Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\archer.avi
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\weeklysheet1215.doc
- %HOMEPATH%\desktop\dialmap.bmp
Modifies file system
Creates the following files
- %TEMP%\zytbutnq.0.cs
- %ALLUSERSPROFILE%\78582d-readme.txt
- C:\far2\addons\78582d-readme.txt
- %LOCALAPPDATA%\applicationhistory\78582d-readme.txt
- C:\users\public\pictures\sample pictures\78582d-readme.txt
- %HOMEPATH%\contacts\78582d-readme.txt
- %HOMEPATH%\favorites\links\78582d-readme.txt
- %TEMP%\cscde4d.tmp
- %ALLUSERSPROFILE%\microsoft\crypto\keys\78582d-readme.txt
- %HOMEPATH%\78582d-readme.txt
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\78582d-readme.txt
- C:\far2\addons\shell\78582d-readme.txt
- C:\far2\addons\xlat\78582d-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\78582d-readme.txt
- %ProgramFiles(x86)%\k-lite codec pack\info\78582d-readme.txt
- %ALLUSERSPROFILE%\microsoft toolkit\78582d-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\78582d-readme.txt
- C:\users\public\recorded tv\sample media\78582d-readme.txt
- C:\users\public\videos\sample videos\78582d-readme.txt
- %ProgramFiles(x86)%\microsoft office\office14\1033\78582d-readme.txt
- %TEMP%\zytbutnq.out
- %TEMP%\cscd181.tmp
- %TEMP%\resd182.tmp
- %TEMP%\zytbutnq.dll
- %TEMP%\pt1aucuv.0.cs
- %TEMP%\pt1aucuv.cmdline
- %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\78582d-readme.txt
- %ALLUSERSPROFILE%\microsoft\user account pictures\78582d-readme.txt
- %TEMP%\pt1aucuv.out
- %TEMP%\pt1aucuv.dll
- C:\far2\78582d-readme.txt
- D:\78582d-readme.txt
- %HOMEPATH%\desktop\78582d-readme.txt
- C:\far2\encyclopedia\tap\78582d-readme.txt
- C:\far2\encyclopedia\78582d-readme.txt
- %TEMP%\zytbutnq.cmdline
- %TEMP%\resde5e.tmp
- C:\users\public\libraries\78582d-readme.txt
Deletes the following files
- %TEMP%\resd182.tmp
- %TEMP%\cscd181.tmp
- %TEMP%\zytbutnq.out
- %TEMP%\zytbutnq.dll
- %TEMP%\zytbutnq.pdb
- %TEMP%\zytbutnq.cmdline
- %TEMP%\zytbutnq.0.cs
- %TEMP%\resde5e.tmp
- %TEMP%\cscde4d.tmp
- %TEMP%\pt1aucuv.0.cs
- %TEMP%\pt1aucuv.pdb
- %TEMP%\pt1aucuv.cmdline
- %TEMP%\pt1aucuv.dll
- %TEMP%\pt1aucuv.out
Moves the following files
- from %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm to %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm.78582d
- from %ProgramFiles%\foxit\foxit to %ProgramFiles%\foxit\foxit.78582d
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini.78582d
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest.78582d
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig.78582d
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der.78582d
- from %ProgramFiles(x86)%\k-lite codec pack\icaros\resources\icarosdescriptions.propdesc to %ProgramFiles(x86)%\k-lite codec pack\icaros\resources\icarosdescriptions.propdesc.78582d
- from %APPDATA%\ghisler\wincmd.ini to %APPDATA%\ghisler\wincmd.ini.78582d
- from %APPDATA%\mirc\urls.ini to %APPDATA%\mirc\urls.ini.78582d
- from %ProgramFiles(x86)%\k-lite codec pack\icaros\icaros license.txt to %ProgramFiles(x86)%\k-lite codec pack\icaros\icaros license.txt.78582d
- from %APPDATA%\winamp\demo.mp3 to %APPDATA%\winamp\demo.mp3.78582d
- from %APPDATA%\qipguard\cache to %APPDATA%\qipguard\cache.78582d
- from %APPDATA%\winamp\winamp.m3u8 to %APPDATA%\winamp\winamp.m3u8.78582d
- from %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\shaders\wave.hlsl to %ProgramFiles(x86)%\k-lite codec pack\mpc-hc64\shaders\wave.hlsl.78582d
- from %ProgramFiles(x86)%\microsoft office\office10\trigram.lex to %ProgramFiles(x86)%\microsoft office\office10\trigram.lex.78582d
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zytbutnq.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD182.tmp" "%TEMP%\CSCD181.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\pt1aucuv.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDE5E.tmp" "%TEMP%\CSCDE4D.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zytbutnq.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD182.tmp" "%TEMP%\CSCD181.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\pt1aucuv.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDE5E.tmp" "%TEMP%\CSCDE4D.tmp"
