Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'SecurityUpdate' = '%TEMP%\0A4897.exe'
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\0a4897.exe
- C:\users\public\pictures\sample pictures\readme_for_unlock.txt
- C:\users\public\music\sample music\readme_for_unlock.txt
- C:\users\public\libraries\readme_for_unlock.txt
- C:\users\public\favorites\readme_for_unlock.txt
- C:\users\public\downloads\readme_for_unlock.txt
- C:\users\public\documents\my videos\readme_for_unlock.txt
- C:\users\public\documents\my pictures\readme_for_unlock.txt
- C:\users\public\documents\my music\readme_for_unlock.txt
- C:\users\public\documents\readme_for_unlock.txt
- C:\users\public\desktop\readme_for_unlock.txt
- C:\users\public\readme_for_unlock.txt
- C:\users\public\recorded tv\readme_for_unlock.txt
- C:\users\default\templates\readme_for_unlock.txt
- C:\users\default\sendto\readme_for_unlock.txt
- C:\users\default\saved games\readme_for_unlock.txt
- C:\users\default\recent\readme_for_unlock.txt
- C:\users\default\printhood\readme_for_unlock.txt
- C:\users\default\nethood\readme_for_unlock.txt
- C:\users\default\links\readme_for_unlock.txt
- C:\users\default\favorites\readme_for_unlock.txt
- C:\users\default\downloads\readme_for_unlock.txt
- C:\users\default\documents\my videos\readme_for_unlock.txt
- C:\users\default\documents\my pictures\readme_for_unlock.txt
- C:\users\default\documents\my music\readme_for_unlock.txt
- C:\users\default\start menu\readme_for_unlock.txt
- %HOMEPATH%\favorites\links for united states\readme_for_unlock.txt
- %HOMEPATH%\voip\readme_for_unlock.txt
- %HOMEPATH%\readme_for_unlock.txt
- %HOMEPATH%\templates\readme_for_unlock.txt
- %HOMEPATH%\start menu\readme_for_unlock.txt
- %HOMEPATH%\sendto\readme_for_unlock.txt
- %HOMEPATH%\searches\readme_for_unlock.txt
- %HOMEPATH%\saved games\readme_for_unlock.txt
- %HOMEPATH%\recent\readme_for_unlock.txt
- %HOMEPATH%\printhood\readme_for_unlock.txt
- %HOMEPATH%\nethood\readme_for_unlock.txt
- %HOMEPATH%\links\readme_for_unlock.txt
- %HOMEPATH%\favorites\windows live\readme_for_unlock.txt
- %HOMEPATH%\favorites\msn websites\readme_for_unlock.txt
- C:\users\default\documents\readme_for_unlock.txt
- %HOMEPATH%\favorites\microsoft websites\readme_for_unlock.txt
- %HOMEPATH%\favorites\links\readme_for_unlock.txt
- %HOMEPATH%\favorites\readme_for_unlock.txt
- %HOMEPATH%\downloads\readme_for_unlock.txt
- %HOMEPATH%\documents\my videos\readme_for_unlock.txt
- %HOMEPATH%\documents\my pictures\readme_for_unlock.txt
- %HOMEPATH%\documents\my music\readme_for_unlock.txt
- %HOMEPATH%\documents\readme_for_unlock.txt
- %HOMEPATH%\desktop\readme_for_unlock.txt
- %HOMEPATH%\cookies\readme_for_unlock.txt
- %HOMEPATH%\contacts\readme_for_unlock.txt
- %HOMEPATH%\application data\readme_for_unlock.txt
- C:\users\public\recorded tv\sample media\readme_for_unlock.txt
- C:\users\public\videos\sample videos\readme_for_unlock.txt
- C:\users\default\desktop\readme_for_unlock.txt
- C:\far2\plugins\brackets\readme_for_unlock.txt
- C:\far2\plugins\align\readme_for_unlock.txt
- C:\far2\plugins\readme_for_unlock.txt
- C:\far2\fexcept\readme_for_unlock.txt
- C:\far2\encyclopedia\tap\readme_for_unlock.txt
- C:\far2\encyclopedia\readme_for_unlock.txt
- C:\far2\documentation\rus\readme_for_unlock.txt
- C:\far2\documentation\eng\readme_for_unlock.txt
- C:\far2\documentation\readme_for_unlock.txt
- C:\far2\addons\xlat\russian\readme_for_unlock.txt
- C:\far2\addons\xlat\readme_for_unlock.txt
- C:\far2\addons\shell\readme_for_unlock.txt
- C:\far2\plugins\arclite\readme_for_unlock.txt
- C:\far2\addons\setup\readme_for_unlock.txt
- C:\far2\addons\colors\default_highlighting\readme_for_unlock.txt
- C:\far2\addons\colors\custom_highlighting\readme_for_unlock.txt
- C:\far2\addons\colors\readme_for_unlock.txt
- C:\far2\addons\readme_for_unlock.txt
- C:\far2\readme_for_unlock.txt
- C:\documents and settings\readme_for_unlock.txt
- C:\readme_for_unlock.txt
- %TEMP%\readme_for_unlock.txt
- %TEMP%\readme_for_unlock.txt.crypt
- <Current directory>\5y9i1p2h1.tmp
- %ALLUSERSPROFILE%\microsoft\settings\8d3j3g0u0.bat
- C:\far2\addons\macros\readme_for_unlock.txt
- C:\far2\plugins\tmppanel\readme_for_unlock.txt
- C:\users\default\application data\readme_for_unlock.txt
- C:\far2\plugins\compare\readme_for_unlock.txt
- C:\users\default\readme_for_unlock.txt
- C:\totalcmd\language\readme_for_unlock.txt
- C:\totalcmd\readme_for_unlock.txt
