Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\weeklysheet1215.doc
- <Drive name for removable media>:\split.avi
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\adobe\acrobat reader dc\39277e-readme.txt
- C:\far2\pluginsdk\headers.c\39277e-readme.txt
- %ProgramFiles(x86)%\steam\graphics\39277e-readme.txt
- %ProgramFiles(x86)%\winamp\plugins\avs\39277e-readme.txt
- %ProgramFiles(x86)%\steam\skins\39277e-readme.txt
- C:\totalcmd\language\39277e-readme.txt
- %PROGRAMDATA%\microsoft\network\downloader\39277e-readme.txt
- %LOCALAPPDATA%\steam\htmlcache\39277e-readme.txt
- %HOMEPATH%\39277e-readme.txt
- %ProgramFiles(x86)%\winamp\plugins\avs\community picks\39277e-readme.txt
- C:\far2\pluginsdk\headers.pas\39277e-readme.txt
- %PROGRAMDATA%\microsoft toolkit\39277e-readme.txt
- %ProgramFiles(x86)%\steam\servers\39277e-readme.txt
- %ProgramFiles(x86)%\steam\resource\39277e-readme.txt
- %ProgramFiles(x86)%\steam\friends\39277e-readme.txt
- %ProgramFiles(x86)%\winamp\skins\bento\39277e-readme.txt
- %ProgramFiles(x86)%\steam\steam\cached\39277e-readme.txt
- %ProgramFiles(x86)%\opera\assets\39277e-readme.txt
- C:\far2\fexcept\39277e-readme.txt
- %ProgramFiles(x86)%\steam\public\39277e-readme.txt
- %PROGRAMDATA%\microsoft\msdn\7.0\1028\39277e-readme.txt
- %PROGRAMDATA%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_099489dd\39277e-readme.txt
- %PROGRAMDATA%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_088cc9f7\39277e-readme.txt
- C:\far2\addons\39277e-readme.txt
- %PROGRAMDATA%\microsoft\ilscache\39277e-readme.txt
- C:\users\public\videos\sample videos\39277e-readme.txt
- %HOMEPATH%\desktop\39277e-readme.txt
- %PROGRAMDATA%\microsoft\user account pictures\39277e-readme.txt
- C:\users\public\libraries\39277e-readme.txt
- %HOMEPATH%\contacts\39277e-readme.txt
- C:\far2\39277e-readme.txt
- C:\totalcmd\39277e-readme.txt
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\39277e-readme.txt
- %ProgramFiles(x86)%\opera\39277e-readme.txt
- %ProgramFiles(x86)%\k-lite codec pack\icaros\39277e-readme.txt
- %ProgramFiles(x86)%\qip 2012\39277e-readme.txt
- %ProgramFiles(x86)%\steam\39277e-readme.txt
- %PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\cache\39277e-readme.txt
- %ProgramFiles(x86)%\winamp\39277e-readme.txt
- %ProgramFiles(x86)%\mirc\39277e-readme.txt
- D:\39277e-readme.txt
- C:\users\public\music\sample music\39277e-readme.txt
- %ProgramFiles(x86)%\k-lite codec pack\39277e-readme.txt
- C:\users\public\pictures\sample pictures\39277e-readme.txt
- %LOCALAPPDATA%\msfree inc\39277e-readme.txt
- %LOCALAPPDATA%\applicationhistory\39277e-readme.txt
- %APPDATA%\ghisler\39277e-readme.txt
- C:\users\public\recorded tv\sample media\39277e-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\39277e-readme.txt
Moves the following files
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnselright.tga to %ProgramFiles(x86)%\steam\graphics\btnselright.tga.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\jay-fatboy - pieces of a dead world.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\jay-fatboy - pieces of a dead world.avs.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnselleft.tga to %ProgramFiles(x86)%\steam\graphics\btnselleft.tga.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\fuk - ice cube.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\fuk - ice cube.avs.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnselbottomright.tga to %ProgramFiles(x86)%\steam\graphics\btnselbottomright.tga.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\fuk - cube.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\fuk - cube.avs.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnselbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\btnselbottomleft.tga.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnselbottom.tga to %ProgramFiles(x86)%\steam\graphics\btnselbottom.tga.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\fuk - afterburner remix.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\fuk - afterburner remix.avs.