Technical Information
To ensure autorun and distribution
Modifies master boot record (MBR).
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\000814251_video_01.avi
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\tree_view.htm
Modifies file system
Creates the following files
- globalroot\device\harddisk0\partition1
- C:\users\public\documents\my videos\sample videos\desktop.ini
- C:\users\public\documents\my videos\desktop.ini
- C:\users\public\documents\my pictures\sample pictures\tulips.jpg
- C:\users\public\documents\my pictures\sample pictures\penguins.jpg
- C:\users\public\documents\my pictures\sample pictures\lighthouse.jpg
- C:\users\public\documents\my pictures\sample pictures\koala.jpg
- C:\users\public\documents\my pictures\sample pictures\jellyfish.jpg
- C:\users\public\documents\my pictures\sample pictures\hydrangeas.jpg
- C:\users\public\documents\my pictures\sample pictures\desktop.ini
- C:\users\public\documents\my pictures\sample pictures\desert.jpg
- C:\users\public\documents\my pictures\sample pictures\chrysanthemum.jpg
- C:\users\public\documents\my pictures\desktop.ini
- C:\users\public\documents\my music\sample music\sleep away.mp3
- C:\users\public\documents\my music\sample music\maid with the flaxen hair.mp3
- C:\users\public\documents\my music\sample music\kalimba.mp3
- C:\users\public\documents\my music\sample music\desktop.ini
- C:\users\public\documents\my music\desktop.ini
- %HOMEPATH%\documents\my videos\desktop.ini
- %HOMEPATH%\documents\my pictures\desktop.ini
- %HOMEPATH%\documents\my music\desktop.ini
- globalroot\device\harddisk1\partition1
- globalroot\device\harddisk0\partition3
- globalroot\device\harddisk0\partition2
- C:\users\public\documents\my videos\sample videos\wildlife.wmv
- C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini
Deletes the following files
- %WINDIR%\boot\dvd\efi\bcd
- %WINDIR%\boot\pcat\da-dk\bootmgr.exe.mui
- %WINDIR%\boot\pcat\cs-cz\bootmgr.exe.mui
- %WINDIR%\boot\pcat\bootmgr
- %WINDIR%\boot\fonts\wgl4_boot.ttf
- %WINDIR%\boot\fonts\kor_boot.ttf
- %WINDIR%\boot\fonts\jpn_boot.ttf
- %WINDIR%\boot\fonts\cht_boot.ttf
- %WINDIR%\boot\fonts\chs_boot.ttf
- %WINDIR%\boot\efi\ru-ru\bootmgfw.efi.mui
- %WINDIR%\boot\efi\zh-tw\bootmgr.efi.mui
- %WINDIR%\boot\efi\zh-hk\bootmgr.efi.mui
- %WINDIR%\boot\efi\zh-hk\bootmgfw.efi.mui
- %WINDIR%\boot\efi\zh-cn\bootmgr.efi.mui
- %WINDIR%\boot\efi\zh-cn\bootmgfw.efi.mui
- %WINDIR%\boot\efi\tr-tr\bootmgr.efi.mui
- %WINDIR%\boot\efi\tr-tr\bootmgfw.efi.mui
- %WINDIR%\boot\efi\sv-se\bootmgr.efi.mui
- %WINDIR%\boot\efi\sv-se\bootmgfw.efi.mui
- %WINDIR%\boot\efi\zh-tw\bootmgfw.efi.mui
- %WINDIR%\boot\efi\ru-ru\bootmgr.efi.mui
- %WINDIR%\boot\pcat\de-de\bootmgr.exe.mui
- %WINDIR%\boot\pcat\memtest.exe
- %WINDIR%\boot\pcat\zh-cn\bootmgr.exe.mui
- %WINDIR%\boot\pcat\tr-tr\bootmgr.exe.mui
- %WINDIR%\boot\pcat\sv-se\bootmgr.exe.mui
- %WINDIR%\boot\pcat\ru-ru\bootmgr.exe.mui
- %WINDIR%\boot\pcat\pt-pt\bootmgr.exe.mui
- %WINDIR%\boot\pcat\pt-br\bootmgr.exe.mui
- %WINDIR%\boot\pcat\pl-pl\bootmgr.exe.mui
- %WINDIR%\boot\pcat\nl-nl\bootmgr.exe.mui
