Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'WindowsUpdateCheck' = '<Full path to file>'
Creates or modifies the following files
- %HOMEPATH%\start menu\programs\startup\.c4d1664ef40ce18f8d41
Creates the following files on removable media
- <Drive name for removable media>:\.c4d1664ef40ce18f8d41
- <Drive name for removable media>:\notepad.exe
- <Drive name for removable media>:\tcm851ax32.exe
- <Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe
- <Drive name for removable media>:\winmine.exe
- <Drive name for removable media>:\utorrent.exe
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
- <Drive name for removable media>:\hanni_umami_chapter.doc
- <Drive name for removable media>:\cveuropeo.doc
- <Drive name for removable media>:\applicantform_en.doc
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\calc.exe
- <Drive name for removable media>:\skypesetup.exe
Malicious functions
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\local\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\accessories\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\accessories\how to back your files.txt
- %HOMEPATH%\start menu\programs\accessories\system tools\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\accessories\system tools\how to back your files.txt
- %HOMEPATH%\start menu\programs\accessories\accessibility\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\accessories\accessibility\how to back your files.txt
- %HOMEPATH%\sendto\.c4d1664ef40ce18f8d41
- %HOMEPATH%\sendto\compressed (zipped) folder.zfsendtotarget
- %HOMEPATH%\sendto\desktop (create shortcut).desklink
- %HOMEPATH%\sendto\mail recipient.mapimail
- %HOMEPATH%\sendto\how to back your files.txt
- %HOMEPATH%\searches\.c4d1664ef40ce18f8d41
- %HOMEPATH%\searches\how to back your files.txt
- %HOMEPATH%\start menu\programs\administrative tools\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\administrative tools\how to back your files.txt
- %HOMEPATH%\saved games\.c4d1664ef40ce18f8d41
- %HOMEPATH%\saved games\how to back your files.txt
- %HOMEPATH%\recent\customdestinations\9027fe24326910d2.customdestinations-ms
- %HOMEPATH%\recent\customdestinations\7e4dca80246863e3.customdestinations-ms
- %HOMEPATH%\recent\customdestinations\74d7f43c1561fc1e.customdestinations-ms
- z:\system volume information\.c4d1664ef40ce18f8d41
- z:\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\winrar\how to back your files.txt
- %HOMEPATH%\recent\customdestinations\5d696d521de238c3.customdestinations-ms
- %HOMEPATH%\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
- %HOMEPATH%\recent\customdestinations\28c8b86deab549a1.customdestinations-ms
- %HOMEPATH%\recent\customdestinations\1b4dd67f29cb1962.customdestinations-ms
- %HOMEPATH%\recent\customdestinations\10a2479c877ca098.customdestinations-ms
- %HOMEPATH%\recent\customdestinations\.c4d1664ef40ce18f8d41
- %HOMEPATH%\recent\how to back your files.txt
- %HOMEPATH%\recent\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\icq\how to back your files.txt
- %HOMEPATH%\start menu\programs\icq\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\mail.ru\how to back your files.txt
- <Current directory>\ids.txt
- %TEMP%\222.tmp\223.tmp\224.bat
- D:\.c4d1664ef40ce18f8d41
- D:\$recycle.bin\.c4d1664ef40ce18f8d41
- C:\.c4d1664ef40ce18f8d41
- D:\system volume information\.c4d1664ef40ce18f8d41
- C:\how to back your files.txt
- C:\users\.c4d1664ef40ce18f8d41
- C:\users\how to back your files.txt
- %HOMEPATH%\.c4d1664ef40ce18f8d41
- %HOMEPATH%\how to back your files.txt
- %HOMEPATH%\voip\.c4d1664ef40ce18f8d41
- %HOMEPATH%\voip\how to back your files.txt
- %HOMEPATH%\videos\.c4d1664ef40ce18f8d41
- %TEMP%\tmpf93c.tmp.exe
- %HOMEPATH%\videos\how to back your files.txt
- %HOMEPATH%\start menu\programs\mail.ru\.c4d1664ef40ce18f8d41
- %HOMEPATH%\templates\.c4d1664ef40ce18f8d41
- %HOMEPATH%\templates\how to back your files.txt
- %HOMEPATH%\start menu\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\how to back your files.txt
- %HOMEPATH%\start menu\programs\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\how to back your files.txt
- %HOMEPATH%\recent\customdestinations\5afe4de1b92fc382.customdestinations-ms
- %HOMEPATH%\start menu\programs\winrar\.c4d1664ef40ce18f8d41
- %HOMEPATH%\recent\customdestinations\969252ce11249fdd.customdestinations-ms
- %HOMEPATH%\start menu\programs\total commander\how to back your files.txt
- %HOMEPATH%\start menu\programs\telegram desktop\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\telegram desktop\how to back your files.txt
- %HOMEPATH%\start menu\programs\maintenance\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\maintenance\how to back your files.txt
