Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Adolf Hitler' = '<Full path to file>'
Creates or modifies the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\desktop.ini
Creates the following files on removable media:
- <Drive name for removable media>:\_Adolf Hitler_.bmp
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
deletes volume shadow copies.
Executes the following:
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %HOMEPATH%\Desktop\_Adolf Hitler_.bmp
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadow /all /quiet & wmic shadowcopy delete & bcdedit /set {default} boostatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -q...
Modifies file system:
Creates the following files:
- %TEMP%\tmp1.tmp
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %TEMP%\tmp2.tmp
- <SYSTEM32>\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
- %TEMP%\tmp3.tmp
- %HOMEPATH%\Desktop\_Adolf Hitler_.bmp
- C:\_Adolf Hitler_.bmp
- %TEMP%\_Adolf Hitler_.mp3
- %APPDATA%\Microsoft\Protect\CREDHIST
- %WINDIR%\ЧАГж±іѕ°НјЖ¬.bmp
Sets the 'hidden' attribute to the following files:
- <Full path to file>
Deletes the following files:
- %TEMP%\tmp3.tmp
- %TEMP%\tmp2.tmp
- %TEMP%\tmp1.tmp
Moves the following files:
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\mimeTypes.rdf to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\mimeTypes.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\localstore.rdf to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\localstore.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.0FABFBFF000306E4.AdolfHitler
- from %HOMEPATH%\Desktop\_Adolf Hitler_.bmp to %HOMEPATH%\Desktop\_Adolf Hitler_.0FABFBFF000306E4.AdolfHitler
- from %HOMEPATH%\Recent\_Adolf Hitler_.lnk to %HOMEPATH%\Recent\_Adolf Hitler_.0FABFBFF000306E4.AdolfHitler
- from %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\baidu[1] to %HOMEPATH%\Local Settings\<INETFILES>\Content.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Microsoft\Internet Explorer\Desktop.htt to %APPDATA%\Microsoft\Internet Explorer\Desktop.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\desktop.ini to %APPDATA%\desktop.0FABFBFF000306E4.AdolfHitler
- from C:\_Adolf Hitler_.bmp to C:\_Adolf Hitler_.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\winscp.rnd to %APPDATA%\winscp.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Microsoft\Internet Explorer\brndlog.bak to %APPDATA%\Microsoft\Internet Explorer\brndlog.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Microsoft\Address Book\%USERNAME%.wab to %APPDATA%\Microsoft\Address Book\%USERNAME%.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Microsoft\Windows\Themes\Custom.theme to %APPDATA%\Microsoft\Windows\Themes\Custom.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Microsoft\Media Player\0007F0B7.wpl to %APPDATA%\Microsoft\Media Player\0007F0B7.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\profiles.ini to %APPDATA%\Mozilla\Firefox\profiles.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.0FABFBFF000306E4.AdolfHitler
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarks.html to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarks.0FABFBFF000306E4.AdolfHitler
Substitutes the following files:
- <Current directory>\0FABFBFF000306E4.AdolfHitler
Moves itself:
- from <Full path to file> to <Current directory>\<File name>.0FABFBFF000306E4.AdolfHitler
Modifies user data files (Trojan.Encoder).
Network activity:
Connects to:
- '12#.#25.114.144':80
TCP:
HTTP GET requests:
- http://www.ba##u.com/ via 12#.#25.114.144
UDP:
- DNS ASK www.ba##u.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'ИООс№ЬАнЖч.exe'
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''
- ClassName: '' WindowName: 'taskmgr.exe'
- ClassName: '' WindowName: '??????????.exe'