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnovrontopright.tga to %ProgramFiles(x86)%\steam\graphics\btnovrontopright.tga.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnovrontopleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovrontopleft.tga.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnseltop.tga to %ProgramFiles(x86)%\steam\graphics\btnseltop.tga.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\el-vis - rittaufdemfeuerstrahl.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\el-vis - rittaufdemfeuerstrahl.avs.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnovrontop.tga to %ProgramFiles(x86)%\steam\graphics\btnovrontop.tga.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\el-vis - hubble002.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\el-vis - hubble002.avs.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnovronright.tga to %ProgramFiles(x86)%\steam\graphics\btnovronright.tga.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnovronleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovronleft.tga.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\el-vis - golden.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\el-vis - golden.avs.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnovronbottomright.tga to %ProgramFiles(x86)%\steam\graphics\btnovronbottomright.tga.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\duo - warm freeform.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\duo - warm freeform.avs.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnovronbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovronbottomleft.tga.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\el-vis - spindle.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\el-vis - spindle.avs.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\amphirion - geometric sustinance.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\amphirion - geometric sustinance.avs.39277e
- from %ProgramFiles(x86)%\steam\servers\dialogaddserver.res to %ProgramFiles(x86)%\steam\servers\dialogaddserver.res.39277e
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest.39277e
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini.39277e
- from %ProgramFiles(x86)%\steam\friends\claninvitationnotification.res to %ProgramFiles(x86)%\steam\friends\claninvitationnotification.res.39277e
- from %ProgramFiles(x86)%\steam\servers\dialoggameinfo_autoretry.res to %ProgramFiles(x86)%\steam\servers\dialoggameinfo_autoretry.res.39277e
- from %ProgramFiles(x86)%\steam\public\subextrafactorauthintro.res to %ProgramFiles(x86)%\steam\public\subextrafactorauthintro.res.39277e
- from %ProgramFiles(x86)%\steam\steam\cached\accountpage.res to %ProgramFiles(x86)%\steam\steam\cached\accountpage.res.39277e
- from %ProgramFiles(x86)%\steam\resource\icon_hlicon1.tga to %ProgramFiles(x86)%\steam\resource\icon_hlicon1.tga.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\zamuz - explosive virus.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\zamuz - explosive virus.avs.39277e
- from %ProgramFiles(x86)%\steam\friends\broadcastuploaderrornotification.res to %ProgramFiles(x86)%\steam\friends\broadcastuploaderrornotification.res.39277e
- from %ProgramFiles(x86)%\steam\public\subextrafactorauthfail.res to %ProgramFiles(x86)%\steam\public\subextrafactorauthfail.res.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\duo - hash the planet.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\duo - hash the planet.avs.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\jheriko - alien device (gallery remix by zamuz).avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\jheriko - alien device (gallery remix by zamuz).avs.39277e
- from %ProgramFiles(x86)%\steam\public\subextrafactorauth.res to %ProgramFiles(x86)%\steam\public\subextrafactorauth.res.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\yathosho - sakura.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\yathosho - sakura.avs.39277e
