Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'svchost.exe' = '"%APPDATA%\Microsoft\Windows\svchost.exe" -start'
Creates the following files on removable media
- <Drive name for removable media>:\encrypted.txt
- <Drive name for removable media>:\sdszfo.docx
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\applicantform_en.doc
- <Drive name for removable media>:\weeklysheet1215.doc
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\glidescope_review_rev_010.docx
- <Drive name for removable media>:\thlps_keeper_mayer_1965.docx
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Injects code into
the following system processes:
- %WINDIR%\syswow64\notepad.exe
Modifies file system
Creates the following files
- %TEMP%\4a2866d1.zeppelin
- C:\far2\addons\colors\custom_highlighting\encrypted.txt
- C:\far2\addons\colors\encrypted.txt
- C:\far2\addons\encrypted.txt
- C:\far2\encrypted.txt
- C:\documents and settings\encrypted.txt
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\encrypted.txt
- C:\$recycle.bin\encrypted.txt
- C:\encrypted.txt
- C:\far2\.zeppelin
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.zeppelin
- C:\$recycle.bin\.zeppelin
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\encrypted.txt
- D:\$recycle.bin\encrypted.txt
- D:\encrypted.txt
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.zeppelin
- D:\$recycle.bin\.zeppelin
- %TEMP%\~temp001.bat
- %TEMP%\f5932c2d.zeppelin
- %APPDATA%\microsoft\windows\svchost.exe
- C:\far2\addons\colors\default_highlighting\encrypted.txt
- C:\far2\addons\macros\encrypted.txt
Deletes the following files
- %TEMP%\4a2866d1.zeppelin
- %TEMP%\f5932c2d.zeppelin
Modifies the following files
- D:\install.log
- <Drive name for removable media>:\february_catalogue__2015.doc
- C:\far2\farhun.hlf
- C:\far2\farger.lng
- <Drive name for removable media>:\applicantform_en.doc
- C:\far2\fareng.lng
- C:\far2\fareng.hlf
- C:\far2\farcze.lng
- C:\far2\far.map
- <Drive name for removable media>:\weeklysheet1215.doc
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- C:\far2\farhun.lng
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\pmd.cer
- C:\far2\clearpluginscache.cmd
- <Drive name for removable media>:\coffee.bmp
- C:\far2\changelog_eng
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\archer.avi
- C:\far2\changelog
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\contosoroot.cer
- C:\far2\farpol.lng
Modifies multiple files.
Deletes itself.
Modifies user data files (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\svchost.exe' -start
- '%APPDATA%\microsoft\windows\svchost.exe' -agent 0
- '%APPDATA%\microsoft\windows\svchost.exe' -agent 2
- '%APPDATA%\microsoft\windows\svchost.exe' -agent 1
- '%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C %TEMP%\~temp001.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\notepad.exe'
- '%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet
- '%WINDIR%\syswow64\cmd.exe' /C %TEMP%\~temp001.bat
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy ByPass -Command "Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}"
