Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\2015-02-worms-nanoparticle-toxicity.pdf
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\guide_reorganization_mapping.xls
- <Drive name for removable media>:\glidescope_review_rev_010.docx
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Modifies file system
Creates the following files
- C:\far2\1d1ef2-readme.txt
- D:\1d1ef2-readme.txt
Moves the following files
- from %ProgramFiles(x86)%\steam\thirdpartylegalnotices.css to %ProgramFiles(x86)%\steam\thirdpartylegalnotices.css.1d1ef2
- from %ProgramFiles(x86)%\opera\installation_status.xml to %ProgramFiles(x86)%\opera\installation_status.xml.1d1ef2
- from %ProgramFiles(x86)%\steam\libx264-142.dll.crypt to %ProgramFiles(x86)%\steam\libx264-142.dll.crypt.1d1ef2
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\saslprepprofile_norm_bidi.spp to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\saslprepprofile_norm_bidi.spp.1d1ef2
- from %ProgramFiles(x86)%\mirc\mirc.chm to %ProgramFiles(x86)%\mirc\mirc.chm.1d1ef2
- from %ProgramFiles(x86)%\steam\libav_h264-56.dll.crypt to %ProgramFiles(x86)%\steam\libav_h264-56.dll.crypt.1d1ef2
- from %ProgramFiles(x86)%\mirc\versions.txt to %ProgramFiles(x86)%\mirc\versions.txt.1d1ef2
- from %ProgramFiles(x86)%\winamp\paths.ini to %ProgramFiles(x86)%\winamp\paths.ini.1d1ef2
- from %ProgramFiles(x86)%\winamp\install.ini to %ProgramFiles(x86)%\winamp\install.ini.1d1ef2
- from %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm to %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm.1d1ef2
- from %ProgramFiles(x86)%\winamp\microsoft.vc90.crt\microsoft.vc90.crt.manifest to %ProgramFiles(x86)%\winamp\microsoft.vc90.crt\microsoft.vc90.crt.manifest.1d1ef2
- from %ProgramFiles(x86)%\steam\libav_h264-56.dll.md5 to %ProgramFiles(x86)%\steam\libav_h264-56.dll.md5.1d1ef2
- from %ProgramFiles(x86)%\opera\server_tracking_data to %ProgramFiles(x86)%\opera\server_tracking_data.1d1ef2
- from %ProgramFiles(x86)%\opera\resources.pri to %ProgramFiles(x86)%\opera\resources.pri.1d1ef2
- from %ProgramFiles(x86)%\mirc\readme.txt to %ProgramFiles(x86)%\mirc\readme.txt.1d1ef2
- from %ProgramFiles(x86)%\qip 2012\unins000.msg to %ProgramFiles(x86)%\qip 2012\unins000.msg.1d1ef2
- from %ProgramFiles(x86)%\mirc\ircintro.chm to %ProgramFiles(x86)%\mirc\ircintro.chm.1d1ef2
- from %ProgramFiles(x86)%\steam\libx264-142.dll.md5 to %ProgramFiles(x86)%\steam\libx264-142.dll.md5.1d1ef2
- from %ProgramFiles(x86)%\opera\installer_prefs.json to %ProgramFiles(x86)%\opera\installer_prefs.json.1d1ef2
- from %ProgramFiles(x86)%\winamp\pconfig.dcf to %ProgramFiles(x86)%\winamp\pconfig.dcf.1d1ef2
- from %ProgramFiles(x86)%\winamp\lang\winamp-sv-se.wlz to %ProgramFiles(x86)%\winamp\lang\winamp-sv-se.wlz.1d1ef2
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\vssadmin.exe' delete shadows /all /quiet' (with hidden window)
