Technical Information
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ituneshelpunavailable.html
- %HOMEPATH%\desktop\iisstart.html
- %HOMEPATH%\desktop\iisstart.htm
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\tree_view.htm
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
Modifies file system
Creates the following files
- %TEMP%\e30e.tmp\e30f.tmp\e310.bat
- %HOMEPATH%\saved games\dotnetzip-jdy3hx4u.tmp
- %HOMEPATH%\searches\dotnetzip-11dyu403.tmp
- %HOMEPATH%\searches\dotnetzip-lxrns0b0.tmp
- %HOMEPATH%\searches\dotnetzip-p0elyqzj.tmp
- %HOMEPATH%\videos\dotnetzip-erbczucf.tmp
- %HOMEPATH%\desktop\dotnetzip-dv3olkhi.tmp
- %HOMEPATH%\desktop\dotnetzip-phh4chgr.tmp
- %HOMEPATH%\desktop\dotnetzip-tguzgpuw.tmp
- %HOMEPATH%\desktop\dotnetzip-b1wjsbsm.tmp
- %HOMEPATH%\desktop\dotnetzip-gzj5zakw.tmp
- %HOMEPATH%\desktop\dotnetzip-sz2dwrnu.tmp
- %HOMEPATH%\desktop\dotnetzip-tkenr0hf.tmp
- %HOMEPATH%\desktop\dotnetzip-m503dpuf.tmp
- %HOMEPATH%\desktop\dotnetzip-nxg1rdks.tmp
- %HOMEPATH%\desktop\dotnetzip-ezrzpp4u.tmp
- %HOMEPATH%\desktop\dotnetzip-b3xtcoai.tmp
- %HOMEPATH%\desktop\dotnetzip-ucqabhgq.tmp
- %HOMEPATH%\desktop\dotnetzip-z2t5vui1.tmp
- %HOMEPATH%\desktop\dotnetzip-qtccb12p.tmp
- %HOMEPATH%\desktop\dotnetzip-arqyvops.tmp
- %HOMEPATH%\desktop\dotnetzip-hz2zzvur.tmp
- %HOMEPATH%\desktop\dotnetzip-0mepqiou.tmp
- %HOMEPATH%\desktop\dotnetzip-tfq5zudk.tmp
- %HOMEPATH%\desktop\dotnetzip-xw01e5jk.tmp
- %HOMEPATH%\desktop\dotnetzip-yincypnx.tmp
- %HOMEPATH%\desktop\dotnetzip-jqzrytr0.tmp
- %HOMEPATH%\desktop\dotnetzip-goencotq.tmp
- %HOMEPATH%\desktop\dotnetzip-ramuu2i2.tmp
- %HOMEPATH%\pictures\dotnetzip-ixhrj3ci.tmp
- %HOMEPATH%\desktop\dotnetzip-xifvxrlq.tmp
- %HOMEPATH%\music\dotnetzip-furqgkr3.tmp
- %HOMEPATH%\favorites\microsoft websites\dotnetzip-tkkxnor5.tmp
- <Current directory>\dotnetzip.dll
- <Current directory>\enmegacoder.exe
- %HOMEPATH%\contacts\dotnetzip-uxd5ighp.tmp
- %HOMEPATH%\contacts\dotnetzip-jnpigzsi.tmp
- %HOMEPATH%\downloads\dotnetzip-1sjlagba.tmp
- %HOMEPATH%\favorites\dotnetzip-jowzpigr.tmp
- %HOMEPATH%\favorites\links\dotnetzip-whrtrjkp.tmp
- %HOMEPATH%\favorites\links\dotnetzip-sacahnhg.tmp
- %HOMEPATH%\favorites\links for united states\dotnetzip-3hy3f5t2.tmp
- %HOMEPATH%\favorites\links for united states\dotnetzip-mafpaft1.tmp
- %HOMEPATH%\favorites\links for united states\dotnetzip-tfxmdbz0.tmp
- %HOMEPATH%\favorites\microsoft websites\dotnetzip-ytctdyx4.tmp
- %HOMEPATH%\favorites\microsoft websites\dotnetzip-h4m4pdpd.tmp
- %HOMEPATH%\favorites\microsoft websites\dotnetzip-4cfj3u44.tmp
- %HOMEPATH%\links\dotnetzip-ri3b3ayf.tmp
- %HOMEPATH%\favorites\microsoft websites\dotnetzip-3c3lkyzv.tmp
- %HOMEPATH%\favorites\msn websites\dotnetzip-qsaxxhfv.tmp
- %HOMEPATH%\favorites\msn websites\dotnetzip-thi3ihtz.tmp
- %HOMEPATH%\favorites\msn websites\dotnetzip-gvgagxcn.tmp
- %HOMEPATH%\favorites\msn websites\dotnetzip-vd0sff1c.tmp
- %HOMEPATH%\favorites\msn websites\dotnetzip-13cnpbj2.tmp
