Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
deletes volume shadow copies.
Modifies file system
Creates the following files
- z:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini
- C:\far2\plugins\arclite\dotzv_readme.txt
- C:\far2\plugins\align\dotzv_readme.txt
- C:\far2\fexcept\dotzv_readme.txt
- C:\far2\encyclopedia\tap\dotzv_readme.txt
- C:\far2\encyclopedia\dotzv_readme.txt
- C:\far2\documentation\rus\dotzv_readme.txt
- C:\far2\documentation\eng\dotzv_readme.txt
- C:\far2\dotzv_readme.txt
- C:\far2\plugins\autowrap\dotzv_readme.txt
- C:\far2\addons\xlat\russian\dotzv_readme.txt
- C:\far2\addons\shell\dotzv_readme.txt
- C:\far2\addons\setup\dotzv_readme.txt
- C:\far2\addons\macros\dotzv_readme.txt
- C:\far2\addons\dotzv_readme.txt
- C:\far2\addons\colors\dotzv_readme.txt
- C:\far2\addons\colors\default_highlighting\dotzv_readme.txt
- D:\dotzv_readme.txt
- C:\far2\addons\colors\custom_highlighting\dotzv_readme.txt
- C:\far2\addons\xlat\dotzv_readme.txt
- C:\far2\plugins\brackets\dotzv_readme.txt
Sets the 'hidden' attribute to the following files
- z:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini
Network activity
Connects to
- '<LOCALNET>.67.1':445
- '<LOCALNET>.67.1':139
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://www.ms####nnecttest.com/connecttest.txt
- http://download.windowsupdate.com/c/msdownload/update/others/2019/12/30378685_721206c65081222488d2fae7cc6ecbca9e5025d4.cab
- http://download.windowsupdate.com/d/msdownload/update/others/2019/08/29692004_8adad4cd466b76f1bfa96233d6832d8a2bbd477a.cab
- http://download.windowsupdate.com/c/msdownload/update/others/2019/10/30015113_f0ac1db5f98499f074c0e673eb42b34311dfe078.cab
- http://download.windowsupdate.com/c/msdownload/update/others/2020/05/31702887_c66d1f08687e7d20809c993d2cddb293957f3ae6.cab
- http://download.windowsupdate.com/d/msdownload/update/others/2019/08/29632392_bfa3183dbb37e66f0fd8e68624b74472de3794ea.cab
UDP
- DNS ASK download.visualstudio.microsoft.com
- DNS ASK microsoft.com
- DNS ASK sls.update.microsoft.com
- DNS ASK ms####nnecttest.com
- DNS ASK ap#.#yip.com
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\wbem\wmic.exe' SHADOWCOPY /nointeractive
- '<SYSTEM32>\vssvc.exe'
