Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\babyboymaintonotesbackground_pal.wmv
- <Drive name for removable media>:\al.xlsx
- <Drive name for removable media>:\highly_cited_2001.xlsx
- <Drive name for removable media>:\waterlandhealthkano.rtf
- <Drive name for removable media>:\flower_trans_matte.wmv
- <Drive name for removable media>:\1sm_price.zip
- <Drive name for removable media>:\suspendedcompanies.xlsx
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\or3sdi2s.0.cs
- %TEMP%\or3sdi2s.cmdline
- %TEMP%\or3sdi2s.out
- %TEMP%\cscbce4.tmp
- %TEMP%\resbd05.tmp
- %TEMP%\or3sdi2s.dll
- %TEMP%\vy6j2xae.0.cs
- %TEMP%\vy6j2xae.cmdline
- %TEMP%\vy6j2xae.out
- %TEMP%\cscbfb3.tmp
- %TEMP%\resbfc4.tmp
- %TEMP%\vy6j2xae.dll
Deletes the following files
- %TEMP%\resbd05.tmp
- %TEMP%\cscbce4.tmp
- %TEMP%\or3sdi2s.dll
- %TEMP%\or3sdi2s.out
- %TEMP%\or3sdi2s.0.cs
- %TEMP%\or3sdi2s.cmdline
- %TEMP%\or3sdi2s.pdb
- %TEMP%\resbfc4.tmp
- %TEMP%\cscbfb3.tmp
- %TEMP%\vy6j2xae.out
- %TEMP%\vy6j2xae.cmdline
- %TEMP%\vy6j2xae.0.cs
- %TEMP%\vy6j2xae.dll
- %TEMP%\vy6j2xae.pdb
Moves the following files
- from %ProgramFiles(x86)%\qip 2012\unins000.dat to %ProgramFiles(x86)%\qip 2012\unins000.dat.d8c661
- from %ProgramFiles(x86)%\pidgin\plugins\.dll to %ProgramFiles(x86)%\pidgin\plugins\.dll.d8c661
- from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets.d8c661
- from %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets to %ProgramFiles(x86)%\msbuild\microsoft\windows workflow foundation\v3.0\workflow.visualbasic.targets.d8c661
- from %ProgramFiles(x86)%\winamp\whatsnew.txt to %ProgramFiles(x86)%\winamp\whatsnew.txt.d8c661
- from %ProgramFiles(x86)%\winamp\pconfig.dcf to %ProgramFiles(x86)%\winamp\pconfig.dcf.d8c661
- from %ProgramFiles(x86)%\winamp\paths.ini to %ProgramFiles(x86)%\winamp\paths.ini.d8c661
- from %ProgramFiles(x86)%\pidgin\sounds\purple\alert.wav to %ProgramFiles(x86)%\pidgin\sounds\purple\alert.wav.d8c661
- from %ProgramFiles(x86)%\qip 2012\skins\qip\extended.cfg to %ProgramFiles(x86)%\qip 2012\skins\qip\extended.cfg.d8c661
- from %ProgramFiles(x86)%\microsoft office\office10\trigram.lex to %ProgramFiles(x86)%\microsoft office\office10\trigram.lex.d8c661
- from %ProgramFiles(x86)%\qip 2012\skins\qip\fade.cfg to %ProgramFiles(x86)%\qip 2012\skins\qip\fade.cfg.d8c661
- from %ProgramFiles(x86)%\google\chrome\application\visualelementsmanifest.xml to %ProgramFiles(x86)%\google\chrome\application\visualelementsmanifest.xml.d8c661
- from %ProgramFiles(x86)%\k-lite codec pack\unins000.dat to %ProgramFiles(x86)%\k-lite codec pack\unins000.dat.d8c661
- from %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm to %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm.d8c661
- from %ProgramFiles(x86)%\microsoft office\office10\thdic.lex to %ProgramFiles(x86)%\microsoft office\office10\thdic.lex.d8c661
- from %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt to %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt.d8c661
- from %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-0.bin to %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-0.bin.d8c661
- from %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-1.bin to %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-1.bin.d8c661
- from %ProgramFiles(x86)%\k-lite codec pack\icaros\resources\icarosdescriptions.propdesc to %ProgramFiles(x86)%\k-lite codec pack\icaros\resources\icarosdescriptions.propdesc.d8c661
- from %ProgramFiles(x86)%\qip 2012\unins000.msg to %ProgramFiles(x86)%\qip 2012\unins000.msg.d8c661
- from %ProgramFiles(x86)%\steam\libav_h264-56.dll.crypt to %ProgramFiles(x86)%\steam\libav_h264-56.dll.crypt.d8c661
- from %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll to %ProgramFiles(x86)%\microsoft analysis services\as oledb\10\resources\1033\msmdsrv.rll.d8c661
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\or3sdi2s.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBD05.tmp" "%TEMP%\CSCBCE4.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\vy6j2xae.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBFC4.tmp" "%TEMP%\CSCBFB3.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\or3sdi2s.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBD05.tmp" "%TEMP%\CSCBCE4.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\vy6j2xae.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBFC4.tmp" "%TEMP%\CSCBFB3.tmp"
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\svchost.exe' -k swprv