Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\508softwareandos.doc
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\weeklysheet1215.doc
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
Modifies file system
Creates the following files
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\dd56bf-readme.txt
- %PROGRAMDATA%\microsoft\mf\dd56bf-readme.txt
- %ProgramFiles(x86)%\pidgin\pixmaps\pidgin\dd56bf-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\dd56bf-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\dd56bf-readme.txt
- C:\far2\dd56bf-readme.txt
- C:\totalcmd\dd56bf-readme.txt
- %PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\cache\dd56bf-readme.txt
- C:\users\public\videos\sample videos\dd56bf-readme.txt
- C:\users\public\recorded tv\sample media\dd56bf-readme.txt
- C:\far2\documentation\eng\dd56bf-readme.txt
- %ProgramFiles(x86)%\pidgin\sounds\purple\dd56bf-readme.txt
- C:\far2\encyclopedia\dd56bf-readme.txt
- %LOCALAPPDATA%\msfree inc\dd56bf-readme.txt
- C:\users\public\pictures\sample pictures\dd56bf-readme.txt
- C:\far2\fexcept\dd56bf-readme.txt
- %CommonProgramFiles(x86)%\java\java update\dd56bf-readme.txt
- C:\far2\addons\colors\dd56bf-readme.txt
- C:\far2\addons\shell\dd56bf-readme.txt
- C:\far2\addons\dd56bf-readme.txt
- %HOMEPATH%\favorites\links\dd56bf-readme.txt
- %HOMEPATH%\contacts\dd56bf-readme.txt
- C:\users\public\libraries\dd56bf-readme.txt
- %HOMEPATH%\dd56bf-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\dd56bf-readme.txt
- D:\dd56bf-readme.txt
- %PROGRAMDATA%\microsoft\user account pictures\dd56bf-readme.txt
- %HOMEPATH%\favorites\links for united states\dd56bf-readme.txt
Moves the following files
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm.dd56bf
- from %ProgramFiles(x86)%\pidgin\sounds\purple\alert.wav to %ProgramFiles(x86)%\pidgin\sounds\purple\alert.wav.dd56bf
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest.dd56bf
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\saslprepprofile_norm_bidi.spp to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\saslprep\saslprepprofile_norm_bidi.spp.dd56bf
- from %ProgramFiles(x86)%\pidgin\sounds\purple\login.wav to %ProgramFiles(x86)%\pidgin\sounds\purple\login.wav.dd56bf
- from %ProgramFiles(x86)%\pidgin\plugins\.dll to %ProgramFiles(x86)%\pidgin\plugins\.dll.dd56bf
- from %ProgramFiles(x86)%\pidgin\sounds\purple\logout.wav to %ProgramFiles(x86)%\pidgin\sounds\purple\logout.wav.dd56bf
- from %ProgramFiles(x86)%\pidgin\pixmaps\pidgin\arrow-down.xpm to %ProgramFiles(x86)%\pidgin\pixmaps\pidgin\arrow-down.xpm.dd56bf
- from %ProgramFiles(x86)%\pidgin\pixmaps\pidgin\arrow-up.xpm to %ProgramFiles(x86)%\pidgin\pixmaps\pidgin\arrow-up.xpm.dd56bf
- from %ProgramFiles(x86)%\pidgin\pixmaps\pidgin\arrow-right.xpm to %ProgramFiles(x86)%\pidgin\pixmaps\pidgin\arrow-right.xpm.dd56bf
- from %ProgramFiles(x86)%\pidgin\pixmaps\pidgin\arrow-left.xpm to %ProgramFiles(x86)%\pidgin\pixmaps\pidgin\arrow-left.xpm.dd56bf
- from %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-0.bin to %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-0.bin.dd56bf
- from %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-1.bin to %ProgramFiles(x86)%\k-lite codec pack\tools\codectweaktool-1.bin.dd56bf
- from %ProgramFiles(x86)%\qip 2012\unins000.msg to %ProgramFiles(x86)%\qip 2012\unins000.msg.dd56bf
- from %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml to %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml.dd56bf
- from %ProgramFiles(x86)%\pidgin\sounds\purple\receive.wav to %ProgramFiles(x86)%\pidgin\sounds\purple\receive.wav.dd56bf
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\vssadmin.exe' delete shadows /all /quiet' (with hidden window)
