Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'BSOD.exe'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '%WINDIR%\BSOD.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\bsod.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
blocks the following features:
- User Account Control (UAC)
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\000814251_video_01.avi
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\parnas_01.jpeg
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\ituneshelpunavailable.html
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\2.jpeg
- %HOMEPATH%\desktop\13.jpeg
- %HOMEPATH%\desktop\1189.jpeg
- %HOMEPATH%\desktop\trivial-merge.html
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %ProgramFiles%\desktop.ini.at3
- %WINDIR%\syswow64\msvcp140_atomic_wait.dll.at3
- %WINDIR%\syswow64\msvcp120.dll.at3
- %WINDIR%\syswow64\msvcp120d.dll.at3
- %WINDIR%\syswow64\msvcp140.dll.at3
- %WINDIR%\syswow64\msvcp140d.dll.at3
- %WINDIR%\syswow64\msvcp140_1.dll.at3
- %WINDIR%\syswow64\msvcp140_2.dll.at3
- %WINDIR%\syswow64\msvcp140_codecvt_ids.dll.at3
- %WINDIR%\syswow64\mfcm120.dll.at3
- %WINDIR%\syswow64\msvcp90d.dll.at3
- %WINDIR%\syswow64\msvcr100.dll.at3
- %WINDIR%\syswow64\msvcr100d.dll.at3
- %WINDIR%\syswow64\msvcr110.dll.at3
- %WINDIR%\syswow64\msvcr110d.dll.at3
- %WINDIR%\syswow64\msvcr120.dll.at3
- %WINDIR%\syswow64\msvcp110d.dll.at3
- %WINDIR%\syswow64\msvcp110.dll.at3
- %WINDIR%\syswow64\msvcm90d.dll.at3
- %WINDIR%\syswow64\msclmd.dll.at3
- %WINDIR%\syswow64\mfcm140u.dll.at3
- %WINDIR%\syswow64\mfcm140.dll.at3
- %WINDIR%\syswow64\mfcm120u.dll.at3
- %WINDIR%\syswow64\mfcm110u.dll.at3
- %WINDIR%\syswow64\mfc140jpn.dll.at3
- %WINDIR%\syswow64\msvcr120d.dll.at3
- %WINDIR%\syswow64\mfcm100u.dll.at3
- %WINDIR%\syswow64\mfcm100.dll.at3
- %WINDIR%\syswow64\mfc140u.dll.at3
- %WINDIR%\syswow64\mfc140rus.dll.at3
- %WINDIR%\syswow64\mfc140kor.dll.at3
- %WINDIR%\syswow64\msvcp100d.dll.at3
- %WINDIR%\syswow64\mfcm110.dll.at3
- %WINDIR%\syswow64\msvcp100.dll.at3
- %WINDIR%\syswow64\msvcr90d.dll.at3
- %WINDIR%\syswow64\noise.kor.at3
- %WINDIR%\syswow64\vcomp120.dll.at3
- %WINDIR%\syswow64\vcomp140.dll.at3
- %WINDIR%\syswow64\vcruntime140.dll.at3
- %WINDIR%\syswow64\vcruntime140d.dll.at3
- %WINDIR%\syswow64\vfpodbc.dll.at3
- %HOMEPATH%\ntuser.ini.at3
- %HOMEPATH%\music\desktop.ini.at3
- %WINDIR%\syswow64\vcomp100.dll.at3
- %HOMEPATH%\pictures\desktop.ini.at3
- %HOMEPATH%\videos\desktop.ini.at3
- %HOMEPATH%\desktop\000814251_video_01.avi.at3
- %HOMEPATH%\desktop\desktop.ini.at3
- %HOMEPATH%\desktop\google chrome.lnk.at3
