Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\22056.bat
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
modifies the following system settings:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\64bit_notes.htm
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\iisstart.htm
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\trivial-merge.htm
Modifies file system
Creates the following files
- %TEMP%\db60.tmp\db61.bat
- %HOMEPATH%\music\rexplo note.txt
- %HOMEPATH%\pictures\rexplo note.txt
- %HOMEPATH%\documents\rexplo note.txt
- %HOMEPATH%\downloads\rexplo note.txt
- %HOMEPATH%\desktop\rexplo note.txt
- %HOMEPATH%\pictures\imagejgourgcraszqxzajgzqzzfhonzaqek.jpg
- %APPDATA%\fondo_antiguo.jpg
- %APPDATA%\id
- %HOMEPATH%\desktop\musiclog9480.ini
- %HOMEPATH%\desktop\documentslog24874.ini
- %HOMEPATH%\desktop\desktoplog30954.ini
- <Current directory>\rnsm-indef.exe
- <Current directory>\rnsm.exe
- <Current directory>\rexplobg.bmp
- <Current directory>\openmeopenmeopenmeopenmeopenmeopenmeopenmeopenmeopenmeopenmeopenmeopenmeopenme.txt
- %HOMEPATH%\videos\rexplo note.txt
- %APPDATA%\rexplo note.txt
Deletes the following files
- %HOMEPATH%\pictures\imagejgourgcraszqxzajgzqzzfhonzaqek.jpg
Moves the following files
- from %HOMEPATH%\desktop\desktoplog30954.ini to %HOMEPATH%\desktop\desktoplog30954.ini.rexplo
- from %HOMEPATH%\desktop\documentslog24874.ini to %HOMEPATH%\desktop\documentslog24874.ini.rexplo
- from %HOMEPATH%\desktop\musiclog9480.ini to %HOMEPATH%\desktop\musiclog9480.ini.rexplo
Modifies the following files
- %HOMEPATH%\desktop\64bit_notes.htm
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\icq.lnk
- %HOMEPATH%\desktop\mail.ru agent.lnk
- %HOMEPATH%\desktop\qip 2012.lnk
- %HOMEPATH%\desktop\telegram.lnk
- %HOMEPATH%\desktop\total commander 64 bit.lnk
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Searches for the following windows
- ClassName: 'GadgetHost' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
Creates and executes the following
- '<Current directory>\rnsm.exe'
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\DB60.tmp\DB61.bat <Full path to file>"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\DB60.tmp\DB61.bat <Full path to file>"
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\mshta.exe' vbscript:Execute("window.moveTo -1000,-1000:Msgbox(""Your important files are encrypted. In 1 minute the files will be deleted, but you can try to recovery these. Wait for next message and foll...
- '<SYSTEM32>\timeout.exe' /t 60 /nobreak
- '%WINDIR%\syswow64\notepad.exe' %APPDATA%\RExplo note.txt