- %WINDIR%\boot\pcat\en-us\bootmgr.exe.mui
- %WINDIR%\boot\pcat\el-gr\bootmgr.exe.mui
- %WINDIR%\boot\pcat\ko-kr\bootmgr.exe.mui
- %WINDIR%\boot\pcat\ja-jp\bootmgr.exe.mui
- %WINDIR%\boot\pcat\it-it\bootmgr.exe.mui
- %WINDIR%\boot\pcat\hu-hu\bootmgr.exe.mui
- %WINDIR%\boot\pcat\fr-fr\bootmgr.exe.mui
- %WINDIR%\boot\pcat\fi-fi\bootmgr.exe.mui
- %WINDIR%\boot\pcat\es-es\bootmgr.exe.mui
- %WINDIR%\boot\pcat\en-us\memtest.exe.mui
- %WINDIR%\boot\pcat\nb-no\bootmgr.exe.mui
- %WINDIR%\boot\efi\pt-pt\bootmgr.efi.mui
- %WINDIR%\boot\efi\pt-pt\bootmgfw.efi.mui
- %WINDIR%\boot\efi\pt-br\bootmgr.efi.mui
- %WINDIR%\boot\efi\en-us\bootmgfw.efi.mui
- %WINDIR%\boot\efi\el-gr\bootmgr.efi.mui
- %WINDIR%\boot\efi\el-gr\bootmgfw.efi.mui
- %WINDIR%\boot\efi\de-de\bootmgr.efi.mui
- %WINDIR%\boot\efi\de-de\bootmgfw.efi.mui
- %WINDIR%\boot\efi\da-dk\bootmgr.efi.mui
- %WINDIR%\boot\efi\da-dk\bootmgfw.efi.mui
- %WINDIR%\boot\efi\en-us\memtest.efi.mui
- %WINDIR%\boot\efi\cs-cz\bootmgr.efi.mui
- %WINDIR%\boot\efi\bootmgr.efi
- %WINDIR%\boot\efi\bootmgfw.efi
- %WINDIR%\boot\dvd\pcat\etfsboot.com
- %WINDIR%\boot\dvd\pcat\en-us\bootfix.bin
- %WINDIR%\boot\dvd\pcat\boot.sdi
- %WINDIR%\boot\dvd\pcat\bcd
- %WINDIR%\boot\dvd\efi\en-us\efisys.bin
- %WINDIR%\boot\dvd\efi\boot.sdi
- %WINDIR%\boot\efi\cs-cz\bootmgfw.efi.mui
- %WINDIR%\boot\efi\es-es\bootmgfw.efi.mui
- %WINDIR%\boot\efi\en-us\bootmgr.efi.mui
- %WINDIR%\boot\efi\es-es\bootmgr.efi.mui
- %WINDIR%\boot\efi\pt-br\bootmgfw.efi.mui
- %WINDIR%\boot\efi\ko-kr\bootmgfw.efi.mui
- %WINDIR%\boot\efi\pl-pl\bootmgr.efi.mui
- %WINDIR%\boot\efi\pl-pl\bootmgfw.efi.mui
- %WINDIR%\boot\efi\nl-nl\bootmgr.efi.mui
- %WINDIR%\boot\efi\nl-nl\bootmgfw.efi.mui
- %WINDIR%\boot\efi\nb-no\bootmgr.efi.mui
- %WINDIR%\boot\efi\nb-no\bootmgfw.efi.mui
- %WINDIR%\boot\efi\memtest.efi
- %WINDIR%\boot\efi\ko-kr\bootmgr.efi.mui
- %WINDIR%\boot\efi\ja-jp\bootmgr.efi.mui
- %WINDIR%\boot\efi\fi-fi\bootmgfw.efi.mui
- %WINDIR%\boot\efi\ja-jp\bootmgfw.efi.mui
- %WINDIR%\boot\efi\it-it\bootmgr.efi.mui
- %WINDIR%\boot\efi\it-it\bootmgfw.efi.mui
- %WINDIR%\boot\efi\hu-hu\bootmgr.efi.mui
- %WINDIR%\boot\efi\hu-hu\bootmgfw.efi.mui
- %WINDIR%\boot\efi\fr-fr\bootmgr.efi.mui
- %WINDIR%\boot\efi\fr-fr\bootmgfw.efi.mui
- %WINDIR%\boot\efi\fi-fi\bootmgr.efi.mui
- %WINDIR%\boot\pcat\zh-hk\bootmgr.exe.mui
- %WINDIR%\boot\pcat\zh-tw\bootmgr.exe.mui
Moves the following files
- from %HOMEPATH%\documents\my music\desktop.ini to %HOMEPATH%\documents\my music\desktop.ini.fck
- from %HOMEPATH%\documents\my pictures\desktop.ini to %HOMEPATH%\documents\my pictures\desktop.ini.fck
- from %HOMEPATH%\documents\my videos\desktop.ini to %HOMEPATH%\documents\my videos\desktop.ini.fck
- from C:\users\public\documents\my music\desktop.ini to C:\users\public\documents\my music\desktop.ini.fck
- from C:\users\public\documents\my music\sample music\desktop.ini to C:\users\public\documents\my music\sample music\desktop.ini.fck
- from C:\users\public\documents\my music\sample music\kalimba.mp3 to C:\users\public\documents\my music\sample music\kalimba.mp3.fck
