Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'MyClone' = '%APPDATA%\<File name>.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.exe
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %HOMEPATH%\desktop\000814251_video_01.avi
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\testee.cer
Modifies file system
Creates the following files
- %APPDATA%\<File name>.exe
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\f1d940d0-b5b2-0083-8403-807a8db430d5.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessibility\desktop.ini.enc
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\desktop.ini.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\system tools\desktop.ini.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\eee47229-947d-2ac7-e8a3-49bafee251d1.xml.enc
- %WINDIR%\softwaredistribution\sls\9482f4b4-e343-43b6-b170-9a65bc822c77\tmpb93e.tmp
- %WINDIR%\softwaredistribution\sls\855e8a7c-ecb4-4ca3-b045-1dfa50104289\sls.cab
- %LOCALAPPDATA%\google\chrome\application\chrome.visualelementsmanifest.xml.enc
- %LOCALAPPDATA%\google\chrome\user data\default\cookies.enc
- %LOCALAPPDATA%\google\chrome\user data\default\extension cookies.enc
- %WINDIR%\softwaredistribution\sls\9482f4b4-e343-43b6-b170-9a65bc822c77\sls.cab
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.html.enc
- %LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\chrome.7z.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\e8fff2df-6041-8f21-3df7-db31661aa09b.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\e64ffef1-e246-b632-595b-56076a3fa776.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\8d56e57b-8663-136d-ff69-a004e217825a.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\91a5b4c7-29a8-ec80-4321-fbecea906705.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\ac116a72-b6b1-d558-23f6-10796e634d41.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\b6126597-8ecb-81b4-8b3a-1430dc2988c1.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\bb26a0e5-d235-0ee6-0c36-6d5e185fa5b1.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\d508ba05-d8aa-2836-484d-3833d22fe185.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\8cfc804a-d777-2361-1670-4569e516397e.xml.enc
- %WINDIR%\softwaredistribution\sls\855e8a7c-ecb4-4ca3-b045-1dfa50104289\tmpc545.tmp
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\errorpage.html.enc
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\pkcs11.txt.enc
- %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\sitesecurityservicestate.txt.enc
- %APPDATA%\opera software\opera stable\cookies.enc
- %APPDATA%\opera software\opera stable\dictionaries\dictionaries.xml.enc
- %APPDATA%\opera software\opera stable\themes_backup\landscape_photo.zip.enc
- %APPDATA%\microsoft\windows\start menu\programs\maintenance\desktop.ini.enc
- %APPDATA%\microsoft\windows\start menu\programs\system tools\desktop.ini.enc
- %APPDATA%\thunderbird\profiles\yrg4bo2l.default-release\pkcs11.txt.enc
- %HOMEPATH%\desktop\microsoft edge.lnk.enc
- %HOMEPATH%\desktop\notepad.exe.enc
- %HOMEPATH%\desktop\telegram.lnk.enc
- %HOMEPATH%\documents\desktop.ini.enc
- %HOMEPATH%\downloads\desktop.ini.enc
- %HOMEPATH%\desktop\desktop.ini.enc
- %HOMEPATH%\desktop\google chrome.lnk.enc
- %APPDATA%\microsoft\windows\start menu\programs\accessories\desktop.ini.enc
- %APPDATA%\microsoft\windows\sendto\desktop.ini.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\roamingcredentialsettings.xml.enc
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\loadingpage.html.enc
- %WINDIR%\softwaredistribution\sls\8b24b027-1dee-babb-9a95-3517dfb9c552\sls.cab
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\testsharepage.html.enc
- %LOCALAPPDATA%\microsoft\onedrive\19.002.0107.0005_1\thirdpartynotices.txt.enc
- %WINDIR%\softwaredistribution\sls\8b24b027-1dee-babb-9a95-3517dfb9c552\tmpcb61.tmp
- %LOCALAPPDATA%\microsoft\onedrive\onedrive.visualelementsmanifest.xml.enc
- %LOCALAPPDATA%\microsoft\windows\shell\defaultlayouts.xml.enc
- %LOCALAPPDATA%\packages\microsoft.oneconnect_8wekyb3d8bbwe\localstate\diagoutputdir\oneconnect.discoverynotificationtask09_28_19_47_28_2155.txt.enc
- %LOCALAPPDATA%\packages\microsoft.oneconnect_8wekyb3d8bbwe\localstate\diagoutputdir\oneconnect.postinstallationtask09_28_19_27_14_9743.txt.enc
- %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\skypeapp0.txt.enc
- %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\shared.xml.enc
- %APPDATA%\microsoft\windows\libraries\documents.library-ms.enc
- %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.enc
- %LOCALAPPDATA%\google\chrome\user data\safe browsing cookies.enc
- %LOCALAPPDATA%\microsoft\internet explorer\iecompatdata\iecompatdata.xml.enc
- %LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml.enc
- C:\users\public\desktop\opera.lnk.enc
- C:\users\public\desktop\steam.lnk.enc
- C:\users\public\documents\desktop.ini.enc
- C:\users\public\downloads\desktop.ini.enc
