Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
blocks the following features:
- User Account Control (UAC)
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\000814251_video_01.avi
- %HOMEPATH%\desktop\region-north-karelia.jpeg
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\parnas_01.jpeg
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\ituneshelpunavailable.html
- %HOMEPATH%\desktop\ituneshelpunavailable.htm
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\howto-index.html
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\garden.htm
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\contosoroot.cer
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\1189.jpeg
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\tree_view.html
Modifies file system
Creates the following files
- <Current directory>\untitled.png
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx.pay.pay
- %HOMEPATH%\desktop\google chrome.lnk.pay.pay
- %HOMEPATH%\desktop\hanni_umami_chapter.doc.pay.pay
- %HOMEPATH%\desktop\howto-index.html.pay.pay
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx.pay.pay
- %HOMEPATH%\desktop\ituneshelpunavailable.htm.pay.pay
- %HOMEPATH%\desktop\ituneshelpunavailable.html.pay.pay
- %HOMEPATH%\desktop\lisp_success.doc.pay.pay
- %HOMEPATH%\desktop\notepad.exe.pay.pay
- %HOMEPATH%\desktop\parnas_01.jpeg.pay.pay
- %HOMEPATH%\pictures\desktop.ini.pay.pay
- %HOMEPATH%\desktop\pmd.cer.pay.pay
- %HOMEPATH%\desktop\region-north-karelia.jpeg.pay.pay
- %HOMEPATH%\desktop\telegram.lnk.pay.pay
- %HOMEPATH%\desktop\tileimage.bmp.pay.pay
- %HOMEPATH%\desktop\tree_view.html.pay.pay
- %HOMEPATH%\documents\desktop.ini.pay
- %HOMEPATH%\downloads\desktop.ini.pay
- %HOMEPATH%\downloads\desktop.ini.pay.pay
- %HOMEPATH%\pictures\desktop.ini.pay
- %HOMEPATH%\desktop\garden.htm.pay.pay
- %HOMEPATH%\desktop\ovp25012015.doc.pay.pay
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.pay.pay
- %HOMEPATH%\desktop\000814251_video_01.avi.pay.pay
- %HOMEPATH%\desktop\000814251_video_01.avi.pay
- %HOMEPATH%\desktop\1189.jpeg.pay
- %HOMEPATH%\desktop\about.html.pay
- %HOMEPATH%\desktop\adhd_and_obesity.docx.pay
- %HOMEPATH%\desktop\desktop.ini.pay
- %HOMEPATH%\desktop\dotnetfx45_full_setup.exe.pay
- %HOMEPATH%\desktop\google chrome.lnk.pay
- %HOMEPATH%\desktop\notepad.exe.pay
- %HOMEPATH%\desktop\telegram.lnk.pay
- %HOMEPATH%\desktop\1189.jpeg.pay.pay
- %HOMEPATH%\desktop\dotnetfx45_full_setup.exe.pay.pay
- %HOMEPATH%\desktop\about.html.pay.pay
- %HOMEPATH%\desktop\adhd_and_obesity.docx.pay.pay
- %HOMEPATH%\desktop\advice_process.htm.pay.pay
- %HOMEPATH%\desktop\coffee.bmp.pay.pay
- %HOMEPATH%\desktop\contosoroot.cer.pay.pay
- %HOMEPATH%\desktop\contoso_1.cer.pay.pay
- %HOMEPATH%\desktop\dashborder_96.bmp.pay.pay
- %HOMEPATH%\desktop\desktop.ini.pay.pay
- %HOMEPATH%\desktop\dial.bmp.pay.pay
- %HOMEPATH%\desktop\fi51.doc.pay.pay
- <Current directory>\decryptor.exe
Deletes the following files
- %HOMEPATH%\desktop\000814251_video_01.avi.pay
- %HOMEPATH%\desktop\tree_view.html.pay
- %HOMEPATH%\desktop\tileimage.bmp.pay
- %HOMEPATH%\desktop\telegram.lnk.pay
- %HOMEPATH%\desktop\region-north-karelia.jpeg.pay
- %HOMEPATH%\desktop\pmd.cer.pay
- %HOMEPATH%\desktop\parnas_01.jpeg.pay
- %HOMEPATH%\desktop\ovp25012015.doc.pay
- %HOMEPATH%\desktop\notepad.exe.pay
- %HOMEPATH%\desktop\lisp_success.doc.pay
- %HOMEPATH%\desktop\ituneshelpunavailable.html.pay
- %HOMEPATH%\desktop\ituneshelpunavailable.htm.pay
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx.pay
- %HOMEPATH%\desktop\howto-index.html.pay
- %HOMEPATH%\desktop\hanni_umami_chapter.doc.pay
- %HOMEPATH%\downloads\desktop.ini.pay
- %HOMEPATH%\desktop\google chrome.lnk.pay
- %HOMEPATH%\desktop\garden.htm.pay
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.pay
- %HOMEPATH%\desktop\fi51.doc.pay
- %HOMEPATH%\desktop\dotnetfx45_full_setup.exe.pay
- %HOMEPATH%\desktop\dial.bmp.pay
- %HOMEPATH%\desktop\desktop.ini.pay
- %HOMEPATH%\desktop\dashborder_96.bmp.pay
- %HOMEPATH%\desktop\contoso_1.cer.pay
- %HOMEPATH%\desktop\contosoroot.cer.pay
- %HOMEPATH%\desktop\coffee.bmp.pay
- %HOMEPATH%\desktop\advice_process.htm.pay
- %HOMEPATH%\desktop\adhd_and_obesity.docx.pay
- %HOMEPATH%\desktop\about.html.pay
- %HOMEPATH%\desktop\1189.jpeg.pay
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx.pay
- %HOMEPATH%\pictures\desktop.ini.pay
Modifies the following files
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_idx.db
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '<Current directory>\decryptor.exe'
