Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Command Prompt (CMD)
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
modifies the following system settings:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\210252809.jpeg
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\parnas_01.jpeg
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\trivial-merge.htm
- %HOMEPATH%\desktop\tree_view.html
- %HOMEPATH%\desktop\join.avi
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %HOMEPATH%\desktop\ituneshelpunavailable.htm
- %HOMEPATH%\desktop\iisstart.html
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\garden.htm
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\tree_view.htm
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\3.jpeg
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\howto-index.html
- %LOCALAPPDATA%\google\chrome\user data\default\login data
Modifies file system
Creates the following files
- %HOMEPATH%\desktop\pagame lo que me debes perra1.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra74.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra73.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra72.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra71.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra70.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra69.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra68.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra67.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra66.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra65.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra64.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra63.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra62.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra61.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra60.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra59.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra58.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra57.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra56.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra55.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra54.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra52.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra53.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra75.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra76.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra98.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra97.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra96.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra95.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra94.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra93.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra92.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra91.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra90.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra89.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra87.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra37.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra86.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra85.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra84.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra83.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra82.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra81.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra80.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra79.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra78.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra77.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra51.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra50.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra49.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra21.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra20.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra19.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra18.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra17.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra16.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra15.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra14.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra13.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra12.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra11.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra10.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra9.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra8.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra7.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra6.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra5.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra4.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra3.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra2.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra23.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra24.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra22.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra25.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra48.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra26.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra47.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra46.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra45.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra44.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra43.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra42.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra41.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra40.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra39.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra88.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra99.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra36.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra35.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra34.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra33.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra32.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra31.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra30.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra29.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra28.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra27.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra38.txt
- %HOMEPATH%\desktop\pagame lo que me debes perra100.txt
Modifies the following files
- %HOMEPATH%\desktop\210252809.jpeg
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\hi\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\hu\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\id\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\it\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ja\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ko\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\lt\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\lv\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ms\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\sl\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\nl\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\no\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\pl\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\pt_br\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\pt_pt\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ro\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ru\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\sk\messages.json
- %HOMEPATH%\desktop\mail.ru agent.lnk
- %HOMEPATH%\desktop\total commander 64 bit.lnk
- %HOMEPATH%\desktop\telegram.lnk
- %HOMEPATH%\desktop\qip 2012.lnk
- %HOMEPATH%\desktop\icq.lnk
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\3.jpeg
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\he\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\fr\messages.json
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'di##ord.com':443
TCP
Other
- 'di##ord.com':443
UDP
- DNS ASK di##ord.com
