Technical Information
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\168.jpeg
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\garden.htm
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\adadsi.html
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
- %HOMEPATH%\desktop\210252809.jpeg
- %HOMEPATH%\desktop\tree_view.htm
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
Modifies file system
Creates the following files
- C:\users\public\pictures\sample pictures\chrysanthemum.jpg.vanitas
- %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cookie\cookies-journal.vanitas
- %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cookie\cookies.vanitas
- %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\index.vanitas
- %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\data_3.vanitas
- %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\data_2.vanitas
- %LOCALAPPDATA%\adobe\color\profiles\wscrgb.icc.vanitas
- %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\data_1.vanitas
- %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\chromedwritefontcache.vanitas
- %LOCALAPPDATA%\adobe\acrobat\dc\cache\acrofnt15.lst.vanitas
- %LOCALAPPDATA%\adobe\acrobat\dc\usercache.bin.vanitas
- %LOCALAPPDATA%\adobe\acrobat\dc\shareddataevents.vanitas
- %LOCALAPPDATA%\adobe\acrobat\dc\adobesysfnt15.lst.vanitas
- %LOCALAPPDATA%\adobe\acrobat\dc\adobecmapfnt15.lst.vanitas
- %LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\data_0.vanitas
- %HOMEPATH%\downloads\icq_rfrset.exe.vanitas
- %LOCALAPPDATA%\adobe\color\profiles\wsrgb.icc.vanitas
- %LOCALAPPDATA%\google\chrome\user data\safe browsing uws list.vanitas
- %LOCALAPPDATA%\google\chrome\user data\safe browsing ip blacklist.vanitas
- %LOCALAPPDATA%\google\chrome\user data\safe browsing inclusion whitelist.vanitas
- %LOCALAPPDATA%\google\chrome\user data\safe browsing extension blacklist.vanitas
- %LOCALAPPDATA%\google\chrome\user data\safe browsing download whitelist.vanitas
- %LOCALAPPDATA%\google\chrome\user data\safe browsing download.vanitas
- %HOMEPATH%\downloads\winamp5666_full_all.exe.vanitas
- %LOCALAPPDATA%\adobe\color\acecache11.lst.vanitas
- %LOCALAPPDATA%\google\chrome\user data\safe browsing cookies.vanitas
- %LOCALAPPDATA%\google\chrome\user data\safe browsing bloom prefix set.vanitas
- %LOCALAPPDATA%\google\chrome\user data\safe browsing bloom.vanitas
- %LOCALAPPDATA%\google\chrome\user data\local state.vanitas
- %LOCALAPPDATA%\google\chrome\user data\first run.vanitas
- %LOCALAPPDATA%\google\chrome\user data\chrome_shutdown_ms.txt.vanitas
- %LOCALAPPDATA%\google\chrome\user data\safe browsing cookies-journal.vanitas
- %LOCALAPPDATA%\applicationhistory\ngen.exe.2c05686e.ini.vanitas
- %HOMEPATH%\downloads\thunderbird setup 31.6.0.exe.vanitas
- %HOMEPATH%\downloads\tcmd851ax64.exe.vanitas
- %HOMEPATH%\downloads\steamsetup.exe.vanitas
- C:\users\public\pictures\sample pictures\tulips.jpg.vanitas
- C:\users\public\pictures\sample pictures\desert.jpg.vanitas
- C:\users\public\pictures\sample pictures\hydrangeas.jpg.vanitas
- C:\users\public\pictures\sample pictures\jellyfish.jpg.vanitas
- C:\users\public\pictures\sample pictures\koala.jpg.vanitas
- C:\users\public\pictures\sample pictures\lighthouse.jpg.vanitas
- %LOCALAPPDATA%\google\chrome\user data\safe browsing uws list prefix set.vanitas
- C:\users\public\pictures\sample pictures\penguins.jpg.vanitas
- C:\users\public\music\sample music\sleep away.mp3.vanitas
- C:\users\public\music\sample music\albumartsmall.jpg.vanitas
- C:\users\public\music\sample music\albumart_{5fa05d35-a682-4af6-96f7-0773e42d4d16}_large.jpg.vanitas
- C:\users\public\music\sample music\albumart_{5fa05d35-a682-4af6-96f7-0773e42d4d16}_small.jpg.vanitas
- C:\users\public\music\sample music\folder.jpg.vanitas
- C:\users\public\music\sample music\kalimba.mp3.vanitas
- C:\users\public\videos\sample videos\wildlife.wmv.vanitas
- %LOCALAPPDATA%\google\chrome\user data\safe browsing csd whitelist.vanitas
- %HOMEPATH%\desktop\168.jpeg.vanitas
- %HOMEPATH%\desktop\508softwareandos.doc.vanitas
- %HOMEPATH%\desktop\210252809.jpeg.vanitas
- %HOMEPATH%\downloads\pidgin-2.10.11.exe.vanitas
- %HOMEPATH%\downloads\opera_ni_stable.exe.vanitas
- %HOMEPATH%\downloads\mirc741.exe.vanitas
- %HOMEPATH%\downloads\magent_rfrset.exe.vanitas
- %HOMEPATH%\downloads\k-lite_codec_pack_1110_mega_dlm.exe.vanitas
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.vanitas
- %HOMEPATH%\downloads\k-lite_codec_pack_1110_mega.exe.vanitas
- C:\users\public\music\sample music\maid with the flaxen hair.mp3.vanitas
- %HOMEPATH%\downloads\chromesetup.exe.vanitas
- %HOMEPATH%\desktop\jre-7u75-windows-i586-iftw.exe.vanitas
- %HOMEPATH%\desktop\dotnetfx45_full_setup.exe.vanitas
- %HOMEPATH%\desktop\chromesetup.exe.vanitas
- %HOMEPATH%\desktop\calc.exe.vanitas
- %HOMEPATH%\downloads\jre-8u45-windows-x64.exe.vanitas
- %LOCALAPPDATA%\google\chrome\user data\default\chromedwritefontcache.vanitas
Changes user data files extensions (Trojan.Encoder).