- %HOMEPATH%\desktop\telegram.lnk.at3
- %WINDIR%\syswow64\vcomp110.dll.at3
- %WINDIR%\syswow64\vccorlib140d.dll.at3
- %WINDIR%\syswow64\mfc110enu.dll.at3
- %WINDIR%\syswow64\noise.tha.at3
- %WINDIR%\syswow64\perfstringbackup.ini.at3
- %WINDIR%\syswow64\ticrf.rat.at3
- %WINDIR%\syswow64\ucrtbased.dll.at3
- %WINDIR%\syswow64\noise.chs.at3
- %WINDIR%\syswow64\noise.dat.at3
- %WINDIR%\syswow64\noise.cht.at3
- %WINDIR%\syswow64\vcamp110.dll.at3
- %WINDIR%\syswow64\vccorlib110d.dll.at3
- %WINDIR%\syswow64\vccorlib120.dll.at3
- %WINDIR%\syswow64\vccorlib120d.dll.at3
- %WINDIR%\syswow64\vccorlib140.dll.at3
- %WINDIR%\syswow64\vcamp120.dll.at3
- %WINDIR%\syswow64\vcamp140.dll.at3
- %WINDIR%\syswow64\vccorlib110.dll.at3
- %WINDIR%\syswow64\mfc140ita.dll.at3
- %WINDIR%\syswow64\mfc140fra.dll.at3
- %WINDIR%\syswow64\mfc140esn.dll.at3
- %WINDIR%\syswow64\aspnet_counters.dll.at3
- %WINDIR%\syswow64\atl100.dll.at3
- %WINDIR%\syswow64\atl110.dll.at3
- %WINDIR%\syswow64\concrt140.dll.at3
- %WINDIR%\syswow64\concrt140d.dll.at3
- %WINDIR%\syswow64\dssec.dat.at3
- %WINDIR%\syswow64\korwbrkr.lex.at3
- %WINDIR%\syswow64\mfc100fra.dll.at3
- %WINDIR%\syswow64\license.rtf.at3
- %WINDIR%\syswow64\mapisvc.inf.at3
- %WINDIR%\syswow64\mfc100.dll.at3
- %WINDIR%\syswow64\mfc100chs.dll.at3
- %WINDIR%\syswow64\mfc100cht.dll.at3
- %WINDIR%\syswow64\mfc100deu.dll.at3
- %WINDIR%\windowsupdate.log.at3
- %WINDIR%\win.ini.at3
- %ProgramFiles(x86)%\desktop.ini.at3
- %WINDIR%\ocsetup_uninstall_searchengine-client-package.etl.at3
- %WINDIR%\tssysprep.log.at3
- %WINDIR%\system.ini.at3
- %WINDIR%\starter.xml.at3
- %WINDIR%\setuperr.log.at3
- %WINDIR%\setupact.log.at3
- %WINDIR%\syswow64\icrav03.rat.at3
- %WINDIR%\pfro.log.at3
- %WINDIR%\syswow64\mfc100esn.dll.at3
- %WINDIR%\msdfmap.ini.at3
- %WINDIR%\enterprise.xml.at3
- %WINDIR%\dtcinstall.log.at3
- %WINDIR%\bootstat.dat.at3
- C:\users\desktop.ini.at3
- %WINDIR%\ocsetup_cbs_uninstall_searchengine-client-package.txt.at3
- %WINDIR%\syswow64\mfc100enu.dll.at3
- %WINDIR%\syswow64\mfc100ita.dll.at3
- %WINDIR%\syswow64\mfc120deu.dll.at3
- %WINDIR%\syswow64\mfc120esn.dll.at3
- %WINDIR%\syswow64\mfc120fra.dll.at3
- %WINDIR%\syswow64\mfc120ita.dll.at3
- %WINDIR%\syswow64\mfc120jpn.dll.at3
- %WINDIR%\syswow64\mfc120cht.dll.at3
- %WINDIR%\syswow64\mfc100jpn.dll.at3
- %WINDIR%\syswow64\mfc120enu.dll.at3
- %WINDIR%\syswow64\mfc120kor.dll.at3
- %WINDIR%\syswow64\mfc140chs.dll.at3
- %WINDIR%\syswow64\mfc140cht.dll.at3
- %WINDIR%\syswow64\mfc140deu.dll.at3
- %WINDIR%\syswow64\mfc140enu.dll.at3
- %WINDIR%\syswow64\mfc120rus.dll.at3
