rnd.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\profiles.ini to %APPDATA%\Mozilla\Firefox\profiles.ini.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Microsoft\Internet Explorer\Desktop.htt to %APPDATA%\Microsoft\Internet Explorer\Desktop.htt.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Microsoft\Address Book\%USERNAME%.wab to %APPDATA%\Microsoft\Address Book\%USERNAME%.wab.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\desktop.ini to %APPDATA%\desktop.ini.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~ to %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Microsoft\Internet Explorer\brndlog.txt to %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Microsoft\Internet Explorer\brndlog.bak to %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Microsoft\Media Player\0007F0B7.wpl to %APPDATA%\Microsoft\Media Player\0007F0B7.wpl.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarks.html to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarks.html.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css.[3bitcoins@protonmail.com].blocking
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.[3bitcoins@protonmail.com].blocking
Modifies user data files (Trojan.Encoder).