- from %ProgramFiles(x86)%\steam\friends\broadcastpublicstatenotification.res to %ProgramFiles(x86)%\steam\friends\broadcastpublicstatenotification.res.39277e
- from %ProgramFiles(x86)%\steam\public\steam_working_large.tga to %ProgramFiles(x86)%\steam\public\steam_working_large.tga.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\yathosho - interlaced.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\yathosho - interlaced.avs.39277e
- from %ProgramFiles(x86)%\steam\friends\broadcastinvitenotification.res to %ProgramFiles(x86)%\steam\friends\broadcastinvitenotification.res.39277e
- from %ProgramFiles(x86)%\steam\servers\dialoggameinfo.res to %ProgramFiles(x86)%\steam\servers\dialoggameinfo.res.39277e
- from %ProgramFiles(x86)%\steam\steam\cached\accepted_cards.tga to %ProgramFiles(x86)%\steam\steam\cached\accepted_cards.tga.39277e
- from %ProgramFiles(x86)%\steam\resource\icon_gift.tga to %ProgramFiles(x86)%\steam\resource\icon_gift.tga.39277e
- from %ProgramFiles(x86)%\steam\public\steam_working1.tga to %ProgramFiles(x86)%\steam\public\steam_working1.tga.39277e
- from %ProgramFiles(x86)%\steam\friends\broadcastrecordererrornotification.res to %ProgramFiles(x86)%\steam\friends\broadcastrecordererrornotification.res.39277e
- from %ProgramFiles(x86)%\steam\friends\blockcommunicationwarningdialog.res to %ProgramFiles(x86)%\steam\friends\blockcommunicationwarningdialog.res.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnovronbottom.tga to %ProgramFiles(x86)%\steam\graphics\btnovronbottom.tga.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\duo - alienated (evilrice trinity tron remix).avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\duo - alienated (evilrice trinity tron remix).avs.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnovrofftopright.tga to %ProgramFiles(x86)%\steam\graphics\btnovrofftopright.tga.39277e
- from %ProgramFiles(x86)%\steam\thirdpartylegalnotices.css to %ProgramFiles(x86)%\steam\thirdpartylegalnotices.css.39277e
- from %ProgramFiles(x86)%\winamp\whatsnew.txt to %ProgramFiles(x86)%\winamp\whatsnew.txt.39277e
- from %ProgramFiles(x86)%\winamp\paths.ini to %ProgramFiles(x86)%\winamp\paths.ini.39277e
- from %ProgramFiles(x86)%\mirc\mirc.chm to %ProgramFiles(x86)%\mirc\mirc.chm.39277e
- from %ProgramFiles(x86)%\winamp\install.ini to %ProgramFiles(x86)%\winamp\install.ini.39277e
- from %ProgramFiles(x86)%\opera\resources.pri to %ProgramFiles(x86)%\opera\resources.pri.39277e
- from %ProgramFiles(x86)%\mirc\versions.txt to %ProgramFiles(x86)%\mirc\versions.txt.39277e
- from %ProgramFiles(x86)%\mirc\ircintro.chm to %ProgramFiles(x86)%\mirc\ircintro.chm.39277e
- from %ProgramFiles(x86)%\mirc\readme.txt to %ProgramFiles(x86)%\mirc\readme.txt.39277e
- from %ProgramFiles(x86)%\opera\server_tracking_data to %ProgramFiles(x86)%\opera\server_tracking_data.39277e
- from %ProgramFiles(x86)%\mirc\defaults\mirc.ini to %ProgramFiles(x86)%\mirc\defaults\mirc.ini.39277e
- from %ProgramFiles(x86)%\k-lite codec pack\unins000.dat to %ProgramFiles(x86)%\k-lite codec pack\unins000.dat.39277e
- from %ProgramFiles(x86)%\steam\libx264-142.dll.md5 to %ProgramFiles(x86)%\steam\libx264-142.dll.md5.39277e
- from %ProgramFiles(x86)%\steam\steam.exe.old to %ProgramFiles(x86)%\steam\steam.exe.old.39277e
- from %ProgramFiles(x86)%\steam\libx264-142.dll.crypt to %ProgramFiles(x86)%\steam\libx264-142.dll.crypt.39277e
- from %ProgramFiles(x86)%\steam\libav_h264-56.dll.crypt to %ProgramFiles(x86)%\steam\libav_h264-56.dll.crypt.39277e
- from %ProgramFiles(x86)%\steam\libav_h264-56.dll.md5 to %ProgramFiles(x86)%\steam\libav_h264-56.dll.md5.39277e
- from %ProgramFiles(x86)%\qip 2012\unins000.dat to %ProgramFiles(x86)%\qip 2012\unins000.dat.39277e
- from %ProgramFiles(x86)%\qip 2012\unins000.msg to %ProgramFiles(x86)%\qip 2012\unins000.msg.39277e
- from %ProgramFiles(x86)%\k-lite codec pack\icaros\icaros license.txt to %ProgramFiles(x86)%\k-lite codec pack\icaros\icaros license.txt.39277e
- from %ProgramFiles(x86)%\opera\installation_status.xml to %ProgramFiles(x86)%\opera\installation_status.xml.39277e
