Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\desktop.ini
- %HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk
Modifies file system:
Creates the following files:
- %APPDATA%\Microsoft\Protect\CREDHIST
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c0620a1bdb6d0c11d2cff22beeb9a37e_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %APPDATA%\encKey.cryptojoker
- %APPDATA%\jokingwithyou.cryptojoker
- %HOMEPATH%\Desktop\CryptoJoker Recovery Information.txt
Deletes the following files:
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c0620a1bdb6d0c11d2cff22beeb9a37e_23ef5514-3059-436f-a4a7-4cefaab20eb1
Moves the following files:
- from %APPDATA%\desktop.ini to %APPDATA%\desktop.ini.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\localstore.rdf to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\localstore.rdf.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\mimeTypes.rdf to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\mimeTypes.rdf.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite.partially.cryptojoker
- from %APPDATA%\winscp.rnd to %APPDATA%\winscp.rnd.partially.cryptojoker
- from %APPDATA%\Microsoft\Address Book\%USERNAME%.wab to %APPDATA%\Microsoft\Address Book\%USERNAME%.wab.partially.cryptojoker
- from %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~ to %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~.partially.cryptojoker
- from %APPDATA%\Microsoft\Internet Explorer\brndlog.bak to %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.partially.cryptojoker
- from %APPDATA%\Microsoft\Internet Explorer\brndlog.txt to %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.fully.cryptojoker
- from %APPDATA%\Microsoft\Internet Explorer\Desktop.htt to %APPDATA%\Microsoft\Internet Explorer\Desktop.htt.partially.cryptojoker
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini.partially.cryptojoker
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk.partially.cryptojoker
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf.partially.cryptojoker
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk.partially.cryptojoker
- from %APPDATA%\Microsoft\Media Player\0007F0B7.wpl to %APPDATA%\Microsoft\Media Player\0007F0B7.wpl.partially.cryptojoker
- from %APPDATA%\Microsoft\Windows\Themes\Custom.theme to %APPDATA%\Microsoft\Windows\Themes\Custom.theme.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\profiles.ini to %APPDATA%\Mozilla\Firefox\profiles.ini.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarks.html to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarks.html.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite.partially.cryptojoker
- from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css.partially.cryptojoker
Modifies user data files (Trojan.Encoder).
Network activity:
Connects to:
- 'sm##.gmail.com':587
UDP:
- DNS ASK sm##.gmail.com
