Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\_nemty_o6dttbk_
Creates the following files on removable media
- <Drive name for removable media>:\_nemty_o6dttbk_-decrypt.txt
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\cveuropeo.doc
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im sql.*
- '%WINDIR%\syswow64\net.exe' stop SQLAgent$SQLEXPRESS
- '%WINDIR%\syswow64\net.exe' stop SQLBrowser
- '%WINDIR%\syswow64\net.exe' stop AcrSch2Svc
- '%WINDIR%\syswow64\net.exe' stop Apache2.4
- '%WINDIR%\syswow64\taskkill.exe' /f /im Flow.*
- '%WINDIR%\syswow64\net.exe' stop SQLWriter
- '%WINDIR%\syswow64\net.exe' stop MSSQL$SQLEXPRESS
- '%WINDIR%\syswow64\net.exe' stop AcronisAgent
- '%WINDIR%\syswow64\net.exe' stop cbVSCService11
- '%WINDIR%\syswow64\net.exe' stop MSSQLServerADHelper100
- '%WINDIR%\syswow64\net.exe' stop QBCFMontorService
- '%WINDIR%\syswow64\net.exe' stop OracleServiceXE
- '%WINDIR%\syswow64\net.exe' stop OracleXETNSListener
- '%WINDIR%\syswow64\net.exe' stop MongoDB
- '%WINDIR%\syswow64\taskkill.exe' /f /im thunderbird.*
- '%WINDIR%\syswow64\taskkill.exe' /f /im excel.*
- '%WINDIR%\syswow64\taskkill.exe' /f /im WBGX.*
- '%WINDIR%\syswow64\net.exe' stop
- '%WINDIR%\syswow64\net.exe' stop QBVSS
- '%WINDIR%\syswow64\taskkill.exe' /f /im node.*
- '%WINDIR%\syswow64\taskkill.exe' /f /im QBW32.*
- '%WINDIR%\syswow64\taskkill.exe' /f /im onenote.*
- '%WINDIR%\syswow64\taskkill.exe' /f /im virtualboxvm.*
- '%WINDIR%\syswow64\taskkill.exe' /f /im wordpad.*
- '%WINDIR%\syswow64\taskkill.exe' /f /im outlook.*
- '%WINDIR%\syswow64\taskkill.exe' /f /im oracle.*
- '%WINDIR%\syswow64\taskkill.exe' /f /im Teams.*
- '%WINDIR%\syswow64\taskkill.exe' /f /im winword.*
- '%WINDIR%\syswow64\net.exe' stop DbxSvc
- '%WINDIR%\syswow64\net.exe' stop CobianBackup11
Modifies file system
Creates the following files
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\650860e5119ec19a8de142e32f03c712_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- C:\far2\plugins\compare\_nemty_o6dttbk_-decrypt.txt
- C:\far2\plugins\drawline\_nemty_o6dttbk_-decrypt.txt
- C:\far2\plugins\editcase\_nemty_o6dttbk_-decrypt.txt
- C:\far2\plugins\emenu\_nemty_o6dttbk_-decrypt.txt
- C:\far2\plugins\farcmds\_nemty_o6dttbk_-decrypt.txt
- C:\far2\plugins\filecase\_nemty_o6dttbk_-decrypt.txt
- C:\far2\plugins\ftp\_nemty_o6dttbk_-decrypt.txt
- C:\far2\plugins\ftp\lib\_nemty_o6dttbk_-decrypt.txt
- C:\far2\plugins\autowrap\_nemty_o6dttbk_-decrypt.txt
- C:\far2\plugins\brackets\_nemty_o6dttbk_-decrypt.txt
- C:\far2\plugins\hlfviewer\_nemty_o6dttbk_-decrypt.txt
- C:\far2\plugins\proclist\_nemty_o6dttbk_-decrypt.txt
- C:\far2\plugins\tmppanel\_nemty_o6dttbk_-decrypt.txt
- C:\far2\pluginsdk\_nemty_o6dttbk_-decrypt.txt
- C:\far2\pluginsdk\headers.c\_nemty_o6dttbk_-decrypt.txt
- C:\far2\pluginsdk\headers.pas\_nemty_o6dttbk_-decrypt.txt
- C:\msocache\_nemty_o6dttbk_-decrypt.txt
- C:\msocache\all users\_nemty_o6dttbk_-decrypt.txt
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\_nemty_o6dttbk_-decrypt.txt
- C:\far2\plugins\macroview\_nemty_o6dttbk_-decrypt.txt
- C:\far2\plugins\network\_nemty_o6dttbk_-decrypt.txt
- C:\far2\plugins\arclite\_nemty_o6dttbk_-decrypt.txt
- C:\far2\plugins\align\_nemty_o6dttbk_-decrypt.txt
- C:\far2\plugins\_nemty_o6dttbk_-decrypt.txt
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\94a9cdfb09e37d01f75d09c2c4488906_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- C:\_nemty_o6dttbk_-decrypt.txt
- C:\documents and settings\_nemty_o6dttbk_-decrypt.txt
- D:\_nemty_o6dttbk_-decrypt.txt
- C:\far2\_nemty_o6dttbk_-decrypt.txt
- C:\far2\addons\colors\_nemty_o6dttbk_-decrypt.txt
- C:\far2\addons\_nemty_o6dttbk_-decrypt.txt
- C:\far2\addons\colors\custom_highlighting\_nemty_o6dttbk_-decrypt.txt
- C:\far2\addons\colors\default_highlighting\_nemty_o6dttbk_-decrypt.txt
- %HOMEPATH%\adobeupdate.exe
- C:\far2\addons\macros\_nemty_o6dttbk_-decrypt.txt
- C:\far2\addons\shell\_nemty_o6dttbk_-decrypt.txt
