Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\8ddcd5-readme.txt
- <Drive name for removable media>:\hanni_umami_chapter.doc
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
Modifies file system
Creates the following files
- %TEMP%\6yfreprx.0.cs
- %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\8ddcd5-readme.txt
- %HOMEPATH%\desktop\8ddcd5-readme.txt
- C:\users\public\music\sample music\8ddcd5-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\8ddcd5-readme.txt
- %HOMEPATH%\favorites\links\8ddcd5-readme.txt
- %HOMEPATH%\8ddcd5-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\8ddcd5-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\8ddcd5-readme.txt
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\8ddcd5-readme.txt
- C:\users\public\libraries\8ddcd5-readme.txt
- C:\far2\encyclopedia\8ddcd5-readme.txt
- C:\far2\encyclopedia\tap\8ddcd5-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\8ddcd5-readme.txt
- %HOMEPATH%\favorites\windows live\8ddcd5-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\8ddcd5-readme.txt
- %PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\cache\8ddcd5-readme.txt
- D:\8ddcd5-readme.txt
- %TEMP%\owk9xtu3.dll
- %TEMP%\res205c.tmp
- %TEMP%\csc204b.tmp
- %TEMP%\owk9xtu3.out
- %TEMP%\owk9xtu3.cmdline
- %TEMP%\owk9xtu3.0.cs
- %TEMP%\6yfreprx.dll
- %TEMP%\res1d7e.tmp
- %TEMP%\csc1d5d.tmp
- %TEMP%\6yfreprx.out
- %TEMP%\6yfreprx.cmdline
- %HOMEPATH%\contacts\8ddcd5-readme.txt
- %ProgramFiles(x86)%\microsoft office\office10\8ddcd5-readme.txt
Deletes the following files
- %TEMP%\res1d7e.tmp
- %TEMP%\csc1d5d.tmp
- %TEMP%\6yfreprx.out
- %TEMP%\6yfreprx.dll
- %TEMP%\6yfreprx.0.cs
- %TEMP%\6yfreprx.cmdline
- %TEMP%\6yfreprx.pdb
- %TEMP%\res205c.tmp
- %TEMP%\csc204b.tmp
- %TEMP%\owk9xtu3.out
- %TEMP%\owk9xtu3.0.cs
- %TEMP%\owk9xtu3.dll
- %TEMP%\owk9xtu3.cmdline
- %TEMP%\owk9xtu3.pdb
Moves the following files
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig.8ddcd5
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini.8ddcd5
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest.8ddcd5
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der.8ddcd5
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\javascripts\jsbytecodewin.bin.8ddcd5
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\3difr.x3d to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\3difr.x3d.8ddcd5
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\2d.x3d to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins3d\2d.x3d.8ddcd5
- from %ProgramFiles(x86)%\microsoft office\office10\trigram.lex to %ProgramFiles(x86)%\microsoft office\office10\trigram.lex.8ddcd5
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\enu\eula.ini to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\legal\enu\eula.ini.8ddcd5
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pddom.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\pddom.api.8ddcd5
- from %ProgramFiles(x86)%\microsoft office\office10\thdic.lex to %ProgramFiles(x86)%\microsoft office\office10\thdic.lex.8ddcd5
- from %ProgramFiles(x86)%\mirc\readme.txt to %ProgramFiles(x86)%\mirc\readme.txt.8ddcd5
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\base_uris.js to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\webresources\resource0\base_uris.js.8ddcd5
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\6yfreprx.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1D7E.tmp" "%TEMP%\CSC1D5D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\owk9xtu3.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES205C.tmp" "%TEMP%\CSC204B.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\6yfreprx.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1D7E.tmp" "%TEMP%\CSC1D5D.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\owk9xtu3.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES205C.tmp" "%TEMP%\CSC204B.tmp"
