Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_...
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\hanni_umami_chapter.doc
- <Drive name for removable media>:\roozenedowebinar.pptx
- <Drive name for removable media>:\middaugh_keynote.pptx
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\000814251_video_01.avi
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\iisstart.htm
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\lock.log
- C:\users\public\recorded tv\sample media\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_...
- C:\users\public\recorded tv\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_t...
- C:\users\public\videos\sample videos\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_plea...
- C:\users\public\videos\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_f...
- C:\users\public\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unl...
- %HOMEPATH%\contacts\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file...
- %HOMEPATH%\desktop\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_...
- %HOMEPATH%\documents\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_fil...
- %HOMEPATH%\downloads\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_fil...
- %HOMEPATH%\favorites\links\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_th...
- %HOMEPATH%\favorites\links for united states\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unl...
- %HOMEPATH%\favorites\microsoft websites\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_p...
- %HOMEPATH%\favorites\msn websites\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_...
- %HOMEPATH%\favorites\windows live\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_...
- %HOMEPATH%\favorites\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_fil...
- %HOMEPATH%\links\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_un...
- %HOMEPATH%\music\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_un...
- %HOMEPATH%\pictures\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file...
- %HOMEPATH%\saved games\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_f...
- %HOMEPATH%\searches\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file...
- %HOMEPATH%\videos\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_u...
- C:\users\public\pictures\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this...
- %HOMEPATH%\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_p...
- C:\users\public\pictures\sample pictures\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_...
- C:\users\public\music\sample music\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please...
- D:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_...
- C:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_...
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_...
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_...
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_...
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_...
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_...
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_...
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_...
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_...
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_...
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_...
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_...
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_...
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_...
- C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file...
- C:\users\default\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_un...
- C:\users\public\desktop\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_...
- C:\users\public\documents\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_thi...
- C:\users\public\downloads\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_thi...
- C:\users\public\libraries\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_thi...
- C:\users\public\music\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_fi...
- C:\users\unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_please_view_this_file_unlock_ple...
Modifies the following files
- <Drive name for removable media>:\correct.avi
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.msi
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.msi
- C:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\desktop.ini
- D:\$recycle.bin\s-1-5-21-3691498038-2086406363-2140527554-1000\desktop.ini
- <Drive name for removable media>:\middaugh_keynote.pptx
- <Drive name for removable media>:\roozenedowebinar.pptx
- <Drive name for removable media>:\applicantform_en.doc
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\hanni_umami_chapter.doc
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\cveuropeo.doc
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\split.avi
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.msi
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