- from C:\users\public\documents\my music\sample music\maid with the flaxen hair.mp3 to C:\users\public\documents\my music\sample music\maid with the flaxen hair.mp3.fck
- from C:\users\public\documents\my music\sample music\sleep away.mp3 to C:\users\public\documents\my music\sample music\sleep away.mp3.fck
- from C:\users\public\documents\my pictures\desktop.ini to C:\users\public\documents\my pictures\desktop.ini.fck
- from C:\users\public\documents\my pictures\sample pictures\desktop.ini to C:\users\public\documents\my pictures\sample pictures\desktop.ini.fck
- from C:\users\public\documents\my videos\desktop.ini to C:\users\public\documents\my videos\desktop.ini.fck
- from C:\users\public\documents\my videos\sample videos\desktop.ini to C:\users\public\documents\my videos\sample videos\desktop.ini.fck
- from C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini to C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.fck
Modifies the following files
- %HOMEPATH%\desktop\000814251_video_01.avi
- %HOMEPATH%\favorites\msn websites\msn money.url
- %HOMEPATH%\favorites\msn websites\msn entertainment.url
- %HOMEPATH%\favorites\msn websites\msn autos.url
- %HOMEPATH%\favorites\microsoft websites\microsoft store.url
- %HOMEPATH%\favorites\microsoft websites\microsoft at work.url
- %HOMEPATH%\favorites\microsoft websites\microsoft at home.url
- %HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url
- %HOMEPATH%\favorites\microsoft websites\ie add-on site.url
- %HOMEPATH%\favorites\links for united states\usa.gov.url
- %HOMEPATH%\favorites\links for united states\gobiernousa.gov.url
- %HOMEPATH%\favorites\links for united states\desktop.ini
- %HOMEPATH%\favorites\links\web slice gallery.url
- %HOMEPATH%\favorites\links\desktop.ini
- %HOMEPATH%\favorites\desktop.ini
- %HOMEPATH%\downloads\desktop.ini
- %HOMEPATH%\documents\desktop.ini
- %HOMEPATH%\desktop\telegram.lnk
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\google chrome.lnk
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\desktop.ini
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\favorites\msn websites\msn sports.url
- %HOMEPATH%\favorites\msn websites\msn.url
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\reagentc.exe' /disable
- '%WINDIR%\syswow64\powercfg.exe' /HIBERNATE OFF
- '%WINDIR%\syswow64\wevtutil.exe' cl Application
- '%WINDIR%\syswow64\wevtutil.exe' cl Security
- '%WINDIR%\syswow64\wevtutil.exe' cl System
- '%WINDIR%\syswow64\cscript.exe' <SYSTEM32>\slmgr.vbs /upk
- '%WINDIR%\syswow64\vssadmin.exe' Delete Shadows /All /Quiet' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' shadowcopy delete /nointeractive' (with hidden window)
- '%WINDIR%\syswow64\reagentc.exe' /disable' (with hidden window)
- '%WINDIR%\syswow64\powercfg.exe' /HIBERNATE OFF' (with hidden window)
- '%WINDIR%\syswow64\wevtutil.exe' cl Application' (with hidden window)
- '%WINDIR%\syswow64\wevtutil.exe' cl Security' (with hidden window)
- '%WINDIR%\syswow64\wevtutil.exe' cl System' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' <SYSTEM32>\slmgr.vbs /upk' (with hidden window)