- C:\far2\addons\xlat\_nemty_o6dttbk_-decrypt.txt
- C:\far2\addons\xlat\russian\_nemty_o6dttbk_-decrypt.txt
- C:\far2\documentation\_nemty_o6dttbk_-decrypt.txt
- C:\far2\documentation\eng\_nemty_o6dttbk_-decrypt.txt
- C:\far2\documentation\rus\_nemty_o6dttbk_-decrypt.txt
- C:\far2\encyclopedia\_nemty_o6dttbk_-decrypt.txt
- C:\far2\encyclopedia\tap\_nemty_o6dttbk_-decrypt.txt
- C:\far2\fexcept\_nemty_o6dttbk_-decrypt.txt
- C:\far2\addons\setup\_nemty_o6dttbk_-decrypt.txt
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\_nemty_o6dttbk_-decrypt.txt
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\_nemty_o6dttbk_-decrypt.txt
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\adobeupdate.exe
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ne##y.hk
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=A: /on=A: /maxsize=401MB' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop DbxSvc' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop OracleXETNSListener' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop OracleServiceXE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop AcrSch2Svc' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop AcronisAgent' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop Apache2.4' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop SQLWriter' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$SQLEXPRESS' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop MSSQLServerADHelper100' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop MongoDB' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop SQLAgent$SQLEXPRESS' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop SQLBrowser' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop CobianBackup11' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop cbVSCService11' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop QBCFMontorService' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop QBVSS' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im Flow.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks.exe /create /sc onstart /tn "_NEMTY_O6DTTBK_" /tr "%HOMEPATH%\AdobeUpdate.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im Teams.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im QBW32.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=A: /on=A: /maxsize=unbounded' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=D: /on=D: /maxsize=401MB' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=D: /on=D: /maxsize=unbounded' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=F: /on=F: /maxsize=401MB' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=F: /on=F: /maxsize=unbounded' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im sql.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im winword.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im wordpad.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im outlook.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im thunderbird.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im oracle.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im excel.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im onenote.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im virtualboxvm.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im node.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im WBGX.*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowc...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=A: /on=A: /maxsize=401MB
- '%WINDIR%\syswow64\cmd.exe' /c net stop SQLBrowser
- '%WINDIR%\syswow64\cmd.exe' /c net stop CobianBackup11
- '%WINDIR%\syswow64\cmd.exe' /c net stop cbVSCService11
- '%WINDIR%\syswow64\cmd.exe' /c net stop QBCFMontorService
- '%WINDIR%\syswow64\cmd.exe' /c net stop QBVSS
- '%WINDIR%\syswow64\cmd.exe' /c net stop
- '%WINDIR%\syswow64\cmd.exe' /c schtasks.exe /create /sc onstart /tn "_NEMTY_O6DTTBK_" /tr "%HOMEPATH%\AdobeUpdate.exe"
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowc...
