Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'lsass.exe' = '"%APPDATA%\Microsoft\Windows\lsass.exe" -start'
Creates the following files on removable media
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\roozenedowebinar.pptx
- <Drive name for removable media>:\waterresourcesag.pptx
- <Drive name for removable media>:\gruenspecht_02172016.pptx
- <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
- <Drive name for removable media>:\dotnetfx45_full_setup.exe
- <Drive name for removable media>:\utorrent.exe
- <Drive name for removable media>:\winmine.exe
- <Drive name for removable media>:\chromesetup.exe
- <Drive name for removable media>:\skypesetup.exe
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\weeklysheet1215.doc
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\hanni_umami_chapter.doc
- <Drive name for removable media>:\indogerman2010.pptx
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\!!! all your files are encrypted !!!.txt
- <Drive name for removable media>:\applicantform_en.doc
- <Drive name for removable media>:\hypothyroidism_slides.pptx
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Injects code into
the following system processes:
- %WINDIR%\syswow64\notepad.exe
Modifies file system
Creates the following files
- %TEMP%\73b00817.zeppelin
- C:\far2\plugins\autowrap\!!! all your files are encrypted !!!.txt
- C:\far2\plugins\arclite\!!! all your files are encrypted !!!.txt
- C:\far2\plugins\align\!!! all your files are encrypted !!!.txt
- C:\far2\fexcept\!!! all your files are encrypted !!!.txt
- C:\far2\encyclopedia\tap\!!! all your files are encrypted !!!.txt
- C:\far2\encyclopedia\!!! all your files are encrypted !!!.txt
- C:\far2\documentation\rus\!!! all your files are encrypted !!!.txt
- C:\far2\documentation\eng\!!! all your files are encrypted !!!.txt
- C:\far2\addons\xlat\russian\!!! all your files are encrypted !!!.txt
- C:\far2\addons\xlat\!!! all your files are encrypted !!!.txt
- C:\far2\addons\shell\!!! all your files are encrypted !!!.txt
- C:\far2\addons\setup\!!! all your files are encrypted !!!.txt
- C:\far2\addons\macros\!!! all your files are encrypted !!!.txt
- C:\far2\addons\colors\default_highlighting\!!! all your files are encrypted !!!.txt
- C:\far2\addons\colors\custom_highlighting\!!! all your files are encrypted !!!.txt
- C:\far2\addons\colors\!!! all your files are encrypted !!!.txt
- C:\far2\addons\!!! all your files are encrypted !!!.txt
- C:\far2\!!! all your files are encrypted !!!.txt
- %TEMP%\~temp001.bat
- %TEMP%\49196560.zeppelin
- %APPDATA%\microsoft\windows\lsass.exe
- C:\far2\plugins\brackets\!!! all your files are encrypted !!!.txt
- C:\far2\plugins\compare\!!! all your files are encrypted !!!.txt
Deletes the following files
- %TEMP%\73b00817.zeppelin
- %TEMP%\49196560.zeppelin
Moves the following files
- from %ProgramFiles%\360tray\360tray.exe to %ProgramFiles%\360tray\360tray.exe.1b0-eec-ae3
- from %ProgramFiles%\amsn\amsn.exe to %ProgramFiles%\amsn\amsn.exe.1b0-eec-ae3
- from %ProgramFiles%\anti-trojan\anti-trojan.exe to %ProgramFiles%\anti-trojan\anti-trojan.exe.1b0-eec-ae3
- from %ProgramFiles%\antivirus\antivirus.exe to %ProgramFiles%\antivirus\antivirus.exe.1b0-eec-ae3
- from %ProgramFiles%\aoltbserver\aoltbserver.exe to %ProgramFiles%\aoltbserver\aoltbserver.exe.1b0-eec-ae3
- from %ProgramFiles%\armor2net\armor2net.exe to %ProgramFiles%\armor2net\armor2net.exe.1b0-eec-ae3
- from %ProgramFiles%\armorsurf\armorsurf.exe to %ProgramFiles%\armorsurf\armorsurf.exe.1b0-eec-ae3
- from %ProgramFiles%\ash\ash.exe to %ProgramFiles%\ash\ash.exe.1b0-eec-ae3
- from %ProgramFiles%\ashavast\ashavast.exe to %ProgramFiles%\ashavast\ashavast.exe.1b0-eec-ae3
