Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\!!restore-my-file-kavva.txt
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
- <Drive name for removable media>:\applicantform_en.doc
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\cveuropeo.doc
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- C:\users\public\documents\.c3680868c.ico
- C:\!!restore-my-file-kavva.txt
- C:\\kms\!!restore-my-file-kavva.txt
- C:\\nxnx\!!restore-my-file-kavva.txt
- C:\\users\!!restore-my-file-kavva.txt
- C:\\users\public\music\!!restore-my-file-kavva.txt
- C:\\users\public\documents\!!restore-my-file-kavva.txt
- C:\\users\public\!!restore-my-file-kavva.txt
- C:\\users\public\downloads\!!restore-my-file-kavva.txt
- C:\\users\public\pictures\!!restore-my-file-kavva.txt
- C:\\users\public\music\sample music\!!restore-my-file-kavva.txt
- C:\\users\public\music\sample music\maid with the flaxen hair.mp3.c3680868c
- C:\\users\public\music\sample music\kalimba.mp3.c3680868c
- C:\\users\public\music\sample music\sleep away.mp3.c3680868c
- C:\\users\public\pictures\sample pictures\!!restore-my-file-kavva.txt
- C:\\users\public\recorded tv\!!restore-my-file-kavva.txt
- C:\\users\public\videos\!!restore-my-file-kavva.txt
- C:\\users\public\recorded tv\sample media\!!restore-my-file-kavva.txt
- C:\\users\public\videos\sample videos\!!restore-my-file-kavva.txt
- C:\\users\user\documents\!!restore-my-file-kavva.txt
- C:\\users\user\downloads\!!restore-my-file-kavva.txt
- C:\\users\user\favorites\!!restore-my-file-kavva.txt
- C:\\users\user\!!restore-my-file-kavva.txt
- C:\\users\user\contacts\!!restore-my-file-kavva.txt
- C:\\users\user\favorites\links for united states\!!restore-my-file-kavva.txt
- C:\\users\user\favorites\links\!!restore-my-file-kavva.txt
- C:\\users\user\desktop\!!restore-my-file-kavva.txt
- C:\\users\public\pictures\sample pictures\chrysanthemum.jpg.c3680868c
- C:\\users\public\pictures\sample pictures\lighthouse.jpg.c3680868c
- C:\\users\user\favorites\microsoft websites\!!restore-my-file-kavva.txt
- C:\\users\user\favorites\msn websites\!!restore-my-file-kavva.txt
- C:\\users\public\pictures\sample pictures\koala.jpg.c3680868c
- C:\\users\public\pictures\sample pictures\hydrangeas.jpg.c3680868c
- C:\\users\public\pictures\sample pictures\desert.jpg.c3680868c
- C:\\users\public\pictures\sample pictures\tulips.jpg.c3680868c
- C:\\users\public\pictures\sample pictures\jellyfish.jpg.c3680868c
- C:\\users\public\pictures\sample pictures\penguins.jpg.c3680868c
- D:\!!restore-my-file-kavva.txt
- C:\\users\user\favorites\windows live\!!restore-my-file-kavva.txt
- C:\\users\public\videos\sample videos\wildlife.wmv.c3680868c
- C:\\users\user\links\!!restore-my-file-kavva.txt
- C:\\users\user\videos\!!restore-my-file-kavva.txt
- C:\\users\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv.c3680868c
- C:\\users\user\searches\!!restore-my-file-kavva.txt
- C:\\users\user\music\!!restore-my-file-kavva.txt
- C:\\users\user\pictures\!!restore-my-file-kavva.txt
- C:\\users\user\saved games\!!restore-my-file-kavva.txt
- C:\\users\user\favorites\links for united states\gobiernousa.gov.url.c3680868c
- C:\\users\user\favorites\links for united states\usa.gov.url.c3680868c
- C:\\users\user\contacts\user.contact.c3680868c
- C:\\users\user\favorites\links\web slice gallery.url.c3680868c
- C:\\users\user\desktop\adhd_and_obesity.docx.c3680868c
- C:\\users\user\desktop\coffee.bmp.c3680868c
- C:\\users\user\desktop\contosoroot_1.cer.c3680868c
- C:\\users\user\desktop\delete.avi.c3680868c
- C:\\users\user\desktop\dashborder_120.bmp.c3680868c
- C:\\users\user\desktop\cveuropeo.doc.c3680868c
- C:\\users\user\desktop\correct.avi.c3680868c
- C:\\users\user\desktop\dial.bmp.c3680868c
- C:\\users\user\desktop\lisp_success.doc.c3680868c
- C:\\users\user\desktop\pmd.cer.c3680868c
- C:\\users\user\desktop\fi51.doc.c3680868c
- C:\\users\user\desktop\sdszfo.docx.c3680868c
- C:\\users\user\favorites\microsoft websites\ie add-on site.url.c3680868c
- C:\\users\user\desktop\testee.cer.c3680868c
- C:\\users\user\favorites\microsoft websites\ie site on microsoft.com.url.c3680868c
- C:\\users\user\desktop\nwfieldnotes1966.docx.c3680868c
- C:\\users\user\desktop\join.avi.c3680868c
- C:\\users\user\desktop\sdksampleprivdeveloper.cer.c3680868c
- C:\\users\user\favorites\microsoft websites\microsoft at home.url.c3680868c
- C:\\users\user\desktop\uep_form_786_bulletin_1726i602.doc.c3680868c
- C:\\users\user\desktop\hanni_umami_chapter.doc.c3680868c
- C:\\users\user\favorites\msn websites\msn autos.url.c3680868c
- C:\\users\user\desktop\thlps_keeper_mayer_1965.docx.c3680868c
- C:\\users\user\favorites\msn websites\msn entertainment.url.c3680868c
- C:\\users\user\favorites\microsoft websites\microsoft at work.url.c3680868c
- C:\\users\user\favorites\microsoft websites\microsoft store.url.c3680868c
- C:\\users\user\favorites\msn websites\msn money.url.c3680868c
- C:\\users\user\favorites\msn websites\msn sports.url.c3680868c
- C:\\users\user\favorites\msn websites\msn.url.c3680868c
- C:\\users\user\favorites\msn websites\msnbc news.url.c3680868c
- C:\\users\user\favorites\windows live\get windows live.url.c3680868c
- C:\\users\user\favorites\windows live\windows live gallery.url.c3680868c
- C:\\users\user\favorites\windows live\windows live spaces.url.c3680868c
- C:\\users\user\favorites\windows live\windows live mail.url.c3680868c
Modifies the following files
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<Full path to file>' -all' (with hidden window)
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /all /quiet' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' shadowcopy delete /nointeractive' (with hidden window)
