Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\tileimage.bmp.exe
- <Drive name for removable media>:\issi2013_template_for_posters.docx
- <Drive name for removable media>:\adhd_and_obesity.docx
- <Drive name for removable media>:\holycrosschurchinstructions.docx
- <Drive name for removable media>:\sdszfo.docx
- <Drive name for removable media>:\dashborder_144.bmp.exe
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\dashborder_96.bmp.exe
- <Drive name for removable media>:\sdksampleprivdeveloper.cer.exe
- <Drive name for removable media>:\testee.cer.exe
- <Drive name for removable media>:\contoso.cer.exe
- <Drive name for removable media>:\fi51.doc.exe
- <Drive name for removable media>:\testcertificate.cer.exe
- <Drive name for removable media>:\february_catalogue__2015.doc.exe
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\file_p_00000000_1371597592.docx
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\skypesetup.exe
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer.exe
- <Drive name for removable media>:\split.avi.exe
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\correct.avi.exe
- <Drive name for removable media>:\delete.avi.exe
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\toolbar.bmp.exe
- <Drive name for removable media>:\hntixwlsle\dpwnjuxuyc.exe
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\calc.exe
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\sxstrace.exe
- %WINDIR%\microsoft.net\framework\v2.0.50727\dw20.exe
- %WINDIR%\microsoft.net\framework\v2.0.50727\applaunch.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\bxptpmgpbi\bxptpmgpbi.ico
- %TEMP%\~temp982260.tmp
- %TEMP%\rcxfcf4.tmp
- %ALLUSERSPROFILE%\bxptpmgpbi\owoautigvw
- %ALLUSERSPROFILE%\bxptpmgpbi\sdszfo.docx.ico
- %TEMP%\rcxf70b.tmp
- %ALLUSERSPROFILE%\bxptpmgpbi\noxbpycgbn
- %ALLUSERSPROFILE%\bxptpmgpbi\holycrosschurchinstructions.docx.ico
- %TEMP%\~temp982525.tmp
- %TEMP%\~temp978672.tmp
- %ALLUSERSPROFILE%\bxptpmgpbi\risuaruuoh
- %ALLUSERSPROFILE%\bxptpmgpbi\issi2013_template_for_posters.docx.ico
- %TEMP%\~temp977549.tmp
- %ALLUSERSPROFILE%\bxptpmgpbi\spnrbfhrqa
- %ALLUSERSPROFILE%\bxptpmgpbi\file_p_00000000_1371597592.docx.ico
- %TEMP%\rcxea5e.tmp
- %ALLUSERSPROFILE%\bxptpmgpbi\kfgdujxxdf
- %ALLUSERSPROFILE%\bxptpmgpbi\adhd_and_obesity.docx.ico
- %TEMP%\~temp982650.tmp
- %TEMP%\rcxff35.tmp
- %TEMP%\rcxffa2.tmp
- %TEMP%\rcx1380.tmp
- %TEMP%\~temp987767.tmp
- %TEMP%\rcx12d4.tmp
- %TEMP%\~temp987673.tmp
- %TEMP%\~temp987720.tmp
- %TEMP%\~temp987704.tmp
- %TEMP%\rcxf3c.tmp
- %TEMP%\~temp986612.tmp
- %TEMP%\rcxc8d.tmp
- %TEMP%\rcx780.tmp
- %TEMP%\rcx77f.tmp
- %TEMP%\~temp984647.tmp
- %TEMP%\~temp984225.tmp
- %TEMP%\~temp984163.tmp
- %TEMP%\rcx31b.tmp
- %TEMP%\rcx222.tmp
- %TEMP%\~temp982821.tmp
- %ALLUSERSPROFILE%\bxptpmgpbi\lisp_success.doc.ico
- %TEMP%\rcx139f.tmp
- %TEMP%\~temp977143.tmp
- %ALLUSERSPROFILE%\bxptpmgpbi\uep_form_786_bulletin_1726i602.doc.ico
- %ALLUSERSPROFILE%\bxptpmgpbi\ypmuhtmpea
- %TEMP%\~temp971309.tmp
- %ALLUSERSPROFILE%\bxptpmgpbi\dashborder_144.bmp.ico
- %ALLUSERSPROFILE%\bxptpmgpbi\wiwkkqsfku
- %ALLUSERSPROFILE%\bxptpmgpbi\tileimage.bmp.ico
- %ALLUSERSPROFILE%\bxptpmgpbi\tectwrcdla
- %ALLUSERSPROFILE%\bxptpmgpbi\toolbar.bmp.ico
- %TEMP%\rcxd317.tmp
- %ALLUSERSPROFILE%\bxptpmgpbi\gmaivwkrqm
- %ALLUSERSPROFILE%\bxptpmgpbi\mtydsrqpyw