- from %ProgramFiles%\ashavsrv\ashavsrv.exe to %ProgramFiles%\ashavsrv\ashavsrv.exe.1b0-eec-ae3
- from %ProgramFiles%\ashchest\ashchest.exe to %ProgramFiles%\ashchest\ashchest.exe.1b0-eec-ae3
- from %ProgramFiles%\ashdisp\ashdisp.exe to %ProgramFiles%\ashdisp\ashdisp.exe.1b0-eec-ae3
- from %ProgramFiles%\ashdug\ashdug.exe to %ProgramFiles%\ashdug\ashdug.exe.1b0-eec-ae3
- from %ProgramFiles%\ashenhcd\ashenhcd.exe to %ProgramFiles%\ashenhcd\ashenhcd.exe.1b0-eec-ae3
- from %ProgramFiles%\ashlogv\ashlogv.exe to %ProgramFiles%\ashlogv\ashlogv.exe.1b0-eec-ae3
- from %ProgramFiles%\ashmaisv\ashmaisv.exe to %ProgramFiles%\ashmaisv\ashmaisv.exe.1b0-eec-ae3
- from %ProgramFiles%\ashpopwz\ashpopwz.exe to %ProgramFiles%\ashpopwz\ashpopwz.exe.1b0-eec-ae3
- from %ProgramFiles%\ashquick\ashquick.exe to %ProgramFiles%\ashquick\ashquick.exe.1b0-eec-ae3
- from %ProgramFiles%\amon\amon.exe to %ProgramFiles%\amon\amon.exe.1b0-eec-ae3
- from %ProgramFiles%\ashserv\ashserv.exe to %ProgramFiles%\ashserv\ashserv.exe.1b0-eec-ae3
- from %ProgramFiles%\alsvc\alsvc.exe to %ProgramFiles%\alsvc\alsvc.exe.1b0-eec-ae3
- from %ProgramFiles%\airdefense\airdefense.exe to %ProgramFiles%\airdefense\airdefense.exe.1b0-eec-ae3
- from %ProgramFiles%\a2cmd\a2cmd.exe to %ProgramFiles%\a2cmd\a2cmd.exe.1b0-eec-ae3
- from %ProgramFiles%\a2guard\a2guard.exe to %ProgramFiles%\a2guard\a2guard.exe.1b0-eec-ae3
- from %ProgramFiles%\a2hijackfree\a2hijackfree.exe to %ProgramFiles%\a2hijackfree\a2hijackfree.exe.1b0-eec-ae3
- from %ProgramFiles%\a2scan\a2scan.exe to %ProgramFiles%\a2scan\a2scan.exe.1b0-eec-ae3
- from %ProgramFiles%\a2service\a2service.exe to %ProgramFiles%\a2service\a2service.exe.1b0-eec-ae3
- from %ProgramFiles%\a2start\a2start.exe to %ProgramFiles%\a2start\a2start.exe.1b0-eec-ae3
- from %ProgramFiles%\a2upd\a2upd.exe to %ProgramFiles%\a2upd\a2upd.exe.1b0-eec-ae3
- from %ProgramFiles%\a2wizard\a2wizard.exe to %ProgramFiles%\a2wizard\a2wizard.exe.1b0-eec-ae3
- from %ProgramFiles%\aavshield\aavshield.exe to %ProgramFiles%\aavshield\aavshield.exe.1b0-eec-ae3
- from %ProgramFiles%\about\about.exe to %ProgramFiles%\about\about.exe.1b0-eec-ae3
- from %ProgramFiles%\ackwin32\ackwin32.exe to %ProgramFiles%\ackwin32\ackwin32.exe.1b0-eec-ae3
- from %ProgramFiles%\admunch\admunch.exe to %ProgramFiles%\admunch\admunch.exe.1b0-eec-ae3
- from %ProgramFiles%\agb5\agb5.exe to %ProgramFiles%\agb5\agb5.exe.1b0-eec-ae3
- from %ProgramFiles%\ageofconan\ageofconan.exe to %ProgramFiles%\ageofconan\ageofconan.exe.1b0-eec-ae3
- from %ProgramFiles%\ahnsd\ahnsd.exe to %ProgramFiles%\ahnsd\ahnsd.exe.1b0-eec-ae3
- from %ProgramFiles%\aim6\aim6.exe to %ProgramFiles%\aim6\aim6.exe.1b0-eec-ae3
- from %ProgramFiles%\aimpro\aimpro.exe to %ProgramFiles%\aimpro\aimpro.exe.1b0-eec-ae3
- from %ProgramFiles%\almon\almon.exe to %ProgramFiles%\almon\almon.exe.1b0-eec-ae3
- from %ProgramFiles%\ashsimp2\ashsimp2.exe to %ProgramFiles%\ashsimp2\ashsimp2.exe.1b0-eec-ae3
Deletes itself.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
TCP
HTTP GET requests
- http://ge###tool.com/
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://ip###ger.org/1Prj67.jpeg
UDP
- DNS ASK ge###tool.com
- DNS ASK ge###tatool.com
- DNS ASK microsoft.com
- DNS ASK ip###ger.org
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\lsass.exe' -start
- '%APPDATA%\microsoft\windows\lsass.exe' -agent 0
- '%APPDATA%\microsoft\windows\lsass.exe' -agent 1
- '%APPDATA%\microsoft\windows\lsass.exe' -agent 2
- '%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C %TEMP%\~temp001.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\notepad.exe'
- '%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet
- '%WINDIR%\syswow64\cmd.exe' /C %TEMP%\~temp001.bat
