Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'google' = '<Full path to file>'
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\13.jpeg
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\iisstart.html
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\alert.html
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\210252809.jpeg
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\tree_view.html
Modifies file system
Creates the following files
- %HOMEPATH%\pictures\desktop.ini.trobibtc218
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\desktop.ini.trobibtc218
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\uninstall\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\tools\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\help\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\configuration\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\google chrome\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\games\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\games\desktop.ini.trobibtc218
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\windows powershell\desktop.ini.trobibtc218
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tablet pc\desktop.ini.trobibtc218
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini.trobibtc218
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\accessibility\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini.trobibtc218
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\desktop.ini.trobibtc218
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\desktop.ini.trobibtc218
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\mirc\trobibtc218.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\trobibtc218.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\wow_helper.exe.trobibtc218
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\reader_sl.exe.trobibtc218
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\logtransport2.exe.trobibtc218
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\eula.exe.trobibtc218
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\arh.exe.trobibtc218
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini.trobibtc218
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobecollabsync.exe.trobibtc218
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adelrcp.exe.trobibtc218
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrotextextractor.exe.trobibtc218
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32info.exe.trobibtc218
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrobroker.exe.trobibtc218
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe.trobibtc218
- %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\trobibtc218.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\trobibtc218.txt
- %ProgramFiles(x86)%\adobe\trobibtc218.txt
- %ProgramFiles(x86)%\trobibtc218.txt
- %ProgramFiles(x86)%\desktop.ini.trobibtc218
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winamp\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\tablet pc\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\steam\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\sharepoint\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\qip 2012\trobibtc218.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\desktop.ini.trobibtc218
- C:\users\public\documents\trobibtc218.txt
- %HOMEPATH%\downloads\jre-8u45-windows-x64.exe.trobibtc218
- %HOMEPATH%\downloads\icq_rfrset.exe.trobibtc218
- %HOMEPATH%\downloads\desktop.ini.trobibtc218
- %HOMEPATH%\downloads\chromesetup.exe.trobibtc218
- %APPDATA%\microsoft\windows\recent\customdestinations\trobibtc218.txt
- %APPDATA%\microsoft\windows\recent\automaticdestinations\trobibtc218.txt
- %APPDATA%\microsoft\windows\recent\trobibtc218.txt
- %APPDATA%\microsoft\windows\recent\desktop.ini.trobibtc218
- C:\users\public\desktop\trobibtc218.txt
- C:\users\public\desktop\desktop.ini.trobibtc218
- %HOMEPATH%\desktop\trobibtc218.txt
- %HOMEPATH%\desktop\skypesetup.exe.trobibtc218
- %HOMEPATH%\desktop\desktop.ini.trobibtc218
- %HOMEPATH%\desktop\correct.avi.trobibtc218
- %HOMEPATH%\desktop\calc.exe.trobibtc218
- %HOMEPATH%\desktop\browse.html.trobibtc218
- %HOMEPATH%\desktop\archer.avi.trobibtc218
- %HOMEPATH%\desktop\api-hashmap.html.trobibtc218
- %HOMEPATH%\desktop\alert.html.trobibtc218
- %HOMEPATH%\desktop\adhd_and_obesity.docx.trobibtc218
- %HOMEPATH%\desktop\210252809.jpeg.trobibtc218
- %HOMEPATH%\desktop\13.jpeg.trobibtc218
- %HOMEPATH%\pictures\trobibtc218.txt
- %HOMEPATH%\downloads\k-lite_codec_pack_1110_mega.exe.trobibtc218
- %HOMEPATH%\downloads\k-lite_codec_pack_1110_mega_dlm.exe.trobibtc218
- %HOMEPATH%\downloads\magent_rfrset.exe.trobibtc218
- %HOMEPATH%\downloads\mirc741.exe.trobibtc218
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\trobibtc218.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\desktop.ini.trobibtc218
- C:\users\public\music\sample music\trobibtc218.txt
- C:\users\public\music\sample music\sleep away.mp3.trobibtc218
- C:\users\public\music\sample music\maid with the flaxen hair.mp3.trobibtc218
- C:\users\public\music\sample music\kalimba.mp3.trobibtc218
- C:\users\public\music\sample music\desktop.ini.trobibtc218
- C:\users\public\music\trobibtc218.txt
- C:\users\public\music\desktop.ini.trobibtc218
- C:\users\public\pictures\sample pictures\trobibtc218.txt
- C:\users\public\pictures\sample pictures\desktop.ini.trobibtc218
- C:\users\public\pictures\desktop.ini.trobibtc218
- C:\users\public\pictures\trobibtc218.txt
- C:\users\public\videos\sample videos\trobibtc218.txt
- C:\users\public\videos\sample videos\desktop.ini.trobibtc218
- C:\users\public\videos\trobibtc218.txt
- C:\users\public\videos\desktop.ini.trobibtc218
- %HOMEPATH%\downloads\trobibtc218.txt
- %HOMEPATH%\downloads\winamp5666_full_all.exe.trobibtc218
- %HOMEPATH%\downloads\thunderbird setup 31.6.0.exe.trobibtc218
- %HOMEPATH%\downloads\tcmd851ax64.exe.trobibtc218
- %HOMEPATH%\downloads\steamsetup.exe.trobibtc218
- %HOMEPATH%\downloads\pidgin-2.10.11.exe.trobibtc218
- %HOMEPATH%\downloads\opera_ni_stable.exe.trobibtc218
- C:\users\public\documents\desktop.ini.trobibtc218
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acroapp\enu\trobibtc218.txt
Changes user data files extensions (Trojan.Encoder).
