Technical Information
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\000814251_video_01.avi
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\iisstart.htm
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\trivial-merge.htm
Modifies file system
Creates the following files
- %HOMEPATH%\desktop\000814251_video_01.avi.raz
- %CommonProgramFiles%\microsoft shared\ink\ro-ro\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\ru-ru\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\shapecollector.exe.raz
- %CommonProgramFiles%\microsoft shared\ink\sk-sk\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\sl-si\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\sr-latn-cs\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\sv-se\readme.txt
- %CommonProgramFiles%\microsoft shared\msinfo\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\tabtip.exe.raz
- %CommonProgramFiles%\microsoft shared\ink\tr-tr\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\uk-ua\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\zh-cn\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\zh-tw\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\readme.txt
- %CommonProgramFiles%\microsoft shared\msclientdatamgr\readme.txt
- %CommonProgramFiles%\microsoft shared\msinfo\en-us\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\pt-br\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\pt-pt\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\th-th\readme.txt
- %CommonProgramFiles%\microsoft shared\msinfo\msinfo32.exe.raz
- %CommonProgramFiles%\microsoft shared\ink\nb-no\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\he-il\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\hr-hr\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\hu-hu\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\hwrcustomization\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\inkwatson.exe.raz
- %CommonProgramFiles%\microsoft shared\ink\inputpersonalization.exe.raz
- %CommonProgramFiles%\microsoft shared\ink\it-it\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\ja-jp\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\ko-kr\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\lt-lt\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\lv-lv\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\mip.exe.raz
- %CommonProgramFiles%\microsoft shared\ink\nl-nl\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\pl-pl\readme.txt
- <Current directory>\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\1033\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\setup.exe.raz
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\readme.txt
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\ospprearm.exe.raz
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe.raz
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\readme.txt
- %CommonProgramFiles%\microsoft shared\proof\readme.txt
- %CommonProgramFiles%\microsoft shared\smart tag\1033\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\cultures\readme.txt
- %CommonProgramFiles%\microsoft shared\smart tag\lists\1033\readme.txt
- %CommonProgramFiles%\microsoft shared\smart tag\metconv.txt.raz
- %CommonProgramFiles%\microsoft shared\smart tag\smarttaginstall.exe.raz
- %CommonProgramFiles%\microsoft shared\smart tag\readme.txt
- %CommonProgramFiles%\microsoft shared\source engine\ose.exe.raz
- %CommonProgramFiles%\microsoft shared\source engine\readme.txt
- %CommonProgramFiles%\microsoft shared\stationery\cave_drawings.gif.raz
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\fltldr.exe.raz
- %CommonProgramFiles%\microsoft shared\office14\msoicons.exe.raz
- %CommonProgramFiles%\microsoft shared\office14\msoxmled.exe.raz
- %CommonProgramFiles%\microsoft shared\office14\oarpmany.exe.raz
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\readme.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\odeploy.exe.raz
- %CommonProgramFiles%\microsoft shared\office14\liclua.exe.raz
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\readme.txt
- C:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\readme.txt
- C:\$recycle.bin\readme.txt
- C:\kms\readme.txt
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\ose.exe.raz
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.exe.raz
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\readme.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\readme.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\readme.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\readme.txt
- %HOMEPATH%\downloads\desktop.ini.raz
- %HOMEPATH%\videos\desktop.ini.raz
- C:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\desktop.ini.raz
- %HOMEPATH%\videos\readme.txt
- %HOMEPATH%\music\readme.txt
- %HOMEPATH%\desktop\skypesetup.exe.raz
- %HOMEPATH%\desktop\calc.exe.raz
- %HOMEPATH%\desktop\default.bmp.raz
- %HOMEPATH%\desktop\delete.avi.raz
- %HOMEPATH%\desktop\desktop.ini.raz
- %HOMEPATH%\desktop\dialmap.bmp.raz
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx.raz
- %HOMEPATH%\desktop\iisstart.htm.raz
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\readme.txt
- %CommonProgramFiles%\microsoft shared\stationery\connectivity.gif.raz
- %HOMEPATH%\desktop\notepad.exe.raz
- %HOMEPATH%\desktop\wrar520.exe.raz
- %HOMEPATH%\desktop\readme.txt
- %HOMEPATH%\documents\desktop.ini.raz
- %HOMEPATH%\documents\readme.txt
- %HOMEPATH%\pictures\desktop.ini.raz
- %HOMEPATH%\pictures\readme.txt
- %HOMEPATH%\music\desktop.ini.raz
- %HOMEPATH%\desktop\alert.htm.raz
- %HOMEPATH%\desktop\tcm851ax32.exe.raz
- %CommonProgramFiles%\microsoft shared\smart tag\lists\readme.txt
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\dw20.exe.raz
- %CommonProgramFiles%\microsoft shared\help\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\ar-sa\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\bg-bg\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\convertinkstore.exe.raz
- %CommonProgramFiles%\microsoft shared\ink\cs-cz\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\da-dk\readme.txt
- %HOMEPATH%\downloads\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\de-de\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\en-us\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\es-es\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\et-ee\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\fi-fi\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\flicklearningwizard.exe.raz
- %CommonProgramFiles%\microsoft shared\ink\fr-fr\readme.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\readme.txt
- %CommonProgramFiles%\microsoft shared\grphflt\cgmimp32.cfg.raz
- %CommonProgramFiles%\microsoft shared\ink\el-gr\readme.txt
- %CommonProgramFiles%\microsoft shared\grphflt\readme.txt
- %CommonProgramFiles%\microsoft shared\grphflt\ms.gif.raz
- %CommonProgramFiles%\microsoft shared\filters\readme.txt
- %CommonProgramFiles%\microsoft shared\euro\readme.txt
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\dwtrig20.exe.raz
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\readme.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\readme.txt
- C:\msocache\readme.txt
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\readme.txt
- <Full path to file>.raz
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\readme.txt
- C:\perflogs\admin\readme.txt
- %CommonProgramFiles%\designer\readme.txt
- %CommonProgramFiles%\microsoft shared\dw\dw20.exe.raz
- %CommonProgramFiles%\microsoft shared\dw\dwtrig20.exe.raz
- %CommonProgramFiles%\microsoft shared\dw\readme.txt
- %CommonProgramFiles%\microsoft shared\equation\1033\readme.txt
- %CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe.raz
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\readme.txt
- %CommonProgramFiles%\microsoft shared\equation\readme.txt
- C:\perflogs\readme.txt
- %CommonProgramFiles%\microsoft shared\stationery\desktop.ini.raz
Deletes itself.
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'xm#.###honanywhere.com':443
TCP
Other
- 'xm#.###honanywhere.com':443
UDP
- DNS ASK xm#.###honanywhere.com