Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Client Server Runtime Subsystem' = '"%ALLUSERSPROFILE%\Application Data\Windows\csrss.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Client Server Runtime Subsystem' = '"%ALLUSERSPROFILE%\Application Data\Windows\csrss.exe"'
Creates the following files on removable media:
- <Drive name for removable media>:\README7.txt
- <Drive name for removable media>:\README6.txt
- <Drive name for removable media>:\README8.txt
- <Drive name for removable media>:\README10.txt
- <Drive name for removable media>:\README9.txt
- <Drive name for removable media>:\README2.txt
- <Drive name for removable media>:\README1.txt
- <Drive name for removable media>:\README3.txt
- <Drive name for removable media>:\README5.txt
- <Drive name for removable media>:\README4.txt
Modifies file system:
Creates the following files:
- %HOMEPATH%\Desktop\README8.txt
- %HOMEPATH%\Desktop\README7.txt
- %HOMEPATH%\Desktop\README9.txt
- %ALLUSERSPROFILE%\Desktop\README1.txt
- %HOMEPATH%\Desktop\README10.txt
- %HOMEPATH%\Desktop\README3.txt
- %HOMEPATH%\Desktop\README2.txt
- %HOMEPATH%\Desktop\README4.txt
- %HOMEPATH%\Desktop\README6.txt
- %HOMEPATH%\Desktop\README5.txt
- %ALLUSERSPROFILE%\Desktop\README8.txt
- %ALLUSERSPROFILE%\Desktop\README7.txt
- %ALLUSERSPROFILE%\Desktop\README9.txt
- %APPDATA%\124BDC17124BDC17.bmp
- %ALLUSERSPROFILE%\Desktop\README10.txt
- %ALLUSERSPROFILE%\Desktop\README3.txt
- %ALLUSERSPROFILE%\Desktop\README2.txt
- %ALLUSERSPROFILE%\Desktop\README4.txt
- %ALLUSERSPROFILE%\Desktop\README6.txt
- %ALLUSERSPROFILE%\Desktop\README5.txt
- %ALLUSERSPROFILE%\Application Data\Windows\csrss.exe
- %TEMP%\nsd3.tmp\System.dll
- %TEMP%\6893A5D897\state.tmp
- C:\README2.txt
- C:\README1.txt
- %TEMP%\new1455625491.html
- %TEMP%\nse2.tmp
- %TEMP%\wap.htm
- %TEMP%\jmgpddcel1uG0JMX.16C
- %TEMP%\story.jsp468773399.html
- C:\README9.txt
- C:\README8.txt
- C:\README10.txt
- %HOMEPATH%\Desktop\README1.txt
- %ALLUSERSPROFILE%\Application Data\System32\xfs
- C:\README4.txt
- C:\README3.txt
- C:\README5.txt
- C:\README7.txt
- C:\README6.txt
Sets the 'hidden' attribute to the following files:
- %ALLUSERSPROFILE%\Application Data\System32\xfs
Moves the following files:
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\9cAJm15piF6ZuqCw7038iQ==.4D2C567370F33C58A745.da_vinci_code
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\4XojM4LBxQ2+42PNmJt-tXAhO3C5UYcb01Wtwu90uR8=.4D2C567370F33C58A745.da_vinci_code
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\localstore.rdf to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\dOsJNgbPqod5dVIDKSzd6jPwVeuv3SBNmQXcizBxPBo=.4D2C567370F33C58A745.da_vinci_code
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\MNAKCIkr+BlOpy3i9j2KDA-Vs7vgNWLcza0LatGcZSg=.4D2C567370F33C58A745.da_vinci_code
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\mimeTypes.rdf to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\eMdA+rndcbmrxpeJ9sU5xAroDaHu6kmIYJFL9BZt9oA=.4D2C567370F33C58A745.da_vinci_code
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\qz8U3-dtXkQrNe5asLZzzXy1lV0pHZeadmUQe2-UZY7VnCB5z4ZnlQY2iYRGo7mg.4D2C567370F33C58A745.da_vinci_code
- from %APPDATA%\Microsoft\Internet Explorer\brndlog.txt to %APPDATA%\Microsoft\Internet Explorer\gIQf9s7YDgIJEfCY70PLo6Lo4bPRsdhcaOSGQn9+hAQ=.4D2C567370F33C58A745.da_vinci_code
- from %APPDATA%\Microsoft\Internet Explorer\brndlog.bak to %APPDATA%\Microsoft\Internet Explorer\eq5M9F7-ViRDbv9Cr8kf0WDkfalvonqcf9waGLAD5v0=.4D2C567370F33C58A745.da_vinci_code
- from %APPDATA%\Mozilla\Firefox\profiles.ini to %APPDATA%\Mozilla\Firefox\ihVlnIuP0iRlsJttoIwmtKZMm2WIjhlTO9hOZ1r6ruw=.4D2C567370F33C58A745.da_vinci_code
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\MZMm4iZlwbCmUyKOXysbbw==.4D2C567370F33C58A745.da_vinci_code
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarks.html to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\psCcyci7Cd58gUXGxvvkXYfTv17UZ-eqPcT73A52lW4=.4D2C567370F33C58A745.da_vinci_code
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\SgqT5h0MLqeCSgwhw8mBSw==.4D2C567370F33C58A745.da_vinci_code
- from %TEMP%\new1455625491.html to %TEMP%\UA3ifnf0NiE9SQFeOf+4DCeSljFVrDKkIPS3m7x+WuUiKhmzD+2Ii+oi6AN0gekp.4D2C567370F33C58A745.da_vinci_code
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\cISGO7KJux1uo1waEIRMtX9e8XlqquDy012H1XVka976A5djGcUsfbVCAOo-DxhY.4D2C567370F33C58A745.da_vinci_code
- from %TEMP%\story.jsp468773399.html to %TEMP%\Yp5g3W0qVBQST7AjtfUceBlSzr4hvHzyToD6-N09ZdK4eEnkIxaB6SLk5arYslFy.4D2C567370F33C58A745.da_vinci_code
- from %TEMP%\6893A5D897\state.tmp to %TEMP%\6893A5D897\state
- from %TEMP%\wap.htm to %TEMP%\dCyZ5mdyDzMFNgZ59Ye7XA==.4D2C567370F33C58A745.da_vinci_code
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\AOaTgaQAL8MESGcUXRcIWE83xUglqNjT4wQzD-0NmwqPrBbIUGJLtspEukWhX59O.4D2C567370F33C58A745.da_vinci_code
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\+WGiEYZDaaMlBAlPpTGBaAbInpQCJNIdqXtndaHYfJ0=.4D2C567370F33C58A745.da_vinci_code
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\uW1snV2Y9cj4OhW8GXKxg80P5z7e87evhVBjRgY3ORI=.4D2C567370F33C58A745.da_vinci_code
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\nWZY0buryhUQ6eaV31cxksLZ7C4hd8kUVxBRQzH+6Fg=.4D2C567370F33C58A745.da_vinci_code
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\ccN2fedODi2dLd7CBor6OwzZjcLz9VMPuLtHD58rhW6+LZQPqSQgyuPgSIPqDmlfxxsqYLIVqcIlZJH0ecPNcA==.4D2C567370F33C58A745.da_vinci_code
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\TCDHxKImw4cqhQQfCVLcuBVQtdq0WiLB518tbRAZpqk=.4D2C567370F33C58A745.da_vinci_code
Modifies user data files (Trojan.Encoder).
Network activity:
Connects to:
- '19#.#09.206.212':443
- '76.##.17.194':9090
- 'localhost':1037
- '13#.#88.40.189':443
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