- %ALLUSERSPROFILE%\bxptpmgpbi\correct.avi.ico
- %ALLUSERSPROFILE%\bxptpmgpbi\ntkhuxrese
- %ALLUSERSPROFILE%\bxptpmgpbi\delete.avi.ico
- %ALLUSERSPROFILE%\bxptpmgpbi\gkbrbxokcr
- %ALLUSERSPROFILE%\bxptpmgpbi\split.avi.ico
- %ALLUSERSPROFILE%\bxptpmgpbi\jdxihmnlcn
- %ALLUSERSPROFILE%\bxptpmgpbi\dashborder_96.bmp.ico
- %ALLUSERSPROFILE%\bxptpmgpbi\sdksampleunprivdeveloper.cer.ico
- %ALLUSERSPROFILE%\bxptpmgpbi\gsnolvcqdu
- %ALLUSERSPROFILE%\bxptpmgpbi\sdksampleprivdeveloper.cer.ico
- %ALLUSERSPROFILE%\bxptpmgpbi\gfxhuhjywl
- %ALLUSERSPROFILE%\bxptpmgpbi\fi51.doc.ico
- %ALLUSERSPROFILE%\bxptpmgpbi\cxbcsksjuh
- %ALLUSERSPROFILE%\bxptpmgpbi\february_catalogue__2015.doc.ico
- %ALLUSERSPROFILE%\bxptpmgpbi\molambofho
- %ALLUSERSPROFILE%\bxptpmgpbi\testcertificate.cer.ico
- %ALLUSERSPROFILE%\bxptpmgpbi\pniujgpktj
- %ALLUSERSPROFILE%\bxptpmgpbi\contoso.cer.ico
- %TEMP%\rcxdcd7.tmp
- %ALLUSERSPROFILE%\bxptpmgpbi\wcxottpbwc
- %TEMP%\rcxdb60.tmp
- %TEMP%\~temp973555.tmp
- %ALLUSERSPROFILE%\bxptpmgpbi\testee.cer.ico
- %TEMP%\rcxdac4.tmp
- %TEMP%\~temp973415.tmp
- %TEMP%\~temp973399.tmp
- %ALLUSERSPROFILE%\bxptpmgpbi\bvqdcolien
- %ALLUSERSPROFILE%\bxptpmgpbi\uhyixmekvd
- %TEMP%\rcx13af.tmp
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\hntixwlsle\dpwnjuxuyc.exe
Moves the following files
- from %TEMP%\rcxd317.tmp to %TEMP%\~temp971309.tmp
- from %TEMP%\rcx1380.tmp to %TEMP%\~temp987720.tmp
- from %TEMP%\rcx12d4.tmp to %TEMP%\~temp987673.tmp
- from %TEMP%\rcxf3c.tmp to %TEMP%\~temp986612.tmp
- from %TEMP%\rcxc8d.tmp to %TEMP%\~temp984225.tmp
- from %TEMP%\rcx780.tmp to %TEMP%\~temp984647.tmp
- from %TEMP%\rcx77f.tmp to %TEMP%\~temp984163.tmp
- from %TEMP%\rcx31b.tmp to %TEMP%\~temp982821.tmp
- from %TEMP%\rcx13af.tmp to %TEMP%\~temp987767.tmp
- from %TEMP%\rcx222.tmp to %TEMP%\~temp982525.tmp
- from %TEMP%\rcxff35.tmp to %TEMP%\~temp982260.tmp
- from %TEMP%\rcxfcf4.tmp to %TEMP%\~temp977549.tmp
- from %TEMP%\rcxf70b.tmp to %TEMP%\~temp978672.tmp
- from %TEMP%\rcxea5e.tmp to %TEMP%\~temp977143.tmp
- from %TEMP%\rcxdcd7.tmp to %TEMP%\~temp973555.tmp
- from %TEMP%\rcxdb60.tmp to %TEMP%\~temp973415.tmp
- from %TEMP%\rcxdac4.tmp to %TEMP%\~temp973399.tmp
- from %TEMP%\rcxffa2.tmp to %TEMP%\~temp982650.tmp
- from %TEMP%\rcx139f.tmp to %TEMP%\~temp987704.tmp
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'za#####1.duckdns.org':6870
TCP
Other
- 'za#####1.duckdns.org':6870
UDP
- DNS ASK za#####1.duckdns.org
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\sxstrace.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\dw20.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\owoautigvw" /out "<Drive name for removable media>:\sdszfo.docx.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\sdszfo.docx.ico" /bin "%ALLUSERSPROFILE%\bxptpmgpbi\jd...
- '%WINDIR%\microsoft.net\framework\v2.0.50727\applaunch.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\noxbpycgbn" /out "<Drive name for removable media>:\holycrosschurchinstructions.docx.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\holycrosschurchinstructions.docx....
- '%WINDIR%\microsoft.net\framework\v2.0.50727\dw20.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\spnrbfhrqa" /out "<Drive name for removable media>:\adhd_and_obesity.docx.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\adhd_and_obesity.docx.ico" /bin "%ALLUSERSPR...
