Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'Client Server Runtime Subsystem' = '"%PROGRAMDATA%\Windows\csrss.exe"'
Creates the following files on removable media
- <Drive name for removable media>:\readme1.txt
- <Drive name for removable media>:\readme2.txt
- <Drive name for removable media>:\readme3.txt
- <Drive name for removable media>:\readme4.txt
- <Drive name for removable media>:\readme5.txt
- <Drive name for removable media>:\readme6.txt
- <Drive name for removable media>:\readme7.txt
- <Drive name for removable media>:\readme8.txt
- <Drive name for removable media>:\readme9.txt
- <Drive name for removable media>:\readme10.txt
Malicious functions
Creates and executes the following
- '%TEMP%\rad55511.tmp'
Injects code into
the following user processes:
- rad55511.tmp
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\tree_view.htm
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\alert.html
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\garden.htm
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\000814251_video_01.avi
- %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
- %TEMP%\rad55511.tmp
- C:\readme8.txt
- C:\readme7.txt
- C:\readme6.txt
- C:\readme5.txt
- C:\readme4.txt
- C:\readme3.txt
- C:\readme2.txt
- C:\readme1.txt
- D:\readme10.txt
- D:\readme9.txt
- D:\readme8.txt
- C:\readme9.txt
- D:\readme7.txt
- D:\readme5.txt
- D:\readme4.txt
- D:\readme3.txt
- D:\readme2.txt
- D:\readme1.txt
- %TEMP%\6893a5~1\cached-microdescs.new
- %TEMP%\6893a5~1\cached-microdesc-consensus.tmp
- %TEMP%\6893a5~1\cached-certs.tmp
- %TEMP%\6893a5~1\unverified-microdesc-consensus.tmp
- %TEMP%\6893a5~1\state.tmp
- %PROGRAMDATA%\windows\csrss.exe
- D:\readme6.txt
- C:\readme10.txt
Deletes the following files
- %TEMP%\6893a5~1\unverified-microdesc-consensus
Moves the following files
- from %TEMP%\6893a5~1\state.tmp to %TEMP%\6893a5~1\state
- from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\databases\databases.db to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\databases\ymvvhxjsscr20+8slyqcpiy6mgq-niak+ooz8f0klum=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\opera software\opera stable\extension state\000007.log to %APPDATA%\opera software\opera stable\extension state\4vkdzbr2p+gd3muvkr5shr3jolk1mixg3v-pvoqp+gy=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\opera software\opera stable\dictionaries\dictionaries.xml to %APPDATA%\opera software\opera stable\dictionaries\to8evwhg3cefassjm5f8aui56ttjoxsk+6kx6r0r71i=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\opera software\opera stable\databases\databases.db to %APPDATA%\opera software\opera stable\databases\5ad-fd8y3ib-taxjsadxjba-vvbinxx8va0lcn4yfcm=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\opera software\opera stable\thumbnails.db to %APPDATA%\opera software\opera stable\cja8kub9cqrvz8zopfqgynh0+szrv5cmnewatxwoava=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\opera software\opera stable\siteprefs.json to %APPDATA%\opera software\opera stable\3dnaluev0to1le8t9oqkrgopqejg-7+rtms6yht1td8=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\opera software\opera stable\session.db to %APPDATA%\opera software\opera stable\hif0qsyxv+tm2ep9vpkokwijkq2hgldi6jul98p3dfq=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt to %APPDATA%\opera software\opera stable\epvbt-prjekxini4vtk8ym8nxob9qsifm0gy3fhk2xxae3pj6ylpx4w2yht4bnmw.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\opera software\opera stable\opera_autoupdate.log to %APPDATA%\opera software\opera stable\mqw47eletmzdjqo3d7g8y6t1q5eixtvstjcivuk-mgpridcnljgzj00aqnpzukla.