Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\gruenspecht_02172016.pptx
- <Drive name for removable media>:\indogerman2010.pptx
- <Drive name for removable media>:\hypothyroidism_slides.pptx
- <Drive name for removable media>:\weeklysheet1215.doc
- <Drive name for removable media>:\thlps_keeper_mayer_1965.docx
- <Drive name for removable media>:\issi2013_template_for_posters.docx
- <Drive name for removable media>:\applicantform_en.doc
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\recovery information.txt
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\roozenedowebinar.pptx
- <Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
deletes volume shadow copies.
Modifies file system
Creates the following files
- C:\$recycle.bin\recovery information.txt
- C:\users\default\videos\recovery information.txt
- C:\users\default\pictures\recovery information.txt
- C:\users\default\music\recovery information.txt
- C:\users\default\favorites\recovery information.txt
- C:\users\default\documents\recovery information.txt
- C:\users\default\links\recovery information.txt
- C:\users\default\downloads\recovery information.txt
- C:\users\default\desktop\recovery information.txt
- C:\users\default\saved games\recovery information.txt
- C:\users\default\recovery information.txt
- %HOMEPATH%\documents\recovery information.txt
- %HOMEPATH%\downloads\recovery information.txt
- %HOMEPATH%\links\recovery information.txt
- %HOMEPATH%\music\recovery information.txt
- %HOMEPATH%\favorites\recovery information.txt
- %HOMEPATH%\desktop\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\videowall\recovery information.txt
- C:\users\public\recovery information.txt
- %HOMEPATH%\searches\recovery information.txt
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\recovery information.txt
- %HOMEPATH%\contacts\recovery information.txt
- %ProgramFiles%\firefox\recovery information.txt
- <Current directory>\recovery information.txt
- C:\users\public\recorded tv\sample media\recovery information.txt
- C:\users\public\videos\sample videos\recovery information.txt
- %HOMEPATH%\videos\recovery information.txt
- C:\users\public\documents\recovery information.txt
- C:\users\public\pictures\recovery information.txt
- C:\users\public\pictures\sample pictures\recovery information.txt
- C:\users\public\music\sample music\recovery information.txt
- C:\users\public\desktop\recovery information.txt
- C:\users\public\music\recovery information.txt
- C:\users\public\favorites\recovery information.txt
- C:\users\public\libraries\recovery information.txt
- C:\users\public\videos\recovery information.txt
- C:\users\public\downloads\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\vignette\recovery information.txt
- %HOMEPATH%\saved games\recovery information.txt
- %HOMEPATH%\pictures\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\memories\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\layeredtitles\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\full\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\huecycle\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\flippage\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\babygirl\recovery information.txt
- %HOMEPATH%\favorites\microsoft websites\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\performance\recovery information.txt
- %ProgramFiles%\dvd maker\shared\recovery information.txt
- %ProgramFiles%\dvd maker\en-us\recovery information.txt
- %ProgramFiles%\dvd maker\recovery information.txt
- D:\recovery information.txt
- D:\$recycle.bin\recovery information.txt
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\recovery information.txt
- %ProgramFiles%\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\babyboy\recovery information.txt
- C:\users\public\recorded tv\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\pets\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\shatter\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\rectangles\recovery information.txt
- %HOMEPATH%\recovery information.txt
- C:\users\recovery information.txt
- %ProgramFiles(x86)%\uninstall information\recovery information.txt
- %ProgramFiles(x86)%\msbuild\microsoft\recovery information.txt
- %ProgramFiles(x86)%\msbuild\recovery information.txt
- %ProgramFiles%\uninstall information\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\push\recovery information.txt
- %ProgramFiles(x86)%\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\oldage\recovery information.txt
- %ProgramFiles%\msbuild\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\specialoccasion\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\travel\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\stacking\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\resizingpanels\recovery information.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\sports\recovery information.txt
- %ProgramFiles%\msbuild\microsoft\recovery information.txt
- %HOMEPATH%\favorites\msn websites\recovery information.txt
Moves the following files
- from %ProgramFiles%\microsoft office\office14\pubwiz\msthed98.poc to %ProgramFiles%\microsoft office\office14\pubwiz\msthed98.poc.bozon3
Modifies the following files
- <Drive name for removable media>:\split.avi
- C:\users\public\music\sample music\maid with the flaxen hair.mp3
- %HOMEPATH%\favorites\msn websites\msn.url
- %HOMEPATH%\favorites\msn websites\msnbc news.url
- %HOMEPATH%\favorites\msn websites\msn sports.url
- %HOMEPATH%\favorites\microsoft websites\microsoft at work.url
- %HOMEPATH%\favorites\microsoft websites\microsoft at home.url
- %HOMEPATH%\favorites\microsoft websites\ie add-on site.url
- %HOMEPATH%\contacts\user.contact
- <Drive name for removable media>:\roozenedowebinar.pptx
- <Drive name for removable media>:\gruenspecht_02172016.pptx
- <Drive name for removable media>:\indogerman2010.pptx
- <Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
- <Drive name for removable media>:\hypothyroidism_slides.pptx
- D:\install.log
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\applicantform_en.doc
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\weeklysheet1215.doc
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\toolbar.bmp
- C:\users\public\music\sample music\kalimba.mp3
- C:\users\public\music\sample music\sleep away.mp3
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\vssadmin.exe' delete shadows /all /quiet' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} recoveryenabled no' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} recoveryenabled no
- '<SYSTEM32>\bcdedit.exe' /set {current} bootstatuspolicy ignoreallfailures
