Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\1sm_price.xls
- <Drive name for removable media>:\10thingscondoms.pdf
- <Drive name for removable media>:\samieee_obiee_presentation.pptx
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\servicing\trustedinstaller.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\tree_view.htm
- %HOMEPATH%\desktop\trivial-merge.htm
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\garden.htm
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\about.htm
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
Modifies file system
Creates the following files
- C:\totalcmd\de5aad-readme.txt
- %LOCALAPPDATA%\google\chrome\user data\de5aad-readme.txt
- %ProgramFiles(x86)%\winamp\system\de5aad-readme.txt
- %HOMEPATH%\de5aad-readme.txt
- %PROGRAMDATA%\microsoft\user account pictures\de5aad-readme.txt
- %ProgramFiles(x86)%\mirc\de5aad-readme.txt
- %ProgramFiles(x86)%\winamp\de5aad-readme.txt
- %ProgramFiles(x86)%\opera\29.0.1795.47\de5aad-readme.txt
- %HOMEPATH%\favorites\msn websites\de5aad-readme.txt
- %HOMEPATH%\favorites\windows live\de5aad-readme.txt
- C:\users\public\recorded tv\sample media\de5aad-readme.txt
- C:\users\public\videos\sample videos\de5aad-readme.txt
- C:\users\public\pictures\sample pictures\de5aad-readme.txt
- %ProgramFiles(x86)%\k-lite codec pack\icaros\resources\de5aad-readme.txt
- %ProgramFiles(x86)%\google\chrome\application\de5aad-readme.txt
- %LOCALAPPDATA%\google\chrome\user data\default\cache\de5aad-readme.txt
- %ProgramFiles(x86)%\microsoft office\office14\1033\de5aad-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\de5aad-readme.txt
- %HOMEPATH%\favorites\links\de5aad-readme.txt
- C:\users\public\libraries\de5aad-readme.txt
- %ProgramFiles(x86)%\mirc\defaults\de5aad-readme.txt
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\de5aad-readme.txt
- %ProgramFiles(x86)%\msbuild\de5aad-readme.txt
- C:\far2\de5aad-readme.txt
- %ProgramFiles(x86)%\k-lite codec pack\icaros\de5aad-readme.txt
- %HOMEPATH%\contacts\de5aad-readme.txt
- %ProgramFiles(x86)%\adobe\acrobat reader dc\de5aad-readme.txt
- %ProgramFiles(x86)%\microsoft office\office10\de5aad-readme.txt
- D:\de5aad-readme.txt
- %HOMEPATH%\desktop\de5aad-readme.txt
- %ProgramFiles(x86)%\qip 2012\de5aad-readme.txt
- %ProgramFiles(x86)%\k-lite codec pack\de5aad-readme.txt
- %LOCALAPPDATA%\google\chrome\user data\default\de5aad-readme.txt
Moves the following files
- from %ProgramFiles(x86)%\qip 2012\unins000.msg to %ProgramFiles(x86)%\qip 2012\unins000.msg.de5aad
- from %ProgramFiles(x86)%\winamp\system\wasabi2.w5s to %ProgramFiles(x86)%\winamp\system\wasabi2.w5s.de5aad
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig.de5aad
- from %ProgramFiles(x86)%\k-lite codec pack\filters\ffdshow\ffdshow.ax to %ProgramFiles(x86)%\k-lite codec pack\filters\ffdshow\ffdshow.ax.de5aad
- from %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\natives_blob.bin to %ProgramFiles(x86)%\google\chrome\application\42.0.2311.135\natives_blob.bin.de5aad
- from %APPDATA%\mirc\mirc.ini to %APPDATA%\mirc\mirc.ini.de5aad
- from %ProgramFiles(x86)%\winamp\system\vp8.wbm to %ProgramFiles(x86)%\winamp\system\vp8.wbm.de5aad
- from %ProgramFiles(x86)%\mirc\mirc.chm to %ProgramFiles(x86)%\mirc\mirc.chm.de5aad
- from %ProgramFiles(x86)%\winamp\install.ini to %ProgramFiles(x86)%\winamp\install.ini.de5aad
- from %ProgramFiles(x86)%\mirc\versions.txt to %ProgramFiles(x86)%\mirc\versions.txt.de5aad
- from %ProgramFiles(x86)%\winamp\whatsnew.txt to %ProgramFiles(x86)%\winamp\whatsnew.txt.de5aad
- from %ProgramFiles(x86)%\mirc\defaults\servers.ini to %ProgramFiles(x86)%\mirc\defaults\servers.ini.de5aad
- from %ProgramFiles(x86)%\winamp\components\ssdp.w6c to %ProgramFiles(x86)%\winamp\components\ssdp.w6c.de5aad
- from %ProgramFiles(x86)%\k-lite codec pack\icaros\resources\icarosdescriptions.propdesc to %ProgramFiles(x86)%\k-lite codec pack\icaros\resources\icarosdescriptions.propdesc.de5aad
- from %ProgramFiles(x86)%\google\chrome\application\debug.log to %ProgramFiles(x86)%\google\chrome\application\debug.log.de5aad
- from %ProgramFiles(x86)%\qip 2012\smilies\qip smilies\aa.gif to %ProgramFiles(x86)%\qip 2012\smilies\qip smilies\aa.gif.de5aad
- from %ProgramFiles(x86)%\opera\29.0.1795.47\opera_autoupdate.licenses to %ProgramFiles(x86)%\opera\29.0.1795.47\opera_autoupdate.licenses.de5aad
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der.de5aad
- from %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm to %ProgramFiles(x86)%\microsoft office\office14\1033\vbaows10.chm.de5aad
- from %ProgramFiles(x86)%\microsoft office\office10\thdic.lex to %ProgramFiles(x86)%\microsoft office\office10\thdic.lex.de5aad
- from %ProgramFiles(x86)%\k-lite codec pack\unins000.dat to %ProgramFiles(x86)%\k-lite codec pack\unins000.dat.de5aad
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini.de5aad
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest.de5aad
- from %ProgramFiles(x86)%\mirc\defaults\mirc.ini to %ProgramFiles(x86)%\mirc\defaults\mirc.ini.de5aad
- from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets.de5aad
- from %ProgramFiles(x86)%\k-lite codec pack\icaros\icaros license.txt to %ProgramFiles(x86)%\k-lite codec pack\icaros\icaros license.txt.de5aad
- from %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt to %ProgramFiles(x86)%\k-lite codec pack\icaros\ffmpeg license.txt.de5aad
- from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm.de5aad
- from %ProgramFiles(x86)%\microsoft office\office10\trigram.lex to %ProgramFiles(x86)%\microsoft office\office10\trigram.lex.de5aad
- from %ProgramFiles(x86)%\qip 2012\unins000.dat to %ProgramFiles(x86)%\qip 2012\unins000.dat.de5aad
- from %ProgramFiles(x86)%\winamp\system\xml.w5s to %ProgramFiles(x86)%\winamp\system\xml.w5s.de5aad
- from %ProgramFiles(x86)%\winamp\system\xspf.w5s to %ProgramFiles(x86)%\winamp\system\xspf.w5s.de5aad
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
