Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Bytelocker' = '"%APPDATA%\{6c9622d6-d1b2-4274-b398-7edbf93e2510}.exe" -nm'
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\sdszfo.docx
Modifies file system
Creates the following files
- %HOMEPATH%\desktop\508softwareandos.doc.skaup
- C:\users\all users\microsoft\windows\caches\{1e8814b6-8f2d-4b97-87f6-9370f7eb40b7}.2.ver0x0000000000000001.db.skaup
- C:\users\all users\microsoft\windows\caches\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db.skaup
- C:\users\all users\microsoft\windows\caches\{4e4260a4-7e39-442e-bc22-7ff751d1c161}.2.ver0x0000000000000002.db.skaup
- C:\users\all users\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db.skaup
- C:\users\all users\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db.skaup
- C:\users\all users\microsoft\windows\caches\{84c252b6-5dca-4ae7-94d3-461f67359cd9}.2.ver0x0000000000000001.db.skaup
- C:\users\all users\microsoft\windows\caches\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db.skaup
- C:\totalcmd\history.txt.skaup
- C:\totalcmd\keyboard.txt.skaup
- C:\users\all users\microsoft\windows\caches\cversions.2.db.skaup
- C:\users\all users\microsoft\windows\caches\{1573b5e2-35f5-4eaf-bec0-4e35d1d995f6}.2.ver0x0000000000000002.db.skaup
- C:\totalcmd\size!.txt.skaup
- C:\far2\savesettings.cmd.skaup
- C:\far2\pluginsdk\headers.pas\farcolorw.pas.skaup
- C:\far2\pluginsdk\headers.pas\farkeysw.pas.skaup
- C:\far2\pluginsdk\headers.pas\pluginw.pas.skaup
- C:\far2\plugins\ftp\ftpcmds.txt.skaup
- C:\far2\plugins\ftp\ftpcmds_rus.txt.skaup
- C:\far2\plugins\ftp\notes.txt.skaup
- C:\far2\plugins\ftp\notes_rus.txt.skaup
- C:\far2\documentation\rus\arc_support.txt.skaup
- C:\far2\clearpluginscache.cmd.skaup
- C:\far2\restoresettings.cmd.skaup
- C:\users\all users\microsoft\windows\ringtones\ringtone 10.wma.skaup
- C:\users\all users\microsoft\windows\ringtones\ringtone 09.wma.skaup
- C:\users\all users\microsoft\windows\ringtones\ringtone 08.wma.skaup
- %HOMEPATH%\desktop\archer.avi.skaup
- %HOMEPATH%\desktop\february_catalogue__2015.doc.skaup
- %HOMEPATH%\desktop\fi51.doc.skaup
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.skaup
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx.skaup
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx.skaup
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx.skaup
- %HOMEPATH%\desktop\join.avi.skaup
- %HOMEPATH%\desktop\lisp_success.doc.skaup
- %HOMEPATH%\desktop\sdszfo.docx.skaup
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.skaup
- C:\users\public\videos\sample videos\wildlife.wmv.skaup
- C:\users\public\music\sample music\maid with the flaxen hair.mp3.skaup
- C:\users\public\music\sample music\sleep away.mp3.skaup
- C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5c82.tmp.appcompat.txt.skaup
- C:\users\all users\microsoft\windows\ringtones\ringtone 01.wma.skaup
- C:\users\all users\microsoft\windows\ringtones\ringtone 02.wma.skaup
- C:\users\all users\microsoft\windows\ringtones\ringtone 03.wma.skaup
- C:\users\all users\microsoft\windows\ringtones\ringtone 04.wma.skaup
- C:\users\all users\microsoft\windows\ringtones\ringtone 05.wma.skaup
- C:\users\all users\microsoft\windows\ringtones\ringtone 06.wma.skaup
- C:\users\all users\microsoft\windows\ringtones\ringtone 07.wma.skaup
- C:\users\public\music\sample music\kalimba.mp3.skaup
- C:\far2\documentation\rus\bug_report.txt.skaup
- C:\far2\documentation\rus\far_faq.txt.skaup
Moves the following files
- from C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5c82.tmp.appcompat.txt.skaup to C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5c82.tmp.appcompat.txt
- from C:\users\all users\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db.skaup to C:\users\all users\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db
- from C:\users\all users\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db.skaup to C:\users\all users\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db
- from C:\users\all users\microsoft\windows\caches\{4e4260a4-7e39-442e-bc22-7ff751d1c161}.2.ver0x0000000000000002.db.skaup to C:\users\all users\microsoft\windows\caches\{4e4260a4-7e39-442e-bc22-7ff751d1c161}.2.ver0x0000000000000002.db
- from C:\users\all users\microsoft\windows\caches\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db.skaup to C:\users\all users\microsoft\windows\caches\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db