- %HOMEPATH%\start menu\programs\total commander\.c4d1664ef40ce18f8d41
- %HOMEPATH%\recent\customdestinations\bf8efb871eda5262.customdestinations-ms
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\local\.c4d1664ef40ce18f8d41
- <Drive name for removable media>:\.c4d1664ef40ce18f8d41
- %HOMEPATH%\recent\customdestinations\.c4d1664ef40ce18f8d41
- %HOMEPATH%\recent\.c4d1664ef40ce18f8d41
- %HOMEPATH%\saved games\.c4d1664ef40ce18f8d41
- %HOMEPATH%\searches\.c4d1664ef40ce18f8d41
- %HOMEPATH%\sendto\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\accessories\accessibility\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\accessories\system tools\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\accessories\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\administrative tools\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\icq\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\mail.ru\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\maintenance\.c4d1664ef40ce18f8d41
- z:\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\startup\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\total commander\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\winrar\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\.c4d1664ef40ce18f8d41
- %HOMEPATH%\templates\.c4d1664ef40ce18f8d41
- %HOMEPATH%\videos\.c4d1664ef40ce18f8d41
- %HOMEPATH%\voip\.c4d1664ef40ce18f8d41
- %HOMEPATH%\.c4d1664ef40ce18f8d41
- C:\users\.c4d1664ef40ce18f8d41
- D:\system volume information\.c4d1664ef40ce18f8d41
- C:\.c4d1664ef40ce18f8d41
- D:\$recycle.bin\.c4d1664ef40ce18f8d41
- D:\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\programs\telegram desktop\.c4d1664ef40ce18f8d41
- z:\system volume information\.c4d1664ef40ce18f8d41
Deletes the following files
- %TEMP%\tmpf93c.tmp.exe
- %TEMP%\222.tmp\223.tmp\224.bat
Moves the following files
- from %HOMEPATH%\sendto\compressed (zipped) folder.zfsendtotarget to %HOMEPATH%\sendto\compressed (zipped) folder.zfsendtotarget.globeimposter-alpha865qqz
- from %HOMEPATH%\sendto\desktop (create shortcut).desklink to %HOMEPATH%\sendto\desktop (create shortcut).desklink.globeimposter-alpha865qqz
- from %HOMEPATH%\sendto\mail recipient.mapimail to %HOMEPATH%\sendto\mail recipient.mapimail.globeimposter-alpha865qqz
- from %HOMEPATH%\recent\customdestinations\10a2479c877ca098.customdestinations-ms to %HOMEPATH%\recent\customdestinations\10a2479c877ca098.customdestinations-ms.globeimposter-alpha865qqz
- from %HOMEPATH%\recent\customdestinations\1b4dd67f29cb1962.customdestinations-ms to %HOMEPATH%\recent\customdestinations\1b4dd67f29cb1962.customdestinations-ms.globeimposter-alpha865qqz
- from %HOMEPATH%\recent\customdestinations\28c8b86deab549a1.customdestinations-ms to %HOMEPATH%\recent\customdestinations\28c8b86deab549a1.customdestinations-ms.globeimposter-alpha865qqz
- from %HOMEPATH%\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms to %HOMEPATH%\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms.globeimposter-alpha865qqz
- from %HOMEPATH%\recent\customdestinations\5afe4de1b92fc382.customdestinations-ms to %HOMEPATH%\recent\customdestinations\5afe4de1b92fc382.customdestinations-ms.globeimposter-alpha865qqz
- from %HOMEPATH%\recent\customdestinations\5d696d521de238c3.customdestinations-ms to %HOMEPATH%\recent\customdestinations\5d696d521de238c3.customdestinations-ms.globeimposter-alpha865qqz
- from %HOMEPATH%\recent\customdestinations\74d7f43c1561fc1e.customdestinations-ms to %HOMEPATH%\recent\customdestinations\74d7f43c1561fc1e.customdestinations-ms.globeimposter-alpha865qqz
- from %HOMEPATH%\recent\customdestinations\7e4dca80246863e3.customdestinations-ms to %HOMEPATH%\recent\customdestinations\7e4dca80246863e3.customdestinations-ms.globeimposter-alpha865qqz
- from %HOMEPATH%\recent\customdestinations\9027fe24326910d2.customdestinations-ms to %HOMEPATH%\recent\customdestinations\9027fe24326910d2.customdestinations-ms.globeimposter-alpha865qqz
- from %HOMEPATH%\recent\customdestinations\969252ce11249fdd.customdestinations-ms to %HOMEPATH%\recent\customdestinations\969252ce11249fdd.customdestinations-ms.globeimposter-alpha865qqz
- from %HOMEPATH%\recent\customdestinations\bf8efb871eda5262.customdestinations-ms to %HOMEPATH%\recent\customdestinations\bf8efb871eda5262.customdestinations-ms.globeimposter-alpha865qqz
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%TEMP%\tmpf93c.tmp.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c @echo off sc config browser sc config browser start=enabled vssadmin delete shadows /all /quiet sc stop vss sc config vss start=disabled sc stop MongoDB sc config MongoDB start=disabl...