- %HOMEPATH%\favorites\msn websites\dotnetzip-eazemn3h.tmp
- %HOMEPATH%\favorites\windows live\dotnetzip-ncak0nfc.tmp
- %HOMEPATH%\favorites\windows live\dotnetzip-j31j3ksl.tmp
- %HOMEPATH%\favorites\windows live\dotnetzip-tcj12wxm.tmp
- %HOMEPATH%\favorites\windows live\dotnetzip-tdyaxpzl.tmp
- %HOMEPATH%\links\dotnetzip-34y0jgqo.tmp
- %HOMEPATH%\links\dotnetzip-ba41np0j.tmp
- %HOMEPATH%\links\dotnetzip-gr2e5t2x.tmp
- %HOMEPATH%\desktop\readme.txt
Moves the following files
- from %HOMEPATH%\contacts\dotnetzip-uxd5ighp.tmp to %HOMEPATH%\contacts\desktop.ini.enmega
- from %HOMEPATH%\links\dotnetzip-ri3b3ayf.tmp to %HOMEPATH%\links\downloads.lnk.enmega
- from %HOMEPATH%\links\dotnetzip-gr2e5t2x.tmp to %HOMEPATH%\links\recentplaces.lnk.enmega
- from %HOMEPATH%\music\dotnetzip-furqgkr3.tmp to %HOMEPATH%\music\desktop.ini.enmega
- from %HOMEPATH%\pictures\dotnetzip-ixhrj3ci.tmp to %HOMEPATH%\pictures\desktop.ini.enmega
- from %HOMEPATH%\saved games\dotnetzip-jdy3hx4u.tmp to %HOMEPATH%\saved games\desktop.ini.enmega
- from %HOMEPATH%\searches\dotnetzip-11dyu403.tmp to %HOMEPATH%\searches\desktop.ini.enmega
- from %HOMEPATH%\searches\dotnetzip-lxrns0b0.tmp to %HOMEPATH%\searches\everywhere.search-ms.enmega
- from %HOMEPATH%\searches\dotnetzip-p0elyqzj.tmp to %HOMEPATH%\searches\indexed locations.search-ms.enmega
- from %HOMEPATH%\favorites\microsoft websites\dotnetzip-tkkxnor5.tmp to %HOMEPATH%\favorites\microsoft websites\microsoft at home.url.enmega
- from %HOMEPATH%\videos\dotnetzip-erbczucf.tmp to %HOMEPATH%\videos\desktop.ini.enmega
- from %HOMEPATH%\desktop\dotnetzip-phh4chgr.tmp to %HOMEPATH%\desktop\archer.avi.enmega
- from %HOMEPATH%\desktop\dotnetzip-tguzgpuw.tmp to %HOMEPATH%\desktop\browse.htm.enmega
- from %HOMEPATH%\desktop\dotnetzip-b1wjsbsm.tmp to %HOMEPATH%\desktop\browse.html.enmega
- from %HOMEPATH%\desktop\dotnetzip-gzj5zakw.tmp to %HOMEPATH%\desktop\delete.avi.enmega
- from %HOMEPATH%\desktop\dotnetzip-sz2dwrnu.tmp to %HOMEPATH%\desktop\desktop.ini.enmega
- from %HOMEPATH%\desktop\dotnetzip-m503dpuf.tmp to %HOMEPATH%\desktop\dotnetfx45_full_setup.exe.enmega
- from %HOMEPATH%\desktop\dotnetzip-xifvxrlq.tmp to %HOMEPATH%\desktop\google chrome.lnk.enmega
- from %HOMEPATH%\desktop\dotnetzip-arqyvops.tmp to %HOMEPATH%\desktop\jre-7u75-windows-i586-iftw.exe.enmega
- from %HOMEPATH%\links\dotnetzip-34y0jgqo.tmp to %HOMEPATH%\links\desktop.ini.enmega
- from %HOMEPATH%\links\dotnetzip-ba41np0j.tmp to %HOMEPATH%\links\desktop.lnk.enmega
- from %HOMEPATH%\favorites\windows live\dotnetzip-tdyaxpzl.tmp to %HOMEPATH%\favorites\windows live\windows live spaces.url.enmega
- from %HOMEPATH%\favorites\windows live\dotnetzip-tcj12wxm.tmp to %HOMEPATH%\favorites\windows live\windows live mail.url.enmega
- from %HOMEPATH%\favorites\windows live\dotnetzip-j31j3ksl.tmp to %HOMEPATH%\favorites\windows live\windows live gallery.url.enmega