- from C:\users\all users\microsoft\windows\caches\{1e8814b6-8f2d-4b97-87f6-9370f7eb40b7}.2.ver0x0000000000000001.db.skaup to C:\users\all users\microsoft\windows\caches\{1e8814b6-8f2d-4b97-87f6-9370f7eb40b7}.2.ver0x0000000000000001.db
- from C:\users\all users\microsoft\windows\caches\{1573b5e2-35f5-4eaf-bec0-4e35d1d995f6}.2.ver0x0000000000000002.db.skaup to C:\users\all users\microsoft\windows\caches\{1573b5e2-35f5-4eaf-bec0-4e35d1d995f6}.2.ver0x0000000000000002.db
- from C:\users\all users\microsoft\windows\caches\cversions.2.db.skaup to C:\users\all users\microsoft\windows\caches\cversions.2.db
- from C:\users\all users\microsoft\windows\ringtones\ringtone 10.wma.skaup to C:\users\all users\microsoft\windows\ringtones\ringtone 10.wma
- from C:\users\all users\microsoft\windows\ringtones\ringtone 09.wma.skaup to C:\users\all users\microsoft\windows\ringtones\ringtone 09.wma
- from C:\users\all users\microsoft\windows\ringtones\ringtone 08.wma.skaup to C:\users\all users\microsoft\windows\ringtones\ringtone 08.wma
- from C:\users\all users\microsoft\windows\ringtones\ringtone 07.wma.skaup to C:\users\all users\microsoft\windows\ringtones\ringtone 07.wma
- from C:\users\all users\microsoft\windows\ringtones\ringtone 06.wma.skaup to C:\users\all users\microsoft\windows\ringtones\ringtone 06.wma
- from C:\users\all users\microsoft\windows\ringtones\ringtone 05.wma.skaup to C:\users\all users\microsoft\windows\ringtones\ringtone 05.wma
- from C:\users\all users\microsoft\windows\ringtones\ringtone 04.wma.skaup to C:\users\all users\microsoft\windows\ringtones\ringtone 04.wma
- from C:\users\all users\microsoft\windows\ringtones\ringtone 03.wma.skaup to C:\users\all users\microsoft\windows\ringtones\ringtone 03.wma
- from C:\users\all users\microsoft\windows\ringtones\ringtone 02.wma.skaup to C:\users\all users\microsoft\windows\ringtones\ringtone 02.wma
- from C:\users\all users\microsoft\windows\ringtones\ringtone 01.wma.skaup to C:\users\all users\microsoft\windows\ringtones\ringtone 01.wma
- from C:\users\all users\microsoft\windows\caches\{84c252b6-5dca-4ae7-94d3-461f67359cd9}.2.ver0x0000000000000001.db.skaup to C:\users\all users\microsoft\windows\caches\{84c252b6-5dca-4ae7-94d3-461f67359cd9}.2.ver0x0000000000000001.db
- from C:\users\all users\microsoft\windows\caches\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db.skaup to C:\users\all users\microsoft\windows\caches\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db
Substitutes the following files
- %HOMEPATH%\Desktop\508softwareandos.doc
- C:\Far2\Documentation\rus\Arc_Support.txt
- C:\Far2\Plugins\FTP\Notes_rus.txt
- C:\Far2\Plugins\FTP\Notes.txt
- C:\Far2\Plugins\FTP\FtpCmds_rus.txt
- C:\Far2\Plugins\FTP\FtpCmds.txt
- C:\Far2\PluginSDK\Headers.pas\PluginW.pas
- C:\Far2\PluginSDK\Headers.pas\FarKeysW.pas
- C:\Far2\PluginSDK\Headers.pas\FarColorW.pas
- C:\Far2\SaveSettings.cmd
- C:\Far2\RestoreSettings.cmd
- C:\Far2\ClearPluginsCache.cmd
- C:\totalcmd\SIZE!.TXT
- C:\totalcmd\KEYBOARD.TXT
- C:\totalcmd\HISTORY.TXT
- C:\Users\Public\Music\Sample Music\Sleep Away.mp3
- C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
- C:\Users\Public\Music\Sample Music\Kalimba.mp3
- C:\Users\Public\Videos\Sample Videos\Wildlife.wmv
- %HOMEPATH%\Desktop\sdszfo.docx
- %HOMEPATH%\Desktop\lisp_success.doc
- %HOMEPATH%\Desktop\join.avi
- %HOMEPATH%\Desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\Desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\Desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\Desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\Desktop\fi51.doc
- %HOMEPATH%\Desktop\february_catalogue__2015.doc
- %HOMEPATH%\Desktop\archer.avi
- %HOMEPATH%\Desktop\aoc_saq_d_v3_merchant.docx
- C:\Far2\Documentation\rus\Bug_Report.txt
- C:\Far2\Documentation\rus\Far_FAQ.txt
Moves itself
- from <Full path to file> to %APPDATA%\{6c9622d6-d1b2-4274-b398-7edbf93e2510}.exe
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c timeout 3 & move /y <Full path to file> %APPDATA%\{6c9622d6-d1b2-4274-b398-7edbf93e2510}.exe & cd /d %APPDATA% & "%APPDATA%\{6c9622d6-d1b2-4274-b398-7edbf93e2510}.exe" -nm' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c timeout 3 & move /y <Full path to file> %APPDATA%\{6c9622d6-d1b2-4274-b398-7edbf93e2510}.exe & cd /d %APPDATA% & "%APPDATA%\{6c9622d6-d1b2-4274-b398-7edbf93e2510}.exe" -nm
- '%WINDIR%\syswow64\timeout.exe' 3