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\opera software\opera stable\favorites.db to %APPDATA%\opera software\opera stable\lx-uafgtlixiiez2t6diuzalbq9pmfwkuaiy-gaqf3k=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\opera software\opera stable\update_prefs.json to %APPDATA%\opera software\opera stable\zh-goovovmswxy1bap4kpxiggjaud3l4u-o2ar9gc3donrti8rtj8xj2h48mntfk.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\opera software\opera stable\bookmarks.bak to %APPDATA%\opera software\opera stable\fqsih6wud9g6mhxyfa+wz2jtibjpwm2efzdczgx+558=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\xulstore.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\xctnhgta+rhiqq+m1qsy24rgiytwpatoia5e16dwzzw=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\mra\update\ver.txt to %APPDATA%\mra\update\xbykvnfdetaljo001iei5w==.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\mra\installerlang.xml to %APPDATA%\mra\tnro0ffleqotoudu95k1apo0tszsnh9q0nlkolhmdamiv+voy47d1myam-z1xh+f.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\recovery.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\riqbxifbi8v8sdsq7bunhkyhkcuunfolgdgwnkuvwl4=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\previous.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\sessionstore-backups\ldiujws8lwjls-8w6tvfikb372u2tcxrzlzsk4palw0=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webapps\webapps.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\webapps\2whhkgo9rt5ycymsj7sotp89f7+qjholmrss8ofx6ju=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting\ujfwqrmpm8-rnyol86bxomz4n8zjg4fw-zmjqfx0nds=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\secmod.db to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\uuwbmu605b8v2srzk6ctosc93j3z9aw+hb0au8o6y4s=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\search.json to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\pw0iowemwfbkux-b1ykbkmxvwgb8sqjr6eqaqb-f-nc=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\revocations.txt to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\nexig6vxpdly1iqfhdmgqwckxxntaho+fxbzovnwytw=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\ia3d2qivrhtnocr0cjo3rw==.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\pluginreg.dat to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\8a022x1bzvqzndfv7ebwpqp3pikvx+yyhiwk9e8a2ye=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\telegram desktop\log.txt to %APPDATA%\telegram desktop\4xgkxamafxph1zwi6i8wca==.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\opera software\opera stable\browser.js to %APPDATA%\opera software\opera stable\nm-kvcjx+n73jhuit8xhlvix7azywnhtz9xy8v4btui=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\telegram desktop\unins000.dat to %APPDATA%\telegram desktop\nmax6trtkldo9y7iq3ogivqae+zqmyze7udxeefv28i=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\session.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\ppufvbpesz3zqknlbiwbwvwowbnm9ma6vr9g8oimx6o=.a0a868d5c2f92eae6170.crypted000007
- from %TEMP%\6893a5~1\unverified-microdesc-consensus.tmp to %TEMP%\6893a5~1\unverified-microdesc-consensus
- from %TEMP%\6893a5~1\cached-certs.tmp to %TEMP%\6893a5~1\cached-certs
- from %TEMP%\6893a5~1\cached-microdesc-consensus.tmp to %TEMP%\6893a5~1\cached-microdesc-consensus
- from %APPDATA%\winamp\plugins\milkdrop2\milk2_msg.ini to %APPDATA%\winamp\plugins\milkdrop2\virwfxpghwlqx4eolyz9sdqz92hme7i4bmfq-gub+he=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\winamp\plugins\milkdrop2\milk2_img.ini to %APPDATA%\winamp\plugins\milkdrop2\vjvjtmp-swmygt7v6bmxccaoarrb19c-bwyynftvifc=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\winamp\winamp.ini to %APPDATA%\winamp\zr2xdi577k2qznxxzi7foawlibhl8erxqoxx4npvvh8=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\winamp\links.xml to %APPDATA%\winamp\mj+6ktubz1wdgm4bsfrctmhy-61c0xkqb0icxhznjjc=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\winamp\demo.mp3 to %APPDATA%\winamp\yhd0clvialjakqh7ttq1xa==.