Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <Current directory>\temp.txt
Substitutes the following executable system files
- %WINDIR%\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll with <Current directory>\temp.txt
- %WINDIR%\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\extensibility.dll with <Current directory>\temp.txt
- %WINDIR%\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\Microsoft.Ink.dll with <Current directory>\temp.txt
- %WINDIR%\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\Microsoft.Ink.dll with <Current directory>\temp.txt
- %WINDIR%\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll with <Current directory>\temp.txt
- %WINDIR%\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll with <Current directory>\temp.txt
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\contosoroot.cer
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\weeklysheet1215.doc
- %APPDATA%\mozilla\firefox\profiles.ini
Modifies file system
Creates the following files
- <Current directory>\temp.txt
Deletes the following files
- %WINDIR%\appcompat\programs\recentfilecache.bcf
- %WINDIR%\assembly\desktop.ini
- %WINDIR%\assembly\gac\adodb\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll
- %WINDIR%\assembly\gac\adodb\7.0.3300.0__b03f5f7f11d50a3a\__assemblyinfo__.ini
- %WINDIR%\assembly\gac\extensibility\7.0.3300.0__b03f5f7f11d50a3a\extensibility.dll
- %WINDIR%\assembly\gac\extensibility\7.0.3300.0__b03f5f7f11d50a3a\__assemblyinfo__.ini
- %WINDIR%\assembly\gac\microsoft.ink\1.0.2201.0__31bf3856ad364e35\microsoft.ink.dll
- %WINDIR%\assembly\gac\microsoft.ink\1.0.2201.0__31bf3856ad364e35\__assemblyinfo__.ini
- %WINDIR%\assembly\gac\microsoft.ink\1.7.2600.2180__31bf3856ad364e35\microsoft.ink.dll
- %WINDIR%\assembly\gac\microsoft.ink\1.7.2600.2180__31bf3856ad364e35\__assemblyinfo__.ini
- %WINDIR%\assembly\gac\microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\microsoft.mshtml.dll
- %WINDIR%\assembly\gac\microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\__assemblyinfo__.ini
- %WINDIR%\assembly\gac\microsoft.stdformat\7.0.3300.0__b03f5f7f11d50a3a\microsoft.stdformat.dll
Modifies the following files
- <Current directory>\temp.txt
Substitutes the following executable files
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll
- %APPDATA%\Telegram Desktop\Telegram.exe
- %APPDATA%\Telegram Desktop\unins000.exe
- %APPDATA%\Telegram Desktop\Updater.exe
Substitutes the following files
- %HOMEPATH%\Desktop\applicantform_en.doc
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\sessionstore-backups\recovery.baklz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\sessionstore-backups\recovery.jsonlz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\sessionstore-backups\upgrade.jsonlz4-20200708170202
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\shield-preference-experiments.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\SiteSecurityServiceState.txt
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^userContextId=4294967295\.metadata-v2
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\storage\default\moz-extension+++5fc1ef9c-f7bf-452f-a7ef-92635f5362ce^userContextId=4294967295\idb\3647222921wleabcEoxlt-eengsairo.sql...
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\xulstore.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\sessionstore-backups\previous.jsonlz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\sessionCheckpoints.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\times.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\TRRBlacklist.txt
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\user.js
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\storage\permanent\chrome\.metadata-v2
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729016.2a211dea-1f81-457a-9f7c-a174126ff0dd.new-profile.jsonlz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.lib
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729067.9cd37e15-817f-4044-81be-e43af1dfc595.main.jsonlz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729070.71d7d59d-5451-4f15-bb9e-420e88a3061f.first-shutdown.jsonlz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\datareporting\session-state.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\datareporting\state.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\extension-preferences.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\extensions.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\LICENSE.txt
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\search.json.mozlz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\security_state\data.safe.bin
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\SecurityPreloadState.txt
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\handlers.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\pkcs11.txt
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\prefs.js
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\saved-telemetry-pings\2a211dea-1f81-457a-9f7c-a174126ff0dd
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\saved-telemetry-pings\71d7d59d-5451-4f15-bb9e-420e88a3061f
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\saved-telemetry-pings\9cd37e15-817f-4044-81be-e43af1dfc595
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\saved-telemetry-pings\dc35f7c9-5b80-4042-a301-e84d8619b27e
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\manifest.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\widevinecdm.dll.sig
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\datareporting\archived\2023-09\1694565729047.dc35f7c9-5b80-4042-a301-e84d8619b27e.event.jsonlz4
- %APPDATA%\Mozilla\Firefox\profiles.ini
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\addons.json
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\permissions.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\pkcs11.txt
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\places.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\prefs.js
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\openpgp.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\parent.lock
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\search.json.mozlz4
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\SiteSecurityServiceState.txt