- '<SYSTEM32>\cmd.exe' /c "color e & @taskkill /IM pg_ctl.exe /F & @taskkill /IM rcrelay.exe /F & @taskkill /IM SogouImeBroker.exe /F & @taskkill /IM CCenter.exe /F & @taskkill /IM ScanFrm.exe /F & @taskkill /IM d_ma...
- '<SYSTEM32>\cmd.exe' /c "color e & @taskkill /IM ThunderPlatform.exe /F & @taskkill /IM iexplore.exe /F & @taskkill /IM vm-agent.exe /F & @taskkill /IM vm-agent-daemon.exe /F & @taskkill /IM eSightService.exe /F & ...
- '<SYSTEM32>\cmd.exe' /c "color e & @taskkill /IM sqlservr.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM java.exe /F & @taskkill /IM fdhost.exe /F & @taskkill /IM fdlauncher.exe /F & @taskkill /IM Veeam.Backup...
- '<SYSTEM32>\cmd.exe' /c "color a & @net stop UIODetect & @net stop VMwareHostd & @net stop TeamViewer8 & @net stop VMUSBArbService & @net stop VMAuthdService & @net stop wanxiao-monitor & @net stop WebAttendServer ...
- '<SYSTEM32>\cmd.exe' /c "color a & @net stop HaoZipSvc & @net stop "igfxCUIService2.0.0.0" & @net stop Realtek11nSU & @net stop xenlite & @net stop XenSvc & @net stop Apache2.2 & @net stop "Synology Drive VSS Servi...
- '<SYSTEM32>\cmd.exe' /c "color a & @net stop U8WorkerService1 & @net stop U8WorkerService2 & @net stop "memcached Server" & @net stop Apache2.4 & @net stop UFIDAWebService & @net stop MSComplianceAudit & @net stop ...
- '<SYSTEM32>\cmd.exe' /c "color e & @taskkill /IM BackupExec.exe /F & @taskkill /IM Att.exe /F & @taskkill /IM mdm.exe /F & @taskkill /IM BackupExecManagementService.exe /F & @taskkill /IM bengine.exe /F & @taskkill...
- '<SYSTEM32>\cmd.exe' /c "color b & @taskkill /IM ReportingServicesService.exe /F & @sc delete "SQL Server Reporting Services" & @sc delete MSSQLFDLauncher & @taskkill /IM U8CEServer.exe /F & @taskkill /IM ServerNT....
- '<SYSTEM32>\cmd.exe' /c "color b & @sc delete "UWS LoPriv Services" & @sc delete ftnlsv3 & @sc delete ftnlses3 & @sc delete FxService & @sc delete "UtilDev Web Server Pro" & @sc delete ftusbrdwks & @sc delete ftusb...
- '<SYSTEM32>\cmd.exe' /c "color b & @sc delete OracleOraDb11g_home1ClrAgent & @sc delete OracleOraDb11g_home1TNSListener & @sc delete OracleVssWriterORCL & @sc delete OracleServiceORCL & @sc delete aspnet_state @sc ...
- '<SYSTEM32>\cmd.exe' /c "color b & @sc delete "DAService_TCP" & @sc delete "eCard-TTransServer" & @sc delete eCardMPService & @sc delete EnergyDataService & @sc delete UI0Detect & @sc delete K3MobileService & @sc d...
- '<SYSTEM32>\cmd.exe' /c "color b & @sc delete "XT800Service_Personal" & @sc delete SQLSERVERAGENT & @sc delete SQLWriter & @sc delete SQLBrowser & @sc delete MSSQLFDLauncher & @sc delete MSSQLSERVER & @sc delete Qc...
- '<SYSTEM32>\cmd.exe' /c "color b & @taskkill /IM DDSoftPwsTomcat9.exe /F & @taskkill /IM U8SmartClient.exe /F & @taskkill /IM U8SmartClientMonitor.exe /F & @taskkill /IM tomcat9.exe /F & @taskkill /IM SqlManagement...
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\222.tmp\223.tmp\224.bat %TEMP%\tmpF93C.tmp.exe"
- '<SYSTEM32>\cmd.exe' /c "@color b & sc delete MSCRMAsyncService & @sc delete REPLICA & @sc delete RTCATS & @sc delete RTCAVMCU & @sc delete RtcQms & @sc delete RTCMEETINGMCU & @sc delete RTCIMMCU & @sc delete RTCDA...
- '<SYSTEM32>\cmd.exe' /c "color e & @taskkill /IM VBoxSDS.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM TeamViewer_Service.exe /F & @taskkill /IM TeamViewer.exe /F & @taskkill /IM CasLicenceServer.exe /F & @t...