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\readme_for_unlock.txt
- C:\recovery\readme_for_unlock.txt
- nul
- C:\perflogs\admin\readme_for_unlock.txt
- C:\perflogs\readme_for_unlock.txt
- C:\msocache\readme_for_unlock.txt
- C:\far2\pluginsdk\headers.pas\readme_for_unlock.txt
- C:\far2\pluginsdk\headers.c\readme_for_unlock.txt
- C:\users\default\cookies\readme_for_unlock.txt
- C:\far2\pluginsdk\readme_for_unlock.txt
- C:\far2\plugins\proclist\readme_for_unlock.txt
- C:\far2\plugins\network\readme_for_unlock.txt
- C:\far2\plugins\macroview\readme_for_unlock.txt
- C:\far2\plugins\hlfviewer\readme_for_unlock.txt
- C:\far2\plugins\ftp\lib\readme_for_unlock.txt
- C:\far2\plugins\ftp\readme_for_unlock.txt
- C:\far2\plugins\filecase\readme_for_unlock.txt
- C:\far2\plugins\farcmds\readme_for_unlock.txt
- C:\far2\plugins\emenu\readme_for_unlock.txt
- C:\far2\plugins\editcase\readme_for_unlock.txt
- C:\far2\plugins\drawline\readme_for_unlock.txt
- C:\far2\plugins\autowrap\readme_for_unlock.txt
- <Current directory>\readme_for_unlock.txt
Deletes the following files
- <Current directory>\5y9i1p2h1.tmp
Modifies the following files
- C:\far2\addons\colors\custom_highlighting\black_from_july.reg.dnt
- C:\far2\addons\colors\default_highlighting\rodion_doroshkevich.reg.dnt
- C:\far2\addons\colors\default_highlighting\vaxcolors.reg.dnt
- C:\far2\addons\colors\default_highlighting\nc5pal2.reg.dnt
- C:\far2\addons\colors\default_highlighting\hell.reg.dnt
- C:\far2\addons\colors\default_highlighting\greenmile.reg.dnt
- C:\far2\addons\colors\default_highlighting\farcolors242.reg.dnt
- C:\far2\addons\colors\default_highlighting\dn_like.reg.dnt
- C:\far2\addons\colors\default_highlighting\descript.ion.dnt
- C:\far2\addons\colors\default_highlighting\colors_from_admin_essp_ru.reg.dnt
- C:\far2\addons\colors\default_highlighting\colors_from_sadovoj.reg.dnt
- C:\far2\addons\colors\default_highlighting\colors_from_gernichenko.reg.dnt
- C:\far2\addons\colors\default_highlighting\black_from_july.reg.dnt
- C:\far2\addons\colors\default_highlighting\black_from_myodov.reg.dnt
- C:\far2\addons\colors\default_highlighting\black_from_fonarev.reg.dnt
- C:\far2\addons\colors\custom_highlighting\vaxcolors.reg.dnt
- C:\far2\addons\colors\custom_highlighting\rodion_doroshkevich.reg.dnt
- C:\far2\addons\colors\custom_highlighting\nc5pal2.reg.dnt
- C:\far2\addons\colors\custom_highlighting\hell.reg.dnt
- C:\far2\addons\colors\custom_highlighting\greenmile.reg.dnt
- C:\far2\addons\colors\custom_highlighting\farcolors242.reg.dnt
- C:\far2\addons\colors\custom_highlighting\dn_like.reg.dnt
- C:\far2\addons\colors\custom_highlighting\descript.ion.dnt
- C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg.dnt
- C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg.dnt
- C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg.dnt
- C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg.dnt
- C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg.dnt
- C:\far2\addons\colors\descript.ion.dnt
- C:\far2\addons\descript.ion.dnt
Modifies multiple files.
Substitutes the following files
- %HOMEPATH%\ntuser.pol
- %HOMEPATH%\Searches\Everywhere.search-ms
- %HOMEPATH%\Searches\Indexed Locations.search-ms
Deletes itself.
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%TEMP%\0a4897.exe'
- '%TEMP%\0a4897.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c %ALLUSERSPROFILE%\Microsoft\Settings\8d3J3g0u0.bat' (with hidden window)
- '<SYSTEM32>\cmd.exe' 䌀/c START /b "" cmd /c DEL "<Full path to file>" &EXIT' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c net config server /autodisconnect:-1' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c reg add hklm\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityUpdate /t REG_EXPAND_SZ /d %TEMP%\0A4897.exe /f
- '<SYSTEM32>\cmd.exe' /c %ALLUSERSPROFILE%\Microsoft\Settings\8d3J3g0u0.bat
- '<SYSTEM32>\cmd.exe' 䌀/c START /b "" cmd /c DEL "<Full path to file>" &EXIT
- '<SYSTEM32>\reg.exe' add hklm\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityUpdate /t REG_EXPAND_SZ /d %TEMP%\0A4897.exe /f
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\findstr.exe' /B /L /I /C:0A4897.exe
- '<SYSTEM32>\cmd.exe' /c DEL "<Full path to file>"
- '<SYSTEM32>\cmd.exe' /c net config server /autodisconnect:-1
- '<SYSTEM32>\net.exe' config server /autodisconnect:-1
- '<SYSTEM32>\net1.exe' config server /autodisconnect:-1
- '<SYSTEM32>\timeout.exe' /T 1 /NOBREAK