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\storage\permanent\chrome\.metadata-v2
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\storage.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\times.json
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\webappsstore.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\xulstore.json
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\SecurityPreloadState.txt
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\sessionCheckpoints.json
- %APPDATA%\Thunderbird\installs.ini
- %APPDATA%\Thunderbird\Crash Reports\InstallTime20210406220621
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\formhistory.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\addonStartup.json.lz4
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\AlternateServices.txt
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\blist.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\compatibility.ini
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\cookies.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\crashes\store.json.mozlz4
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\global-messages-db.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\abook.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\history.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729880.22a456d0-5d02-445b-9603-4fe4b9e5c45c.new-profile.jsonlz4
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\datareporting\state.json
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\directoryTree.json
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\enigmail.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\extension-preferences.json
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\extensions.json
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\favicons.sqlite
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729925.d8154144-ac52-40e8-b685-b640783b2c0d.main.jsonlz4
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\datareporting\archived\2023-09\1694565729926.199a0618-6d48-4205-858d-6b9a8ba9e913.first-shutdown.jsonlz4
- %APPDATA%\Thunderbird\Profiles\chdgbv82.default-release\datareporting\session-state.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\crashes\store.json.mozlz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\containers.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\compatibility.ini
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Opera.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
- %APPDATA%\Microsoft\Windows\Recent\desktop.ini
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
- %APPDATA%\Microsoft\Protect\S-1-5-21-3150914307-1777937420-491476919-1000\Preferred
- %APPDATA%\Microsoft\Windows\Libraries\desktop.ini
- %APPDATA%\Microsoft\Windows\Libraries\Documents.library-ms
- %APPDATA%\Microsoft\Windows\Libraries\Music.library-ms
- %APPDATA%\Microsoft\Windows\Libraries\Pictures.library-ms
- %APPDATA%\Microsoft\Windows\Libraries\Videos.library-ms
- %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms
- %APPDATA%\Microsoft\Protect\S-1-5-21-3150914307-1777937420-491476919-1000\39666d8e-6840-4731-92f5-211bd00a9866
- %APPDATA%\Microsoft\Protect\CREDHIST
- %APPDATA%\Microsoft\Protect\S-1-5-21-3150914307-1777937420-491476919-1000\51da22b7-9513-4885-adb9-cd2e72f47f0a
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini
- %HOMEPATH%\Desktop\Telegram.lnk
- %HOMEPATH%\Desktop\coffee.bmp
- %HOMEPATH%\Desktop\contoso.cer
- %HOMEPATH%\Desktop\contosoroot.cer
- %HOMEPATH%\Desktop\contosoroot_1.cer
- %HOMEPATH%\Desktop\dashBorder_192.bmp
- %HOMEPATH%\Desktop\delete.avi
- %HOMEPATH%\Desktop\desktop.ini
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
- %APPDATA%\Microsoft\Windows\SendTo\Compressed (zipped) Folder.ZFSendToTarget
- <Current directory>\temp.txt
- %HOMEPATH%\Downloads\desktop.ini
- %HOMEPATH%\Music\desktop.ini
- %HOMEPATH%\Pictures\desktop.ini
- %HOMEPATH%\Videos\desktop.ini
- %HOMEPATH%\Documents\desktop.ini
- %HOMEPATH%\Searches\desktop.ini
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-3150914307-1777937420-491476919-1000\f58155b4b1d5a524ca0261c3ee99fb50_d99ef00b-ccd3-4f1d-9980-90ac453b0b47
- %HOMEPATH%\Desktop\hanni_umami_chapter.doc
- %HOMEPATH%\Desktop\Google Chrome.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini
- %APPDATA%\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Maintenance\Help.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Telegram.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Uninstall Telegram.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\What is new in the latest version.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\desktop.ini
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk
- %APPDATA%\Mozilla\Firefox\Profiles\m15ucxjx.default\user.js
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\addons.json
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\addonStartup.json.lz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\AlternateServices.txt
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\bookmarkbackups\bookmarks-2024-04-09_11_w-7ab47BTxTEWDh4A2YEHg==.jsonlz4
- %APPDATA%\Mozilla\Firefox\Profiles\v08trqk6.default-release\broadcast-listeners.json
- %APPDATA%\Mozilla\Firefox\Crash Reports\InstallTime20200708170202
- %APPDATA%\Mozilla\Firefox\installs.ini
- %APPDATA%\Mozilla\Firefox\Profiles\m15ucxjx.default\times.json
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
- %APPDATA%\Microsoft\Windows\SendTo\Desktop.ini
- %APPDATA%\Microsoft\Windows\SendTo\Fax Recipient.lnk
- %APPDATA%\Microsoft\Windows\SendTo\Mail Recipient.MAPIMail
- %APPDATA%\Microsoft\Windows\Start Menu\desktop.ini
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk
- %APPDATA%\Microsoft\Windows\SendTo\Documents.mydocs
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Command Prompt.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Run.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\computer.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Control Panel.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Private Character Editor.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini
- %APPDATA%\Thunderbird\Profiles\hmz1jddi.default\times.json
- %APPDATA%\Thunderbird\profiles.ini
Modifies user data files (Trojan.Encoder).