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\desktop.ini.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\desktopsettings2013.xml.enc
- C:\users\public\desktop\mozilla thunderbird.lnk.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftinternetexplorer2013.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftlync2010.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftlync2013win32.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftlync2013win64.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftnotepad.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\easeofaccesssettings2013.xml.enc
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\desktop.ini.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftinternetexplorer2013backup.xml.enc
- %ALLUSERSPROFILE%\microsoft\identitycrl\production\wlidsvcconfig.xml.enc
- %ALLUSERSPROFILE%\microsoft\identitycrl\int\wlidsvcconfig.xml.enc
- C:\users\default\appdata\local\microsoft\windows\shell\defaultlayouts.xml.enc
- %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml.enc
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\resource.xml.enc
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml.enc
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml.enc
- C:\users\public\desktop\acrobat reader dc.lnk.enc
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\resource.xml.enc
- %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml.enc
- C:\users\public\desktop\desktop.ini.enc
- C:\users\default\appdata\roaming\microsoft\windows\sendto\desktop (create shortcut).desklink.enc
- C:\users\default\appdata\roaming\microsoft\windows\sendto\desktop.ini.enc
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessibility\desktop.ini.enc
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml.enc
- %ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2010win32.xml.enc
- C:\users\public\desktop\firefox.lnk.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2010win64.xml.enc
- C:\users\default\appdata\roaming\microsoft\windows\start menu\programs\system tools\desktop.ini.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013backupwin32.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\appxprovisioning.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\1faf63f7-f387-4522-1175-68c9652d968a.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\215f9712-9fca-a3f8-5b11-660eefc73b96.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\28502d06-9d29-8514-1e5d-64447116d798.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\28748306-9f02-a5d7-6ded-4459fddadc31.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\2b5d0f60-d93b-1629-f3e5-4167231c7ee6.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\517cfcaf-138b-1796-2cea-62892204250a.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\5b0a39aa-16e0-a938-f694-656664c7be15.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\5c834b0b-64f8-6383-854a-915ac7ddab77.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\600f46b0-7173-cdd3-5efb-2bf110ef230c.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\67447b0c-05cf-6740-5f7b-391ab440c42d.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\6ffa25dc-c89d-3de9-3601-df09bae65a75.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\vdistate.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013backupwin64.xml.enc
- %ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\0a8c1492-65ca-6a01-de25-0e183559d10d.xml.enc
- %APPDATA%\microsoft\windows\start menu\programs\accessibility\desktop.ini.enc
- %HOMEPATH%\links\desktop.lnk.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\networkprinters.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013office365win64.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013win32.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013win64.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016backupwin32.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016backupwin64.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016win32.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2013office365win32.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoffice2016win64.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2013cawin64.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2016cawin32.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2016cawin64.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftskypeforbusiness2016win32.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftskypeforbusiness2016win64.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftwordpad.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\microsoftoutlook2013cawin32.xml.enc
- %ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\themesettings2013.xml.enc
- %HOMEPATH%\links\downloads.lnk.enc
Changes user data files extensions (Trojan.Encoder).
Network activity
UDP
- DNS ASK settings-win.data.microsoft.com
