Technical Information
To ensure autorun and distribution
Modifies master boot record (MBR).
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\64bit_notes.htm
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\garden.htm
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\ituneshelpunavailable.htm
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
Modifies file system
Creates the following files
- %HOMEPATH%\your_files_are_encrypted.txt
- %HOMEPATH%\desktop\your_files_are_encrypted.txt
- %HOMEPATH%\downloads\your_files_are_encrypted.txt
- %HOMEPATH%\documents\your_files_are_encrypted.txt
- C:\users\public\your_files_are_encrypted.txt
Moves the following files
- from %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json to %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js to %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\alternateservices.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\alternateservices.txt.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pluginreg.dat to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pluginreg.dat.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\securitypreloadstate.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\securitypreloadstate.txt.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\trrblacklist.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\trrblacklist.txt.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js.sw3nbqts
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json.sw3nbqts
- from %APPDATA%\telegram desktop\unins000.dat to %APPDATA%\telegram desktop\unins000.dat.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\alternateservices.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\alternateservices.txt.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cert9.db to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cert9.db.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\enigmail.sqlite.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\formhistory.sqlite.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\global-messages-db.sqlite.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\history.sqlite.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\key4.db to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\key4.db.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\mailviews.dat to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\mailviews.dat.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\openpgp.sqlite.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\permissions.sqlite.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\securitypreloadstate.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\securitypreloadstate.txt.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sitesecurityservicestate.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sitesecurityservicestate.txt.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\storage.sqlite.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\webappsstore.sqlite.sw3nbqts
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json.sw3nbqts
- from %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json to %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json.sw3nbqts
Modifies the following files
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\alternateservices.txt
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pluginreg.dat
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\securitypreloadstate.txt
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\trrblacklist.txt
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json
- %APPDATA%\telegram desktop\unins000.dat
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\abook.sqlite
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\alternateservices.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\blist.sqlite
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cert9.db
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
