Technical Information
To ensure autorun and distribution
Infects the following executable files
- %HOMEPATH%\desktop\winmine.exe
- %HOMEPATH%\desktop\notepad.exe
- %HOMEPATH%\desktop\jre-7u75-windows-i586-iftw.exe
Creates the following files on removable media
- <Drive name for removable media>:\c4ea94798e6f8cdcdff37d6baf102df5.ogutdonre
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\iisstart.htm
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\tree_view.htm
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\split.avi
Modifies file system
Creates the following files
- nul
- C:\users\public\libraries\85e3664a5060c080595f81f1397a25f0.ogutdonre
- C:\users\public\recorded tv\5c428d0794dbc4914541cca5d069ecd7.ogutdonre
- C:\users\public\e2d3e948412385a0bc44e141aa1be3de.ogutdonre
- C:\users\public\desktop\a106618ebf3768da48e6e8dc4d180c27.ogutdonre
- C:\users\public\desktop\4374e4c4059163e64b248c6308211bf8.ogutdonre
- C:\users\public\recorded tv\sample media\a92bc2d0ef9602c1060ab51fe282958e.ogutdonre
- C:\users\public\desktop\e80c4fdb90ac5618b2a0db6d0b7f66b8.ogutdonre
- C:\users\public\desktop\856217af91abfa60a6197fd5b4a4427b.ogutdonre
- C:\users\public\desktop\31685e0db6ca4934845f994f74ae35da.ogutdonre
- %HOMEPATH%\favorites\msn websites\c77c7c426a882fe139cce5b14486b70c.ogutdonre
- C:\users\public\desktop\7c8318bc9a40fbd97b0f4f1df5074a52.ogutdonre
- %HOMEPATH%\pictures\8be6199717bf6ea3563eb21305501f42.ogutdonre
- %HOMEPATH%\videos\eb4b9a08c0aae4e1d941755533b19cc8.ogutdonre
- %HOMEPATH%\downloads\d0340cd673c291dd871d28ef2b905254.ogutdonre
- %HOMEPATH%\contacts\a3474519eebb542a10cd77e6a8a44fd9.ogutdonre
- %HOMEPATH%\music\093a0e53a243ecc4998386b0de0fd95b.ogutdonre
- %HOMEPATH%\searches\895534c4aaf4311eac8a05435eb14dde.ogutdonre
- %HOMEPATH%\searches\b0fd66c6f5cbe39cd84e5641f691a1c9.ogutdonre
- %HOMEPATH%\searches\4a7c561fe31c0536541f49554fb817bf.ogutdonre
- %HOMEPATH%\documents\4057e3eb40c3fb20ae0b06da9ac33f49.ogutdonre
- %HOMEPATH%\contacts\e9ecb2171e86a3a9a942bba6b2c9f1fd.ogutdonre
- %HOMEPATH%\saved games\a75738d46dfdc3eaafd7f55881e0ba29.ogutdonre
- C:\users\public\documents\34a53f39043c9e9662586aa09b94f246.ogutdonre
- C:\users\public\music\sample music\347732027b03e2332c15be73a69feda0.ogutdonre
- D:\90f0495c653ae002a34a3cf79e73bd07.ogutdonre
- C:\users\public\pictures\sample pictures\5c1ad11eec4a3a0968f6dbb607eb212c.ogutdonre
- C:\users\public\pictures\sample pictures\92b315f95b1c5773e6cf9050d2ab5c62.ogutdonre
- C:\users\public\pictures\sample pictures\1ca2393630642cbf773715be0ba7887c.ogutdonre
- C:\users\public\videos\sample videos\5fdda4875377ae9dd94d8ff73c472a2b.ogutdonre
- C:\users\public\videos\294740f834d9faa4149c7ecdee97fa51.ogutdonre
- C:\users\public\videos\sample videos\05212970f8a5bae701885f13dc73c73d.ogutdonre
- C:\users\public\pictures\sample pictures\428b95aa5e6e1badae502cd255daafa6.ogutdonre
- C:\users\public\pictures\96fb19ba0364f62ad9b3644a6c064fa7.ogutdonre
- C:\users\public\recorded tv\sample media\1ceca5eb352b673dd5cf7264337703c5.ogutdonre
- C:\users\public\libraries\cb31e0767a82bc6ab32f2fdf3364e50e.ogutdonre
- C:\users\public\pictures\sample pictures\18f9cb1796b26d40a13a53ea84b04aa5.ogutdonre