- from %HOMEPATH%\downloads\dotnetzip-1sjlagba.tmp to %HOMEPATH%\downloads\desktop.ini.enmega
- from %HOMEPATH%\favorites\dotnetzip-jowzpigr.tmp to %HOMEPATH%\favorites\desktop.ini.enmega
- from %HOMEPATH%\favorites\links\dotnetzip-whrtrjkp.tmp to %HOMEPATH%\favorites\links\desktop.ini.enmega
- from %HOMEPATH%\favorites\links\dotnetzip-sacahnhg.tmp to %HOMEPATH%\favorites\links\web slice gallery.url.enmega
- from %HOMEPATH%\favorites\links for united states\dotnetzip-3hy3f5t2.tmp to %HOMEPATH%\favorites\links for united states\desktop.ini.enmega
- from %HOMEPATH%\favorites\links for united states\dotnetzip-mafpaft1.tmp to %HOMEPATH%\favorites\links for united states\gobiernousa.gov.url.enmega
- from %HOMEPATH%\favorites\links for united states\dotnetzip-tfxmdbz0.tmp to %HOMEPATH%\favorites\links for united states\usa.gov.url.enmega
- from %HOMEPATH%\favorites\microsoft websites\dotnetzip-ytctdyx4.tmp to %HOMEPATH%\favorites\microsoft websites\ie add-on site.url.enmega
- from %HOMEPATH%\desktop\dotnetzip-xw01e5jk.tmp to %HOMEPATH%\desktop\telegram.lnk.enmega
- from %HOMEPATH%\desktop\dotnetzip-dv3olkhi.tmp to %HOMEPATH%\desktop\applicantform_en.doc.enmega
- from %HOMEPATH%\favorites\microsoft websites\dotnetzip-h4m4pdpd.tmp to %HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url.enmega
- from %HOMEPATH%\favorites\microsoft websites\dotnetzip-3c3lkyzv.tmp to %HOMEPATH%\favorites\microsoft websites\microsoft store.url.enmega
- from %HOMEPATH%\favorites\msn websites\dotnetzip-qsaxxhfv.tmp to %HOMEPATH%\favorites\msn websites\msn autos.url.enmega
- from %HOMEPATH%\favorites\msn websites\dotnetzip-thi3ihtz.tmp to %HOMEPATH%\favorites\msn websites\msn entertainment.url.enmega
- from %HOMEPATH%\favorites\msn websites\dotnetzip-gvgagxcn.tmp to %HOMEPATH%\favorites\msn websites\msn money.url.enmega
- from %HOMEPATH%\favorites\msn websites\dotnetzip-vd0sff1c.tmp to %HOMEPATH%\favorites\msn websites\msn sports.url.enmega
- from %HOMEPATH%\favorites\msn websites\dotnetzip-13cnpbj2.tmp to %HOMEPATH%\favorites\msn websites\msn.url.enmega
- from %HOMEPATH%\favorites\msn websites\dotnetzip-eazemn3h.tmp to %HOMEPATH%\favorites\msn websites\msnbc news.url.enmega
- from %HOMEPATH%\favorites\windows live\dotnetzip-ncak0nfc.tmp to %HOMEPATH%\favorites\windows live\get windows live.url.enmega
- from %HOMEPATH%\contacts\dotnetzip-jnpigzsi.tmp to %HOMEPATH%\contacts\user.contact.enmega
- from %HOMEPATH%\favorites\microsoft websites\dotnetzip-4cfj3u44.tmp to %HOMEPATH%\favorites\microsoft websites\microsoft at work.url.enmega
- from %HOMEPATH%\desktop\dotnetzip-ezrzpp4u.tmp to %HOMEPATH%\desktop\utorrent.exe.enmega
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '<Current directory>\enmegacoder.exe'
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\E30E.tmp\E30F.tmp\E310.bat <Full path to file>"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\E30E.tmp\E30F.tmp\E310.bat <Full path to file>"
- '%WINDIR%\notepad.exe' %HOMEPATH%\Desktop\README.TXT
