Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico.bit
- %TEMP%\dd_vcredistui7a3c.txt.bit
- %TEMP%\dd_wcf_ca_smci_20230531_225943_157.txt.bit
- %TEMP%\dd_wcf_ca_smci_20230531_225945_094.txt.bit
- %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_core_x64.msi.txt.bit
- %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_extended_x64.msi.txt.bit
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_164850616-msi_vc_red.msi.txt.bit
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_165235616-msi_vc_red.msi.txt.bit
- %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_165304913-msi_vc_red.msi.txt.bit
- %LOCALAPPDATA%low\microsoft\internet explorer\services\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico.bit
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\alternateservices.txt.bit
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\securitypreloadstate.txt.bit
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\securitypreloadstate.txt.bit
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sitesecurityservicestate.txt.bit
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\trrblacklist.txt.bit
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\alternateservices.txt.bit
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\pkcs11.txt.bit
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\securitypreloadstate.txt.bit
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sitesecurityservicestate.txt.bit
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\trrblacklist.txt.bit
- %APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\license.txt.bit
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\alternateservices.txt.bit
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt.bit
- %TEMP%\dd_vcredistmsi7a3c.txt.bit
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\pkcs11.txt.bit
- %TEMP%\dd_setuputility.txt.bit
- C:\users\public\pictures\sample pictures\chrysanthemum.jpg.bit
- %ALLUSERSPROFILE%\microsoft\office\documentrepository.ico.bit
- %ALLUSERSPROFILE%\microsoft\office\mysharepoints.ico.bit
- %ALLUSERSPROFILE%\microsoft\office\mysite.ico.bit
- %ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.ico.bit
- %ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.ico.bit
- %ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmp.bit
- %ALLUSERSPROFILE%\microsoft\user account pictures\user.bmp.bit
- C:\users\public\music\sample music\kalimba.mp3.bit
- C:\users\public\music\sample music\maid with the flaxen hair.mp3.bit
- C:\users\public\music\sample music\sleep away.mp3.bit
- C:\users\public\pictures\sample pictures\desert.jpg.bit
- %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.bit
- C:\users\public\pictures\sample pictures\hydrangeas.jpg.bit
- C:\users\public\pictures\sample pictures\jellyfish.jpg.bit
- C:\users\public\pictures\sample pictures\koala.jpg.bit
- C:\users\public\pictures\sample pictures\lighthouse.jpg.bit
- C:\users\public\pictures\sample pictures\penguins.jpg.bit
- C:\users\public\pictures\sample pictures\tulips.jpg.bit
- C:\users\public\videos\sample videos\wildlife.wmv.bit
- %LOCALAPPDATA%\iconcache.db.bit
- %LOCALAPPDATA%\google\chrome\user data\default\google profile.ico.bit
- %LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.bit
- %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.bit
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sitesecurityservicestate.txt.bit
Modifies the following files
- %ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico
- %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt
- %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt
- %LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt
- %LOCALAPPDATA%\google\chrome\user data\default\google profile.ico
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\splash-620x300.png
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\smalllogo.png
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\logo.png
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\secondarytile.png
- C:\users\public\videos\sample videos\wildlife.wmv
- C:\users\public\pictures\sample pictures\tulips.jpg
- C:\users\public\pictures\sample pictures\penguins.jpg
- C:\users\public\pictures\sample pictures\lighthouse.jpg
- C:\users\public\pictures\sample pictures\koala.jpg
- C:\users\public\pictures\sample pictures\jellyfish.jpg
- C:\users\public\pictures\sample pictures\hydrangeas.jpg
- C:\users\public\pictures\sample pictures\desert.jpg
- C:\users\public\pictures\sample pictures\chrysanthemum.jpg
- C:\users\public\music\sample music\sleep away.mp3
- C:\users\public\music\sample music\maid with the flaxen hair.mp3
- C:\users\public\music\sample music\kalimba.mp3
- %ALLUSERSPROFILE%\microsoft\user account pictures\user.bmp
- %ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmp
- %ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.ico
- %ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.ico
- %ALLUSERSPROFILE%\microsoft\office\mysite.ico
- %ALLUSERSPROFILE%\microsoft\office\mysharepoints.ico
- %ALLUSERSPROFILE%\microsoft\office\documentrepository.ico
- %TEMP%\dd_setuputility.txt
- %TEMP%\dd_vcredistmsi7a3c.txt
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
