Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\babyboymaintoscenesbackground_pal.wmv
- <Drive name for removable media>:\swc_2009-03-02.rdf
- <Drive name for removable media>:\taxus_baccata.rdf
- <Drive name for removable media>:\pubnet_855.rtf
- <Drive name for removable media>:\fungalnameauthors.rtf
- <Drive name for removable media>:\router_manual.rtf
- <Drive name for removable media>:\military_callsigns_0311.rtf
- <Drive name for removable media>:\phytoremediation.rtf
- <Drive name for removable media>:\waterlandhealthkano.rtf
- <Drive name for removable media>:\babyboymaintonotesbackground_pal.wmv
- <Drive name for removable media>:\digest.rdf
- <Drive name for removable media>:\elvisimp.rdf
- <Drive name for removable media>:\contenttypes.rdf
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\contosoroot.cer
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\testee.cer
Modifies file system
Creates the following files
- %TEMP%\mysbggzm.0.cs
- %ALLUSERSPROFILE%\microsoft toolkit\9f4dd1-readme.txt
- C:\far2\documentation\eng\9f4dd1-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\9f4dd1-readme.txt
- C:\totalcmd\9f4dd1-readme.txt
- %HOMEPATH%\favorites\links\9f4dd1-readme.txt
- %HOMEPATH%\desktop\9f4dd1-readme.txt
- C:\far2\9f4dd1-readme.txt
- C:\users\public\libraries\9f4dd1-readme.txt
- %HOMEPATH%\contacts\9f4dd1-readme.txt
- %ALLUSERSPROFILE%\microsoft\user account pictures\9f4dd1-readme.txt
- C:\users\public\pictures\sample pictures\9f4dd1-readme.txt
- D:\9f4dd1-readme.txt
- %TEMP%\res6d82.tmp
- %TEMP%\csc6d72.tmp
- %TEMP%\5iy0ll4g.out
- %TEMP%\5iy0ll4g.cmdline
- %TEMP%\5iy0ll4g.0.cs
- %TEMP%\mysbggzm.dll
- %TEMP%\res3708.tmp
- %TEMP%\csc36f7.tmp
- %TEMP%\mysbggzm.out
- %TEMP%\mysbggzm.cmdline
- %TEMP%\5iy0ll4g.dll
- %ProgramFiles(x86)%\k-lite codec pack\icaros\9f4dd1-readme.txt
Deletes the following files
- %TEMP%\res3708.tmp
- %TEMP%\csc36f7.tmp
- %TEMP%\mysbggzm.out
- %TEMP%\mysbggzm.cmdline
- %TEMP%\mysbggzm.pdb
- %TEMP%\mysbggzm.dll
- %TEMP%\mysbggzm.0.cs
- %TEMP%\res6d82.tmp
- %TEMP%\csc6d72.tmp
- %TEMP%\5iy0ll4g.cmdline
- %TEMP%\5iy0ll4g.out
- %TEMP%\5iy0ll4g.pdb
- %TEMP%\5iy0ll4g.0.cs
- %TEMP%\5iy0ll4g.dll
Moves the following files
- from %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt to %ProgramFiles(x86)%\k-lite codec pack\icaros\39e13780b176416ac0.9f4dd1
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\b1ec8ff75bc4595.9f4dd1
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\29eb186940258.9f4dd1
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\6c8ee1f.9f4dd1
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\0e45b89b576678207cc6e8a5a1fc31910c.9f4dd1
- from %ProgramFiles(x86)%\k-lite codec pack\icaros\resources\icarosdescriptions.propdesc to %ProgramFiles(x86)%\k-lite codec pack\icaros\resources\99c9852b3d400272fdd1c849f35.9f4dd1
- from %ProgramFiles(x86)%\mirc\mirc.chm to %ProgramFiles(x86)%\mirc\407c441a.9f4dd1
- from %ProgramFiles(x86)%\mirc\ircintro.chm to %ProgramFiles(x86)%\mirc\bae1f660bd78.9f4dd1
- from %ProgramFiles(x86)%\winamp\install.ini to %ProgramFiles(x86)%\winamp\0e5137ad64f.9f4dd1
- from %ProgramFiles(x86)%\k-lite codec pack\icaros\icaros license.txt to %ProgramFiles(x86)%\k-lite codec pack\icaros\ab70d22d34a9bb828e.9f4dd1
- from %ProgramFiles(x86)%\qip 2012\unins000.dat to %ProgramFiles(x86)%\qip 2012\5dbe129297e3.9f4dd1
- from %ProgramFiles(x86)%\opera\server_tracking_data to %ProgramFiles(x86)%\opera\66d558ec64d5ff36a0a1.9f4dd1
- from %ProgramFiles(x86)%\qip 2012\unins000.msg to %ProgramFiles(x86)%\qip 2012\42aa50e26efc.9f4dd1
- from %ProgramFiles(x86)%\opera\installation_status.xml to %ProgramFiles(x86)%\opera\e83e869f3dcdbe1dfb2b15b.9f4dd1
- from %ProgramFiles(x86)%\k-lite codec pack\unins000.dat to %ProgramFiles(x86)%\k-lite codec pack\af4a24d38a9e.9f4dd1
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\7ce917908f.9f4dd1
- from %ProgramFiles(x86)%\steam\thirdpartylegalnotices.doc to %ProgramFiles(x86)%\steam\thirdpartylegalnotices.doc.9f4dd1
- from %ProgramFiles(x86)%\steam\libav_h264-56.dll.md5 to %ProgramFiles(x86)%\steam\fa76f9c04366328904dba.9f4dd1
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mysbggzm.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3708.tmp" "%TEMP%\CSC36F7.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5iy0ll4g.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6D82.tmp" "%TEMP%\CSC6D72.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\mysbggzm.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3708.tmp" "%TEMP%\CSC36F7.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\5iy0ll4g.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6D82.tmp" "%TEMP%\CSC6D72.tmp"