- %WINDIR%\syswow64\mfc120u.dll.at3
- %WINDIR%\syswow64\mfc140.dll.at3
- %HOMEPATH%\documents\desktop.ini.at3
- %HOMEPATH%\desktop\wrar520.exe.at3
- %WINDIR%\syswow64\mfc110u.dll.at3
- %WINDIR%\syswow64\mfc110rus.dll.at3
- %WINDIR%\syswow64\mfc110kor.dll.at3
- %WINDIR%\syswow64\mfc110jpn.dll.at3
- %WINDIR%\syswow64\mfc110ita.dll.at3
- %WINDIR%\syswow64\mfc110fra.dll.at3
- %WINDIR%\syswow64\mfc110esn.dll.at3
- %WINDIR%\syswow64\mfc120chs.dll.at3
- %WINDIR%\syswow64\mfc110deu.dll.at3
- %WINDIR%\syswow64\mfc110cht.dll.at3
- %WINDIR%\syswow64\mfc110chs.dll.at3
- %WINDIR%\syswow64\mfc110.dll.at3
- %WINDIR%\syswow64\mfc100u.dll.at3
- %WINDIR%\syswow64\mfc100rus.dll.at3
- %WINDIR%\syswow64\mfc100kor.dll.at3
- %WINDIR%\syswow64\mfc120.dll.at3
- %WINDIR%\bsod.exe
Sets the 'hidden' attribute to the following files
- %WINDIR%\bsod.exe
- <Full path to file>
Deletes the following files
- %WINDIR%\bootstat.dat
- %WINDIR%\syswow64\msvcp140_codecvt_ids.dll
- %WINDIR%\syswow64\msvcp140_atomic_wait.dll
- %WINDIR%\syswow64\msvcp140_2.dll
- %WINDIR%\syswow64\msvcp140_1.dll
- %WINDIR%\syswow64\msvcp140d.dll
- %WINDIR%\syswow64\msvcp140.dll
- %WINDIR%\syswow64\msvcp120d.dll
- %WINDIR%\syswow64\msvcp120.dll
- %WINDIR%\syswow64\msvcp110d.dll
- %WINDIR%\syswow64\msvcp110.dll
- %WINDIR%\syswow64\msvcp100d.dll
- %WINDIR%\syswow64\msvcp100.dll
- %WINDIR%\syswow64\msvcm90d.dll
- %WINDIR%\syswow64\mfc140enu.dll
- %WINDIR%\syswow64\msclmd.dll
- %WINDIR%\syswow64\mfcm140.dll
- %WINDIR%\syswow64\mfcm120u.dll
- %WINDIR%\syswow64\mfcm120.dll
- %WINDIR%\syswow64\mfcm110u.dll
- %WINDIR%\syswow64\mfcm110.dll
- %WINDIR%\syswow64\mfcm100u.dll
- %WINDIR%\syswow64\mfcm100.dll
- %WINDIR%\syswow64\mfc140u.dll
- %WINDIR%\syswow64\mfc140rus.dll
- %WINDIR%\syswow64\mfc140kor.dll
- %WINDIR%\syswow64\mfc140jpn.dll
- %WINDIR%\syswow64\mfc140ita.dll
- %WINDIR%\syswow64\mfc140fra.dll
- %WINDIR%\syswow64\mfcm140u.dll
- %WINDIR%\syswow64\mfc140esn.dll
- %WINDIR%\syswow64\msvcp90d.dll
- %WINDIR%\syswow64\ucrtbased.dll
- %WINDIR%\syswow64\vcruntime140.dll
- %WINDIR%\syswow64\vcomp140.dll
- %WINDIR%\syswow64\vcomp120.dll
- %WINDIR%\syswow64\vcomp110.dll
- %WINDIR%\syswow64\vcomp100.dll
- %WINDIR%\syswow64\vccorlib140d.dll
- %WINDIR%\syswow64\vccorlib140.dll
- %WINDIR%\syswow64\vccorlib120d.dll
- %WINDIR%\syswow64\vccorlib120.dll
- %WINDIR%\syswow64\vccorlib110d.dll
- %WINDIR%\syswow64\vccorlib110.dll
- %WINDIR%\syswow64\vcamp140.dll
- %WINDIR%\syswow64\vcamp120.dll
- %WINDIR%\syswow64\msvcr100d.dll
- %WINDIR%\syswow64\msvcr100.dll
- %WINDIR%\syswow64\ticrf.rat
- %WINDIR%\syswow64\perfstringbackup.ini
- %WINDIR%\syswow64\noise.tha