- '%WINDIR%\syswow64\schtasks.exe' /create /sc onstart /tn "_NEMTY_O6DTTBK_" /tr "%HOMEPATH%\AdobeUpdate.exe"
- '<SYSTEM32>\vssvc.exe'
- '%WINDIR%\syswow64\net1.exe' stop MongoDB
- '%WINDIR%\syswow64\cmd.exe' /c net stop MongoDB
- '%WINDIR%\syswow64\cmd.exe' /c net stop SQLAgent$SQLEXPRESS
- '%WINDIR%\syswow64\net1.exe' stop AcrSch2Svc
- '%WINDIR%\syswow64\net1.exe' stop QBVSS
- '%WINDIR%\syswow64\net1.exe' stop CobianBackup11
- '%WINDIR%\syswow64\net1.exe' stop OracleServiceXE
- '%WINDIR%\syswow64\net1.exe' stop MSSQL$SQLEXPRESS
- '%WINDIR%\syswow64\net1.exe' stop AcronisAgent
- '%WINDIR%\syswow64\net1.exe' stop Apache2.4
- '%WINDIR%\syswow64\net1.exe' stop SQLWriter
- '%WINDIR%\syswow64\net1.exe' stop
- '%WINDIR%\syswow64\net1.exe' stop OracleXETNSListener
- '%WINDIR%\syswow64\net1.exe' stop cbVSCService11
- '%WINDIR%\syswow64\net1.exe' stop MSSQLServerADHelper100
- '%WINDIR%\syswow64\net1.exe' stop DbxSvc
- '%WINDIR%\syswow64\net1.exe' stop QBCFMontorService
- '%WINDIR%\syswow64\cmd.exe' /c net stop MSSQLServerADHelper100
- '%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$SQLEXPRESS
- '%WINDIR%\syswow64\cmd.exe' /c net stop SQLWriter
- '%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded
- '%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=D: /on=D: /maxsize=401MB
- '%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=D: /on=D: /maxsize=unbounded
- '%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=F: /on=F: /maxsize=401MB
- '%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=F: /on=F: /maxsize=unbounded
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im sql.*
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im winword.*
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im wordpad.*
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im outlook.*
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im thunderbird.*
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im oracle.*
- '%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=A: /on=A: /maxsize=unbounded
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im excel.*
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im virtualboxvm.*
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im node.*
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im QBW32.*
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im WBGX.*
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im Teams.*
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im Flow.*
- '%WINDIR%\syswow64\cmd.exe' /c net stop DbxSvc
- '%WINDIR%\syswow64\cmd.exe' /c net stop OracleXETNSListener
- '%WINDIR%\syswow64\cmd.exe' /c net stop OracleServiceXE
- '%WINDIR%\syswow64\cmd.exe' /c net stop AcrSch2Svc
- '%WINDIR%\syswow64\cmd.exe' /c net stop AcronisAgent
- '%WINDIR%\syswow64\cmd.exe' /c net stop Apache2.4
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im onenote.*
- '%WINDIR%\syswow64\net1.exe' stop SQLAgent$SQLEXPRESS
- '%WINDIR%\syswow64\net1.exe' stop SQLBrowser
