Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'discord' = '%LOCALAPPDATA%\discord.exe'
Creates the following files on removable media
- <Drive name for removable media>:\antimalware.exe
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\2.jpeg
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\garden.htm
- %HOMEPATH%\desktop\trivial-merge.htm
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\adadsi.html
- %HOMEPATH%\desktop\64bit_notes.htm
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\trivial-merge.html
Modifies file system
Creates the following files
- %TEMP%\regasm.exe
- %LOCALAPPDATA%\discord.exe
- %APPDATA%\id
- %APPDATA%\fondo_antiguo.jpg
- %HOMEPATH%\pictures\image3wgoejdhdmzgmjhkbmu9coajy=mba1.jpg
- %HOMEPATH%\desktop\как расшифровать файлы.txt
- %HOMEPATH%\downloads\как расшифровать файлы.txt
- %HOMEPATH%\documents\как расшифровать файлы.txt
- %HOMEPATH%\pictures\как расшифровать файлы.txt
- %HOMEPATH%\music\как расшифровать файлы.txt
- %HOMEPATH%\videos\как расшифровать файлы.txt
- %APPDATA%\как расшифровать файлы.txt
- %APPDATA%\usb_maker.bat
- D:\antimalware.exe
Deletes the following files
- %HOMEPATH%\pictures\image3wgoejdhdmzgmjhkbmu9coajy=mba1.jpg
Modifies the following files
- %HOMEPATH%\desktop\2.jpeg
- %HOMEPATH%\desktop\64bit_notes.htm
- %HOMEPATH%\desktop\adadsi.html
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\icq.lnk
- %HOMEPATH%\desktop\mail.ru agent.lnk
- %HOMEPATH%\desktop\qip 2012.lnk
- %HOMEPATH%\desktop\telegram.lnk
- %HOMEPATH%\desktop\total commander 64 bit.lnk
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'sp#######eeamz.herokuapp.com':80
TCP
HTTP GET requests
- http://sp#######eeamz.herokuapp.com/1158644/huis_bn.exe?ha#########
UDP
- DNS ASK sp#######eeamz.herokuapp.com
Miscellaneous
Searches for the following windows
- ClassName: 'SystemTray_Main' WindowName: ''
Creates and executes the following
- '%TEMP%\regasm.exe'
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\usb_maker.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\notepad.exe' %APPDATA%\КАК РАСШИФРОВАТЬ ФАЙЛЫ.txt
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\usb_maker.bat" "
