Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\Satan Cryptor\Shell\Open\Command] '' = 'C:\ST_V2\St_V2.exe "%1"'
Malicious functions:
Reads files which store third party applications passwords:
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite
Modifies file system:
Creates the following files:
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.satan
- %HOMEPATH%\Favorites\Links\customize links.url.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite.satan
- %HOMEPATH%\Favorites\Links\free hotmail.url.satan
- <LS_APPDATA>\iconcache.db.satan
- %HOMEPATH%\Favorites\radio station guide.url.satan
- %HOMEPATH%\Favorites\Links\windows media.url.satan
- %HOMEPATH%\Favorites\Links\windows.url.satan
- %APPDATA%\winscp.rnd.satan
- %HOMEPATH%\Favorites\desktop.ini.satan
- %HOMEPATH%\Favorites\msn.com.url.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\usercontent-example.css.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userchrome-example.css.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarks.html.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json.satan
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\show desktop.scf.satan
- %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.satan
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\windows media player.lnk.satan
- %APPDATA%\Microsoft\Media Player\0007f0b7.wpl.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite.satan
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini.satan
- %HOMEPATH%\Recent\desktop.ini.satan
- %HOMEPATH%\Recent\drwebvirtnet.lnk.satan
- %HOMEPATH%\Recent\scoopy.lnk.satan
- %HOMEPATH%\Recent\local disk (c).lnk.satan
- %HOMEPATH%\My Documents\My Music\sample music.lnk.satan
- %HOMEPATH%\My Documents\My Pictures\desktop.ini.satan
- %HOMEPATH%\My Documents\desktop.ini.satan
- %HOMEPATH%\My Documents\My Music\desktop.ini.satan
- %HOMEPATH%\ntuser.ini.satan
- %HOMEPATH%\SendTo\compressed (zipped) folder.zfsendtotarget.satan
- %HOMEPATH%\Recent\xxx_svga.lnk.satan
- %HOMEPATH%\SendTo\mail recipient.mapimail.satan
- %HOMEPATH%\SendTo\desktop.ini.satan
- %HOMEPATH%\SendTo\desktop (create shortcut).desklink.satan
- %HOMEPATH%\Recent\video7.0.lnk.satan
- %HOMEPATH%\Recent\scsi.lnk.satan
- %HOMEPATH%\Recent\vm_shara on '.hostshared folders' (z).lnk.satan
- %HOMEPATH%\Recent\xxscsi.lnk.satan
- %HOMEPATH%\My Documents\My Pictures\sample pictures.lnk.satan
- <LS_APPDATA>\Microsoft\Media Player\currentdatabase_59r.wmdb.satan
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\folders.dbx.satan
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\_cache_003_.satan
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\_cache_001_.satan
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\offline.dbx.satan
- %APPDATA%\Mozilla\Firefox\profiles.ini.satan
- %HOMEPATH%\Favorites\Links\windows marketplace.url.satan
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\outbox.dbx.satan
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\inbox.dbx.satan
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\xul.mfl.satan
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\startupcache.4.little.satan
- %HOMEPATH%\Local Settings\<INETFILES>\desktop.ini.satan
- %HOMEPATH%\Local Settings\History\History.IE5\desktop.ini.satan
- %HOMEPATH%\Local Settings\History\desktop.ini.satan
- %HOMEPATH%\Local Settings\desktop.ini.satan
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\_cache_map_.satan
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\urlclassifier3.sqlite.satan
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\_cache_002_.satan
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini.satan
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\desktop.ini.satan
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\desktop.ini.satan
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\notepad.lnk.satan
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\windows media player.lnk.satan
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\command prompt.lnk.satan
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\narrator.lnk.satan
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\magnifier.lnk.satan
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\utility manager.lnk.satan
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\on-screen keyboard.lnk.satan
- C:\Documents and Settings\Default User\Templates\amipro.sam.satan
- C:\Documents and Settings\Default User\Start Menu\Programs\remote assistance.lnk.satan
- C:\Documents and Settings\Default User\Templates\excel.xls.satan
- C:\Documents and Settings\Default User\Start Menu\Programs\windows media player.lnk.satan
- C:\Documents and Settings\Default User\Start Menu\Programs\desktop.ini.satan
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\synchronize.lnk.satan
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\program compatibility wizard.lnk.satan
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\windows explorer.lnk.satan
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\tour windows xp.lnk.satan
- C:\Documents and Settings\Default User\Start Menu\desktop.ini.satan
- C:\Documents and Settings\Default User\Local Settings\History\desktop.ini.satan
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\currentdatabase_59r.wmdb.satan
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\desktop.ini.satan
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\desktop.ini.satan
- C:\Documents and Settings\Default User\Application Data\desktop.ini.satan
- C:\ST_V2\St_V2.exe
- C:\ReadMe.TXT
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.satan
- C:\autoexec.bat.satan
- C:\Documents and Settings\Default User\SendTo\desktop (create shortcut).desklink.satan
- C:\Documents and Settings\Default User\SendTo\compressed (zipped) folder.zfsendtotarget.satan
- C:\Documents and Settings\Default User\SendTo\mail recipient.mapimail.satan
- C:\Documents and Settings\Default User\SendTo\desktop.ini.satan
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\desktop.ini.satan
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\desktop.ini.satan
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\desktop.ini.satan
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\desktop.ini.satan
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\desktop.ini.satan
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\desktop.ini.satan
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\desktop.ini.satan
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\desktop.ini.satan
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\desktop.ini.satan
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\desktop.ini.satan
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\desktop.ini.satan
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\desktop.ini.satan
- C:\Documents and Settings\NetworkService\Local Settings\History\desktop.ini.satan
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\desktop.ini.satan
- %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.satan
- %APPDATA%\Microsoft\Address Book\%USERNAME%.wab.satan
- %APPDATA%\Microsoft\Internet Explorer\desktop.htt.satan
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\launch internet explorer browser.lnk.satan
- %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~.satan
- C:\Documents and Settings\NetworkService\ntuser.ini.satan
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\desktop.ini.satan
- %APPDATA%\desktop.ini.satan
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\desktop.ini.satan
- C:\Documents and Settings\LocalService\ntuser.ini.satan
- C:\Documents and Settings\Default User\Templates\sndrec.wav.satan
- C:\Documents and Settings\Default User\Templates\quattro.wb2.satan
- C:\Documents and Settings\Default User\Templates\wordpfct.wpd.satan
- C:\Documents and Settings\Default User\Templates\winword.doc.satan
- C:\Documents and Settings\Default User\Templates\presenta.shw.satan
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\desktop.ini.satan
- C:\Documents and Settings\Default User\Templates\excel4.xls.satan
- C:\Documents and Settings\Default User\Templates\powerpnt.ppt.satan
- C:\Documents and Settings\Default User\Templates\lotus.wk4.satan
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\desktop.ini.satan
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\desktop.ini.satan
- C:\Documents and Settings\NetworkService\Local Settings\desktop.ini.satan
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\desktop.ini.satan
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\desktop.ini.satan
- C:\Documents and Settings\Default User\Templates\wordpfct.wpg.satan
- C:\Documents and Settings\Default User\Templates\winword2.doc.satan
- C:\Documents and Settings\LocalService\Local Settings\History\desktop.ini.satan
- C:\Documents and Settings\LocalService\Local Settings\desktop.ini.satan
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity:
Connects to:
- '61.##0.3.151':80
TCP:
HTTP GET requests:
- http://61.##0.3.151/data/count.php?st################################################################################