- '%WINDIR%\microsoft.net\framework\v2.0.50727\dw20.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\risuaruuoh" /out "<Drive name for removable media>:\issi2013_template_for_posters.docx.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\issi2013_template_for_posters.d...
- '%WINDIR%\microsoft.net\framework\v2.0.50727\dw20.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\spnrbfhrqa" /out "<Drive name for removable media>:\file_p_00000000_1371597592.docx.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\file_p_00000000_1371597592.docx.ic...
- '%WINDIR%\microsoft.net\framework\v2.0.50727\applaunch.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\gfxhuhjywl" /out "<Drive name for removable media>:\fi51.doc.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\fi51.doc.ico" /bin "%ALLUSERSPROFILE%\bxptpmgpbi\jdxihmnl...
- '%WINDIR%\microsoft.net\framework\v2.0.50727\applaunch.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\cxbcsksjuh" /out "<Drive name for removable media>:\february_catalogue__2015.doc.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\february_catalogue__2015.doc.ico" /bi...
- '%WINDIR%\microsoft.net\framework\v2.0.50727\applaunch.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\molambofho" /out "<Drive name for removable media>:\TestCertificate.cer.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\TestCertificate.cer.ico" /bin "%ALLUSERSPROFIL...
- '%WINDIR%\microsoft.net\framework\v2.0.50727\applaunch.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\pniujgpktj" /out "<Drive name for removable media>:\contoso.cer.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\contoso.cer.ico" /bin "%ALLUSERSPROFILE%\bxptpmgpbi\jd...
- '%WINDIR%\microsoft.net\framework\v2.0.50727\applaunch.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\wcxottpbwc" /out "<Drive name for removable media>:\testEE.cer.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\testEE.cer.ico" /bin "%ALLUSERSPROFILE%\bxptpmgpbi\jdxi...
- '%WINDIR%\microsoft.net\framework\v2.0.50727\dw20.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\bvqdcolien" /out "<Drive name for removable media>:\SDKSamplePrivDeveloper.cer.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\SDKSamplePrivDeveloper.cer.ico" /bin "%...
- '%WINDIR%\microsoft.net\framework\v2.0.50727\applaunch.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\gsnolvcqdu" /out "<Drive name for removable media>:\SDKSampleUnprivDeveloper.cer.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\SDKSampleUnprivDeveloper.cer.ico" /bi...
- '%WINDIR%\microsoft.net\framework\v2.0.50727\applaunch.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\ypmuhtmpea" /out "<Drive name for removable media>:\dashBorder_144.bmp.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\dashBorder_144.bmp.ico" /bin "%ALLUSERSPROFILE%...
- '%WINDIR%\microsoft.net\framework\v2.0.50727\applaunch.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\wiwkkqsfku" /out "<Drive name for removable media>:\tileimage.bmp.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\tileimage.bmp.ico" /bin "%ALLUSERSPROFILE%\bxptpmgpb...
- '%WINDIR%\microsoft.net\framework\v2.0.50727\applaunch.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\tectwrcdla" /out "<Drive name for removable media>:\toolbar.bmp.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\toolbar.bmp.ico" /bin "%ALLUSERSPROFILE%\bxptpmgpbi\jd...
- '%WINDIR%\microsoft.net\framework\v2.0.50727\applaunch.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\gmaivwkrqm" /out "<Drive name for removable media>:\dashBorder_96.bmp.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\dashBorder_96.bmp.ico" /bin "%ALLUSERSPROFILE%\b...
- '%WINDIR%\microsoft.net\framework\v2.0.50727\applaunch.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\mtydsrqpyw" /out "<Drive name for removable media>:\correct.avi.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\correct.avi.ico" /bin "%ALLUSERSPROFILE%\bxptpmgpbi\jd...
- '%WINDIR%\microsoft.net\framework\v2.0.50727\applaunch.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\ntkhuxrese" /out "<Drive name for removable media>:\delete.avi.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\delete.avi.ico" /bin "%ALLUSERSPROFILE%\bxptpmgpbi\jdxi...
- '%WINDIR%\microsoft.net\framework\v2.0.50727\dw20.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\gkbrbxokcr" /out "<Drive name for removable media>:\split.avi.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\split.avi.ico" /bin "%ALLUSERSPROFILE%\bxptpmgpbi\jdxihm...
- '%WINDIR%\microsoft.net\framework\v2.0.50727\dw20.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\laocqqehyx" /out "<Drive name for removable media>:\skypesetup.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\skypesetup.exe.ico" /bin "%ALLUSERSPROFILE%\bxptpmgpbi\...
- '%WINDIR%\microsoft.net\framework\v2.0.50727\dw20.exe' /in "%ALLUSERSPROFILE%\bxptpmgpbi\iileucootn" /out "<Drive name for removable media>:\calc.exe" /icon "%ALLUSERSPROFILE%\bxptpmgpbi\calc.exe.ico" /bin "%ALLUSERSPROFILE%\bxptpmgpbi\jdxihmnlcn"