- C:\users\public\pictures\sample pictures\d7e62ebbf6ed623e6e3f25974db12c93.ogutdonre
- C:\users\public\pictures\sample pictures\d7b6c3f6a1615c0342a39ca116129c7b.ogutdonre
- C:\users\public\pictures\sample pictures\56e9d3071c4a3907efe40e54ad9b5df1.ogutdonre
- C:\users\public\music\sample music\cb1a3384e64e36f69e29ef2acf2136ce.ogutdonre
- C:\users\public\music\sample music\44a4a14d8404b3c2dacf876b9fd072b7.ogutdonre
- C:\users\public\music\sample music\9043968e28f0d7183a8619a770506907.ogutdonre
- C:\users\public\music\b116e41ed9ed50f52e73f0d7d193e185.ogutdonre
- C:\users\public\downloads\badc302283e7f88f15d86e1c7c6c8052.ogutdonre
- C:\users\public\pictures\sample pictures\01b062197a3b649fd395ad208260d759.ogutdonre
- %HOMEPATH%\links\7ee5954f5bc947b9e1d8fabe833672f1.ogutdonre
- %HOMEPATH%\links\9e396536f2d25479e81bb8474ff938a7.ogutdonre
- %HOMEPATH%\favorites\msn websites\80d0572e1c8e0b810132e2b333ce6f93.ogutdonre
- %HOMEPATH%\desktop\48cb7bcbfd6c7d9d476c3a97e0215287.ogutdonre
- %HOMEPATH%\desktop\63982402f2a6dbf49c0df56551d68991.ogutdonre
- %HOMEPATH%\desktop\560c402e68052bf9c90450d446484aa0.ogutdonre
- %HOMEPATH%\desktop\a3f4a459a1b75d09abcb703f01abf9e5.ogutdonre
- %HOMEPATH%\desktop\d5d393e160682d7fc6f359094d7100d7.ogutdonre
- %HOMEPATH%\desktop\bbc7c78af5ce9b12852fedeb40746fa7.ogutdonre
- %HOMEPATH%\desktop\a6ff06afc9488557c4739c7ad4b5ca1d.ogutdonre
- %HOMEPATH%\desktop\ad8b6a31a5ea26a0644c660d634c9613.ogutdonre
- %HOMEPATH%\desktop\4a7b11902c3c3b68a49e1970b3ccac55.ogutdonre
- %HOMEPATH%\desktop\fb1aea7b7bc5dbfe30d822e0267212d6.ogutdonre
- %HOMEPATH%\desktop\1aaa67b416ebe5855e0c1883753a6243.ogutdonre
- %HOMEPATH%\desktop\ee803371693bd49a122952ac555583e9.ogutdonre
- %HOMEPATH%\desktop\3c6e15b371c9655f627a24980afbd482.ogutdonre
- %HOMEPATH%\desktop\bde6d71ed1eabcfc059a97c6af00f379.ogutdonre
- %HOMEPATH%\desktop\a8d5fe728fdb77f0fb121712f7d1a8c6.ogutdonre
- %HOMEPATH%\desktop\47c82de3040d45104ce7ce63698384b8.ogutdonre
- %HOMEPATH%\desktop\66f71448a77b0768344e8527aea7f122.ogutdonre
- %HOMEPATH%\desktop\c796f466f620766134564612f25455b8.ogutdonre
- %HOMEPATH%\desktop\a412fd05d7e3398b98bcb0854574a34f.ogutdonre
- %HOMEPATH%\desktop\48d6e9101b1de18cd187e411fe92d5cc.ogutdonre
- %HOMEPATH%\desktop\099bec8489db816eef768dff7459c622.ogutdonre
- %HOMEPATH%\desktop\50db5fa2577cbe669650aead3d9193df.ogutdonre
- %HOMEPATH%\desktop\5fe76a43055f6ee3a21ce3f187013ef5.ogutdonre
- %HOMEPATH%\links\a8a682ed18e7eacb64cd9c4b6963c5b5.ogutdonre
- %HOMEPATH%\favorites\microsoft websites\3bd5ec9d3772a84ab3bd78a335db1ed4.ogutdonre
- %HOMEPATH%\favorites\msn websites\f9e560e16f4e6b5ed6d47c2c33b7c55e.ogutdonre
- %HOMEPATH%\favorites\msn websites\c746d24e649acda04558c78f82157a35.ogutdonre
- %HOMEPATH%\favorites\msn websites\8c5399f435c33a2275a649cac6334a60.ogutdonre
- %HOMEPATH%\links\ffc2272f7a4d2e78f5b70be70d01fc46.ogutdonre
- %HOMEPATH%\favorites\msn websites\f1d4310558076b6f0048c4953dda2400.ogutdonre
- %HOMEPATH%\favorites\windows live\05d281c07e11eaa93d2fe46d38101bd1.ogutdonre
- %HOMEPATH%\favorites\windows live\0956e25dde04cae153a47a1d318378cb.ogutdonre