- from %ProgramFiles(x86)%\opera\installer_prefs.json to %ProgramFiles(x86)%\opera\installer_prefs.json.39277e
- from %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml to %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\yathosho - skogsklocka(tm).avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\yathosho - skogsklocka(tm).avs.39277e
- from %APPDATA%\ghisler\wincmd.ini to %APPDATA%\ghisler\wincmd.ini.39277e
- from %ProgramFiles(x86)%\steam\steam\cached\aboutdialog.res to %ProgramFiles(x86)%\steam\steam\cached\aboutdialog.res.39277e
- from %ProgramFiles(x86)%\steam\public\steamui_greek.txt to %ProgramFiles(x86)%\steam\public\steamui_greek.txt.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\duo - alien intercourse 4.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\duo - alien intercourse 4.avs.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnovrofftopleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovrofftopleft.tga.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - spirit realm (plasmoid rmx).avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - spirit realm (plasmoid rmx).avs.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnovrofftop.tga to %ProgramFiles(x86)%\steam\graphics\btnovrofftop.tga.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - helium.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - helium.avs.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnovroffright.tga to %ProgramFiles(x86)%\steam\graphics\btnovroffright.tga.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnovroffleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovroffleft.tga.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - fury (extreme remix) by fsk.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - fury (extreme remix) by fsk.avs.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnovroffbottomright.tga to %ProgramFiles(x86)%\steam\graphics\btnovroffbottomright.tga.39277e
- from %ProgramFiles(x86)%\steam\graphics\btndistopright.tga to %ProgramFiles(x86)%\steam\graphics\btndistopright.tga.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - fractal (slo-mo metallic) (u).avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - fractal (slo-mo metallic) (u).avs.39277e
- from %ProgramFiles(x86)%\winamp\pconfig.dcf to %ProgramFiles(x86)%\winamp\pconfig.dcf.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\amphirion - ex deux mechanica.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\amphirion - ex deux mechanica.avs.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\acid - twitchy liquid shit (mixing plastics mix by tuggummi).avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\acid - twitchy liquid shit (mixing plastics mix by tuggummi).avs.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\colormap.ape to %ProgramFiles(x86)%\winamp\plugins\avs\colormap.ape.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnovroffbottomleft.tga to %ProgramFiles(x86)%\steam\graphics\btnovroffbottomleft.tga.39277e
- from %ProgramFiles(x86)%\steam\graphics\btnovroffbottom.tga to %ProgramFiles(x86)%\steam\graphics\btnovroffbottom.tga.39277e
- from %ProgramFiles(x86)%\steam\servers\addservergamespage.res to %ProgramFiles(x86)%\steam\servers\addservergamespage.res.39277e
- from %ProgramFiles(x86)%\steam\skins\skins_readme.txt to %ProgramFiles(x86)%\steam\skins\skins_readme.txt.39277e
- from %ProgramFiles(x86)%\steam\friends\achievementnotification.res to %ProgramFiles(x86)%\steam\friends\achievementnotification.res.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\addborder.ape to %ProgramFiles(x86)%\winamp\plugins\avs\addborder.ape.39277e
- from %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - data flow.avs to %ProgramFiles(x86)%\winamp\plugins\avs\community picks\degnic - data flow.avs.39277e
- from %APPDATA%\opera software\opera stable\bookmarks to %APPDATA%\opera software\opera stable\bookmarks.39277e
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\vssadmin.exe' delete shadows /all /quiet' (with hidden window)