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\virtualfolders.dat to %APPDATA%\thunderbird\profiles\wjj9aet2.default\eqafcg9-83sgctltpdbp7yrrh5uqemq5k7k-3gie6c7a--ntlg4b9boew0re7scv.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\times.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\xzwc+l5w+ipdltthiiirh1sbzubgiozgij6jdg2gpfi=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\aa5ve4xwygqltafkzoajbcnlg2vn4yeu9hg-5ptfwmmlydpyq1v683jecn7fddqy.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\secmod.db to %APPDATA%\thunderbird\profiles\wjj9aet2.default\whryi-vuxdezafktxita+i+bogync-il+a8uyso2xkc=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\telegram desktop\tdata\shortcuts-default.json to %APPDATA%\telegram desktop\tdata\ozb1p7gtgbkubbtgvjpsroiklrtftz-v-tpydzpuw1vzikclexgl0qu2odl3j9gy.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\prefs.js to %APPDATA%\thunderbird\profiles\wjj9aet2.default\hi+baqynq72rmki99p6ncq==.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\mailviews.dat to %APPDATA%\thunderbird\profiles\wjj9aet2.default\dw1lmbr8cns40ha+q61cqdd30z8pwj3m5e6zq+xqmz0=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\localstore.rdf to %APPDATA%\thunderbird\profiles\wjj9aet2.default\q8xldixnyjjdt7-n-vsavlsbnptigf5c-jk8lyg1cdq=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\key3.db to %APPDATA%\thunderbird\profiles\wjj9aet2.default\kqhddzzyidwsobyujqwxua==.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\foldertree.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\zfw6cp88xsf+esyl4kysxyzxo+jdyhn2bsl10fdknuw=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.json to %APPDATA%\thunderbird\profiles\wjj9aet2.default\unjxyydwxhkbmtai4jusobrhu6lpf88vdq1jdmeako0=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\extensions.ini to %APPDATA%\thunderbird\profiles\wjj9aet2.default\yoo9psxzsonpmiaatbzl9xswzzavfgdq1qwta3pkuua=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\compatibility.ini to %APPDATA%\thunderbird\profiles\wjj9aet2.default\khk+zyfybbsxjrpjjydhgr-ki0vwl4waozl80moec+lqrjdjhd+miceuai4lvfcc.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\cert8.db to %APPDATA%\thunderbird\profiles\wjj9aet2.default\wep90rscute2b-kcsyjl0w==.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\thunderbird\profiles\wjj9aet2.default\blocklist.xml to %APPDATA%\thunderbird\profiles\wjj9aet2.default\dh0cytlg1oralgz0-wio6a52p4kxwkys1jnikldi4rk=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\lpshvp7jg6kfx5l2+ut0wqx1m41dtlauo5vmth-czmc=.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\telegram desktop\tdata\shortcuts-custom.json to %APPDATA%\telegram desktop\tdata\5dkcwdbvyozt4qee3saxujgglhygbdstgjkgg6swo08chln2+wvaddbewuoi4rb4.a0a868d5c2f92eae6170.crypted000007
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\mimetypes.rdf to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\y2uudyp8eg+ekmnbmlsudi-izclxdil1wsxlnhmhuue=.a0a868d5c2f92eae6170.crypted000007
Deletes itself.
Modifies user data files (Trojan.Encoder).
Network activity
TCP
HTTP GET requests
- http://sa###dninth.com/templates/beez/html/com_contact/category/2c.jpg
- http://ip#####.#hatismyipaddress.com/
- http://a4#####2xzclh6fd.onion/reg.php?i=##################################
UDP
- DNS ASK sa###dninth.com
- DNS ASK ip#####.#hatismyipaddress.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c %TEMP%\rad55511.tmp' (with hidden window)
- '<SYSTEM32>\vssadmin.exe' List Shadows' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c %TEMP%\rad55511.tmp
- '<SYSTEM32>\vssadmin.exe' List Shadows
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\svchost.exe' -k swprv
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\chcp.com'
