Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
deletes volume shadow copies.
Executes the following
- '%WINDIR%\syswow64\net.exe' stop avpsus /y
- '%WINDIR%\syswow64\net.exe' stop McAfeeDLPAgentService /y
- '%WINDIR%\syswow64\net.exe' stop mfewc /y
- '%WINDIR%\syswow64\net.exe' stop BMR Boot Service /y
- '%WINDIR%\syswow64\net.exe' stop NetBackup BMR MTFTP Service /y
- '%WINDIR%\syswow64\taskkill.exe' /IM mspub.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM mydesktopqos.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM mydesktopservice.exe /F
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
Modifies file system
Creates the following files
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\mailviews.dat.crypted
- C:\users\public\pictures\sample pictures\tulips.jpg.crypted
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\128.png.crypted
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\128.png.crypted
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\16.png.crypted
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\32.png.crypted
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\48.png.crypted
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\128.png.crypted
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\128.png.crypted
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_128.png.crypted
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_16.png.crypted
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\secondarytile.png.crypted
- %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.crypted
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\logo.png.crypted
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\splash-620x300.png.crypted
- %TEMP%\jawshtml.html.crypted
- %TEMP%\microsoft .net framework 4 setup_20230912_172639823.html.crypted
- %TEMP%\microsoft .net framework 4.8 setup_20230912_173103134.html.crypted
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215.html.crypted
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793.html.crypted
- %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997.html.crypted
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.html.crypted
- %LOCALAPPDATA%\microsoft\media player\currentdatabase_372.wmdb.crypted
- %LOCALAPPDATA%\microsoft\media player\localmls_3.wmdb.crypted
- C:\users\public\music\sample music\kalimba.mp3.crypted
- C:\users\public\pictures\sample pictures\lighthouse.jpg.crypted
- C:\users\public\pictures\sample pictures\penguins.jpg.crypted
- C:\users\public\pictures\sample pictures\koala.jpg.crypted
- C:\users\public\pictures\sample pictures\jellyfish.jpg.crypted
- C:\users\public\pictures\sample pictures\hydrangeas.jpg.crypted
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pluginreg.dat.crypted
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\icudtl.dat.crypted
- %ALLUSERSPROFILE%\microsoft\rac\statedata\racmetadata.dat.crypted
- %ALLUSERSPROFILE%\microsoft\rac\statedata\racwmidatabookmarks.dat.crypted
- %ALLUSERSPROFILE%\microsoft\rac\statedata\racwmieventdata.dat.crypted
- %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\tokens.dat.crypted
- %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\cache.dat.crypted
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt.crypted
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt.crypted
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt.crypted
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\license.txt.crypted
- C:\users\public\music\sample music\maid with the flaxen hair.mp3.crypted
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\smalllogo.png.crypted
- %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.crypted
- %TEMP%\dd_vcredistmsi12db.txt.crypted
- %TEMP%\dd_vcredistui12db.txt.crypted
- %TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt.crypted
- %TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt.crypted
- %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt.crypted
- %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt.crypted
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt.crypted
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt.crypted
- %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt.crypted
- C:\users\public\pictures\sample pictures\chrysanthemum.jpg.crypted
- C:\users\public\pictures\sample pictures\desert.jpg.crypted
- %APPDATA%\telegram desktop\unins000.dat.crypted
- %TEMP%\dd_setuputility.txt.crypted
- C:\users\public\music\sample music\sleep away.mp3.crypted
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'ra#.####ubusercontent.com':443
TCP
Other
- 'ra#.####ubusercontent.com':443
UDP
- DNS ASK ra#.####ubusercontent.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\net1.exe' stop avpsus /y
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=g: /on=g: /maxsize=unbounded
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=g: /on=g: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=f: /on=f: /maxsize=unbounded
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=f: /on=f: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=e: /on=e: /maxsize=unbounded
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=e: /on=e: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=d: /on=d: /maxsize=unbounded
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=d: /on=d: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=h: /on=h: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=c: /on=c: /maxsize=unbounded
- '%WINDIR%\syswow64\sc.exe' config SstpSvc start= disabled
- '%WINDIR%\syswow64\sc.exe' config SQLWriter start= disabled
- '%WINDIR%\syswow64\sc.exe' config SQLTELEMETRY$ECWDB2 start= disabled
- '%WINDIR%\syswow64\sc.exe' config SQLTELEMETRY start= disabled
- '%WINDIR%\syswow64\net1.exe' stop NetBackup BMR MTFTP Service /y
- '%WINDIR%\syswow64\net1.exe' stop BMR Boot Service /y
- '%WINDIR%\syswow64\net1.exe' stop mfewc /y
- '%WINDIR%\syswow64\net1.exe' stop McAfeeDLPAgentService /y
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=c: /on=c: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=h: /on=h: /maxsize=unbounded
