Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
deletes volume shadow copies.
Modifies file system
Creates the following files
- C:\far2\!!readme_to_decrypt_my_files.txt
- C:\far2\pluginsdk\headers.c\!!readme_to_decrypt_my_files.txt
- C:\far2\plugins\tmppanel\!!readme_to_decrypt_my_files.txt
- C:\far2\plugins\proclist\!!readme_to_decrypt_my_files.txt
- C:\far2\plugins\network\!!readme_to_decrypt_my_files.txt
- C:\far2\plugins\macroview\!!readme_to_decrypt_my_files.txt
- C:\far2\plugins\hlfviewer\!!readme_to_decrypt_my_files.txt
- C:\far2\plugins\ftp\!!readme_to_decrypt_my_files.txt
- C:\far2\plugins\filecase\!!readme_to_decrypt_my_files.txt
- C:\far2\plugins\farcmds\!!readme_to_decrypt_my_files.txt
- C:\far2\plugins\emenu\!!readme_to_decrypt_my_files.txt
- C:\far2\plugins\editcase\!!readme_to_decrypt_my_files.txt
- C:\far2\plugins\drawline\!!readme_to_decrypt_my_files.txt
- C:\far2\plugins\compare\!!readme_to_decrypt_my_files.txt
- C:\far2\plugins\brackets\!!readme_to_decrypt_my_files.txt
- C:\far2\pluginsdk\headers.pas\!!readme_to_decrypt_my_files.txt
- C:\far2\plugins\autowrap\!!readme_to_decrypt_my_files.txt
- C:\far2\plugins\align\!!readme_to_decrypt_my_files.txt
- C:\far2\encyclopedia\tap\!!readme_to_decrypt_my_files.txt
- C:\far2\documentation\rus\!!readme_to_decrypt_my_files.txt
- C:\far2\documentation\eng\!!readme_to_decrypt_my_files.txt
- C:\far2\addons\xlat\!!readme_to_decrypt_my_files.txt
- C:\far2\addons\shell\!!readme_to_decrypt_my_files.txt
- C:\far2\addons\setup\!!readme_to_decrypt_my_files.txt
- C:\far2\addons\macros\!!readme_to_decrypt_my_files.txt
- C:\far2\addons\colors\!!readme_to_decrypt_my_files.txt
- C:\totalcmd\language\!!readme_to_decrypt_my_files.txt
- C:\far2\fexcept\!!readme_to_decrypt_my_files.txt
- C:\far2\encyclopedia\!!readme_to_decrypt_my_files.txt
- C:\far2\addons\!!readme_to_decrypt_my_files.txt
- C:\totalcmd\!!readme_to_decrypt_my_files.txt
- C:\far2\plugins\arclite\!!readme_to_decrypt_my_files.txt
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\!!readme_to_decrypt_my_files.txt
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} recoveryenabled no' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall set allprofiles state off' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} recoveryenabled no
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall set allprofiles state off
- '<SYSTEM32>\bcdedit.exe' /set {current} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\netsh.exe' advfirewall set allprofiles state off
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\svchost.exe' -k swprv
