Technical Information
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\13.jpeg
- %HOMEPATH%\desktop\pushkin.jpeg
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\iisstart.html
- %HOMEPATH%\desktop\ituneshelpunavailable.html
- %HOMEPATH%\desktop\howto-index.html
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
- %HOMEPATH%\desktop\168.jpg
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\tileimage.bmp
Modifies file system
Creates the following files
- %TEMP%\office32ww.xml
- %TEMP%\penguins.jpg
- %TEMP%\tulips.jpg
- %TEMP%\wildlife.wmv
- %TEMP%\13.jpeg
- %TEMP%\168.jpg
- %TEMP%\4f0bf7ff71f28.jpeg
- %TEMP%\google chrome.lnk
- %TEMP%\telegram.lnk
- %TEMP%\adhd_and_obesity.docx
- %TEMP%\applicantform_en.doc
- %TEMP%\browse.htm
- %TEMP%\dashborder_144.bmp
- %TEMP%\koala.jpg
- %TEMP%\lighthouse.jpg
- %TEMP%\dashborder_96.bmp
- %TEMP%\howto-index.html
- %TEMP%\ituneshelpunavailable.html
- %TEMP%\iisstart.html
- %TEMP%\ovp25012015.doc
- %TEMP%\pushkin.jpeg
- %TEMP%\sdszfo.docx
- %TEMP%\tileimage.bmp
- %TEMP%\desktop.lnk
- %TEMP%\downloads.lnk
- %TEMP%\recentplaces.lnk
- %TEMP%\ntuser.ini
- %TEMP%\168.jpeg
- %TEMP%\february_catalogue__2015.doc
- %TEMP%\file_p_00000000_1371597592.docx
- %TEMP%\jellyfish.jpg
- %TEMP%\hydrangeas.jpg
- %TEMP%\desert.jpg
- %TEMP%\setup.xml
- %TEMP%\excelmui.xml
- %TEMP%\powerpointmui.xml
- %TEMP%\publishermui.xml
- %TEMP%\outlookmui.xml
- %TEMP%\wordmui.xml
- %TEMP%\proof.xml
- %TEMP%\proofing.xml
- %TEMP%\office32mui.xml
- %TEMP%\infopathmui.xml
- %TEMP%\onenotemui.xml
- %TEMP%\groovemui.xml
- %TEMP%\officemui.xml
- %TEMP%\proplusww.xml
- %TEMP%\officemuiset.xml
- %TEMP%\accessmui.xml
- %TEMP%\accessmuiset.xml
- %TEMP%\ntuser.dat.log
- %TEMP%\acrobat reader dc.lnk
- %TEMP%\firefox.lnk
- %TEMP%\mozilla thunderbird.lnk
- %TEMP%\opera.lnk
- %TEMP%\desktop.ini
- %TEMP%\steam.lnk
- %TEMP%\maid with the flaxen hair.mp3
- %TEMP%\kalimba.mp3
- %TEMP%\sleep away.mp3
- %TEMP%\chrysanthemum.jpg
- %TEMP%\branding.xml
- %TEMP%\1sm_price.zip
- %TEMP%\2.jpeg
Modifies the following files
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemuiset.xml
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemui.xml
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\groovemui.xml
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.xml
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.xml
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\accessmui.xml
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\branding.xml
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C "icacls . /grant Everyone:F /T /C /Q"
- '%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q
- '%WINDIR%\syswow64\cmd.exe' /C "icacls . /grant Everyone:F /T /C /Q"' (with hidden window)