- %WINDIR%\syswow64\noise.kor
- %WINDIR%\syswow64\noise.dat
- %WINDIR%\syswow64\noise.cht
- %WINDIR%\syswow64\noise.chs
- %WINDIR%\syswow64\msvcr90d.dll
- %WINDIR%\syswow64\msvcr120d.dll
- %WINDIR%\syswow64\msvcr120.dll
- %WINDIR%\syswow64\msvcr110d.dll
- %WINDIR%\syswow64\msvcr110.dll
- %WINDIR%\syswow64\msvcr100_clr0400.dll
- %WINDIR%\syswow64\vcamp110.dll
- %WINDIR%\syswow64\mfc140deu.dll
- %WINDIR%\syswow64\mfc140cht.dll
- %WINDIR%\syswow64\mfc140chs.dll
- %WINDIR%\syswow64\mfc100cht.dll
- %WINDIR%\syswow64\mfc100chs.dll
- %WINDIR%\syswow64\mfc100.dll
- %WINDIR%\syswow64\mapisvc.inf
- %WINDIR%\syswow64\license.rtf
- %WINDIR%\syswow64\korwbrkr.lex
- %WINDIR%\syswow64\icrav03.rat
- %WINDIR%\syswow64\dssec.dat
- %WINDIR%\syswow64\concrt140d.dll
- %WINDIR%\syswow64\concrt140.dll
- %WINDIR%\syswow64\atl110.dll
- %WINDIR%\syswow64\atl100.dll
- %WINDIR%\syswow64\mfc100enu.dll
- %WINDIR%\syswow64\aspnet_counters.dll
- %WINDIR%\windowsshell.manifest
- %WINDIR%\win.ini
- %WINDIR%\tssysprep.log
- %WINDIR%\system.ini
- %WINDIR%\starter.xml
- %WINDIR%\setuperr.log
- %WINDIR%\setupact.log
- %WINDIR%\pfro.log
- %WINDIR%\ocsetup_uninstall_searchengine-client-package.etl
- %WINDIR%\ocsetup_cbs_uninstall_searchengine-client-package.txt
- %WINDIR%\msdfmap.ini
- %WINDIR%\enterprise.xml
- %WINDIR%\dtcinstall.log
- %WINDIR%\windowsupdate.log
- %WINDIR%\syswow64\mfc100esn.dll
- %WINDIR%\syswow64\mfc100deu.dll
- %WINDIR%\syswow64\mfc100fra.dll
- %WINDIR%\syswow64\mfc140.dll
- %WINDIR%\syswow64\mfc110rus.dll
- %WINDIR%\syswow64\mfc120u.dll
- %WINDIR%\syswow64\mfc120rus.dll
- %WINDIR%\syswow64\mfc120kor.dll
- %WINDIR%\syswow64\mfc120jpn.dll
- %WINDIR%\syswow64\mfc120ita.dll
- %WINDIR%\syswow64\mfc120fra.dll
- %WINDIR%\syswow64\mfc120esn.dll
- %WINDIR%\syswow64\mfc120enu.dll
- %WINDIR%\syswow64\mfc120deu.dll
- %WINDIR%\syswow64\mfc120cht.dll
- %WINDIR%\syswow64\mfc120chs.dll
- %WINDIR%\syswow64\mfc120.dll
- %WINDIR%\syswow64\mfc110u.dll
- %WINDIR%\syswow64\mfc110kor.dll
- %WINDIR%\syswow64\mfc100ita.dll
- %WINDIR%\syswow64\mfc110jpn.dll
- %WINDIR%\syswow64\mfc110ita.dll
- %WINDIR%\syswow64\mfc110fra.dll
- %WINDIR%\syswow64\mfc110esn.dll
- %WINDIR%\syswow64\mfc110enu.dll
- %WINDIR%\syswow64\mfc110deu.dll
- %WINDIR%\syswow64\mfc110cht.dll
- %WINDIR%\syswow64\mfc110chs.dll
- %WINDIR%\syswow64\mfc110.dll
- %WINDIR%\syswow64\mfc100u.dll
- %WINDIR%\syswow64\mfc100rus.dll
- %WINDIR%\syswow64\mfc100kor.dll
- %WINDIR%\syswow64\mfc100jpn.dll
- %WINDIR%\syswow64\vcruntime140d.dll
- %WINDIR%\syswow64\vfpodbc.dll
Changes user data files extensions (Trojan.Encoder).