- %HOMEPATH%\favorites\windows live\2c26b54132819863fc1a0acb8585e98a.ogutdonre
- %HOMEPATH%\favorites\windows live\ca695e136c99c22240dbf3ef560dc899.ogutdonre
- %HOMEPATH%\favorites\microsoft websites\80cf67ec034675b819c42185946f1c30.ogutdonre
- %HOMEPATH%\desktop\165915f628dfe080dca52899a67275eb.ogutdonre
- %HOMEPATH%\favorites\microsoft websites\d1235dbb6418f5fbb7b8632e76d0dc74.ogutdonre
- %HOMEPATH%\favorites\microsoft websites\286bf57ac66e09f523f01a96f7174a21.ogutdonre
- %HOMEPATH%\favorites\microsoft websites\1e493124cefc65fa192a01451e65dc16.ogutdonre
- %HOMEPATH%\favorites\links\2027a4c77c5df2a38d52022c1b464e11.ogutdonre
- %HOMEPATH%\favorites\links for united states\d4209f4222856cb9559f5a6d000a4a01.ogutdonre
- %HOMEPATH%\favorites\links\a1d7d9befe04ed1e08c7e9b6cd4c2acf.ogutdonre
- %HOMEPATH%\favorites\links for united states\88dacbf0c542b93476ff16d8d5196469.ogutdonre
- %HOMEPATH%\favorites\95ac3bdc47946b8c14606645dc26e5a2.ogutdonre
- %HOMEPATH%\favorites\links for united states\579986f8813e768d8af96816e229aeba.ogutdonre
- C:\users\9fcca798a3add005bd716c94494a87d1.ogutdonre
- D:\$recycle.bin\s-1-5-21-1238866942-1249195528-555854008-1000\793e265d008dfafc091ae922be759368.ogutdonre
Modifies the following files
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\favorites\windows live\windows live spaces.url
- %HOMEPATH%\favorites\windows live\windows live gallery.url
- %HOMEPATH%\favorites\windows live\get windows live.url
- %HOMEPATH%\favorites\microsoft websites\microsoft at work.url
- %HOMEPATH%\favorites\microsoft websites\microsoft store.url
- %HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url
- %HOMEPATH%\favorites\microsoft websites\ie add-on site.url
- %HOMEPATH%\favorites\microsoft websites\microsoft at home.url
- %HOMEPATH%\favorites\links\web slice gallery.url
- %HOMEPATH%\favorites\links for united states\gobiernousa.gov.url
- %HOMEPATH%\favorites\links\desktop.ini
- %HOMEPATH%\favorites\links for united states\usa.gov.url
- %HOMEPATH%\favorites\desktop.ini
- %HOMEPATH%\favorites\links for united states\desktop.ini
- %HOMEPATH%\desktop\google chrome.lnk
- %HOMEPATH%\desktop\desktop.ini
- %HOMEPATH%\desktop\telegram.lnk
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\tree_view.htm
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\favorites\windows live\windows live mail.url
- %HOMEPATH%\favorites\msn websites\msn autos.url
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c "vssadmin Delete Shadows /all /quiet"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "vssadmin resize shadowstorage /for=%s /on=%s /maxsize=unbounded"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del /s /f /q %s*.VHD %s*.bac %s*.bak %s*.wbcat %s*.bkf %sBackup*.* %sbackup*.* %s*.set %s*.win %s*.dsk"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "vssadmin Delete Shadows /all /quiet"
- '<SYSTEM32>\cmd.exe' /c "vssadmin resize shadowstorage /for=%s /on=%s /maxsize=unbounded"
- '<SYSTEM32>\vssadmin.exe' resize shadowstorage /for=%s /on=%s /maxsize=unbounded
- '<SYSTEM32>\cmd.exe' /c "del /s /f /q %s*.VHD %s*.bac %s*.bak %s*.wbcat %s*.bkf %sBackup*.* %sbackup*.* %s*.set %s*.win %s*.dsk"
