Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\contosoroot.cer
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\trivial-merge.htm
- %HOMEPATH%\desktop\tree_view.htm
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\correct.avi
Modifies file system
Creates the following files
- %HOMEPATH%\ce6a83-readme.txt
- %PROGRAMDATA%\microsoft\mf\ce6a83-readme.txt
- %PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\cache\ce6a83-readme.txt
- %ProgramFiles(x86)%\microsoft office\office14\1033\ce6a83-readme.txt
- %ProgramFiles(x86)%\k-lite codec pack\ce6a83-readme.txt
- %ProgramFiles(x86)%\k-lite codec pack\icaros\ce6a83-readme.txt
- %ProgramFiles(x86)%\winamp\ce6a83-readme.txt
- C:\users\public\libraries\ce6a83-readme.txt
- C:\far2\encyclopedia\ce6a83-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ce6a83-readme.txt
- %PROGRAMDATA%\microsoft toolkit\ce6a83-readme.txt
- C:\far2\encyclopedia\tap\ce6a83-readme.txt
- C:\users\public\pictures\sample pictures\ce6a83-readme.txt
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\ce6a83-readme.txt
- D:\ce6a83-readme.txt
- C:\far2\ce6a83-readme.txt
- %HOMEPATH%\desktop\ce6a83-readme.txt
- %HOMEPATH%\contacts\ce6a83-readme.txt
- %PROGRAMDATA%\ce6a83-readme.txt
- C:\totalcmd\ce6a83-readme.txt
- %PROGRAMDATA%\microsoft\user account pictures\ce6a83-readme.txt
- %ProgramFiles(x86)%\opera\ce6a83-readme.txt
- %ProgramFiles(x86)%\qip 2012\ce6a83-readme.txt
- %ProgramFiles(x86)%\mirc\ce6a83-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\ce6a83-readme.txt
- C:\far2\documentation\rus\ce6a83-readme.txt
- %ProgramFiles(x86)%\steam\ce6a83-readme.txt
Moves the following files
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm.ce6a83
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini.ce6a83
- from %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt to %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt.ce6a83
- from %ProgramFiles(x86)%\qip 2012\unins000.dat to %ProgramFiles(x86)%\qip 2012\unins000.dat.ce6a83
- from %ProgramFiles(x86)%\mirc\mirc.chm to %ProgramFiles(x86)%\mirc\mirc.chm.ce6a83
- from %ProgramFiles(x86)%\winamp\whatsnew.txt to %ProgramFiles(x86)%\winamp\whatsnew.txt.ce6a83
- from %ProgramFiles(x86)%\k-lite codec pack\unins000.dat to %ProgramFiles(x86)%\k-lite codec pack\unins000.dat.ce6a83
- from %ProgramFiles(x86)%\mirc\versions.txt to %ProgramFiles(x86)%\mirc\versions.txt.ce6a83
- from %ProgramFiles(x86)%\mirc\ircintro.chm to %ProgramFiles(x86)%\mirc\ircintro.chm.ce6a83
- from %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm to %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm.ce6a83
- from %ProgramFiles(x86)%\k-lite codec pack\icaros\icaros license.txt to %ProgramFiles(x86)%\k-lite codec pack\icaros\icaros license.txt.ce6a83
- from %ProgramFiles(x86)%\winamp\paths.ini to %ProgramFiles(x86)%\winamp\paths.ini.ce6a83
- from %ProgramFiles(x86)%\winamp\pconfig.dcf to %ProgramFiles(x86)%\winamp\pconfig.dcf.ce6a83
- from %ProgramFiles(x86)%\opera\installer_prefs.json to %ProgramFiles(x86)%\opera\installer_prefs.json.ce6a83
- from %ProgramFiles(x86)%\qip 2012\unins000.msg to %ProgramFiles(x86)%\qip 2012\unins000.msg.ce6a83
- from %ProgramFiles(x86)%\opera\resources.pri to %ProgramFiles(x86)%\opera\resources.pri.ce6a83
- from %ProgramFiles(x86)%\opera\server_tracking_data to %ProgramFiles(x86)%\opera\server_tracking_data.ce6a83
- from %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml to %ProgramFiles(x86)%\opera\launcher.visualelementsmanifest.xml.ce6a83
- from %ProgramFiles(x86)%\mirc\readme.txt to %ProgramFiles(x86)%\mirc\readme.txt.ce6a83
- from %ProgramFiles(x86)%\opera\installation_status.xml to %ProgramFiles(x86)%\opera\installation_status.xml.ce6a83
- from %ProgramFiles(x86)%\winamp\install.ini to %ProgramFiles(x86)%\winamp\install.ini.ce6a83
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\vssadmin.exe' delete shadows /all /quiet' (with hidden window)
