Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Classes\.EF9E23B4\shell\Open\command] '' = 'explorer.exe RecoveryManual.html'
Creates the following files on removable media
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\iisstart.htm
- <Drive name for removable media>:\tree_view.htm
- <Drive name for removable media>:\about.htm
- <Drive name for removable media>:\alert.htm
- <Drive name for removable media>:\tree_view.html
- <Drive name for removable media>:\api-hashmap.html
- <Drive name for removable media>:\trivial-merge.html
- <Drive name for removable media>:\alert.html
- <Drive name for removable media>:\pushkin.jpeg
- <Drive name for removable media>:\168.jpeg
- <Drive name for removable media>:\firefly1.mov
- <Drive name for removable media>:\13.jpeg
- <Drive name for removable media>:\parnas_01.jpeg
- <Drive name for removable media>:\2.jpg
- <Drive name for removable media>:\13.jpg
- <Drive name for removable media>:\168.jpg
- <Drive name for removable media>:\3.jpg
- <Drive name for removable media>:\pushkin.jpg
- <Drive name for removable media>:\region-north-karelia.jpg
- <Drive name for removable media>:\scan.mov
- <Drive name for removable media>:\64bit_notes.htm
- <Drive name for removable media>:\region-north-karelia.jpeg
- <Drive name for removable media>:\glidescope_review_rev_010.docx
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\recoverymanual.html
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\nwfieldnotes1966.docx
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\cveuropeo.doc
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\weeklysheet1215.doc
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
- <Drive name for removable media>:\thlps_keeper_mayer_1965.docx
- <Drive name for removable media>:\aoc_saq_d_v3_merchant.docx
- <Drive name for removable media>:\adhd_and_obesity.docx
- <Drive name for removable media>:\video.mp4
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe
Modifies file system
Creates the following files
- %TEMP%\~1059106.tmp
- C:\far2\fexcept\recoverymanual.html
- C:\far2\encyclopedia\tap\recoverymanual.html
- C:\far2\encyclopedia\recoverymanual.html
- C:\far2\documentation\rus\recoverymanual.html
- C:\far2\documentation\eng\recoverymanual.html
- C:\far2\recoverymanual.html
- C:\far2\addons\xlat\russian\recoverymanual.html
- C:\far2\plugins\align\recoverymanual.html
- C:\far2\addons\xlat\recoverymanual.html
- C:\far2\addons\setup\recoverymanual.html
- C:\far2\addons\macros\recoverymanual.html
- C:\far2\addons\recoverymanual.html
- C:\far2\addons\colors\recoverymanual.html
- C:\far2\addons\colors\default_highlighting\recoverymanual.html
- C:\far2\addons\colors\custom_highlighting\recoverymanual.html
- D:\recoverymanual.html
- C:\far2\addons\shell\recoverymanual.html
- C:\far2\plugins\arclite\recoverymanual.html
Deletes the following files
- %TEMP%\~1059106.tmp
Substitutes the following executable files
- C:\Far2\Plugins\arclite\7z.sfx
- C:\Far2\Plugins\arclite\7zCon.sfx
- C:\Far2\Plugins\arclite\7zS2.sfx
- C:\Far2\Plugins\arclite\7zS2con.sfx
- C:\Far2\Plugins\arclite\7zSD.sfx
Substitutes the following files
- D:\install.log
- C:\Far2\Addons\Macros\View_Space.reg
- C:\Far2\Addons\Macros\WheelScreenSwitch.reg
- C:\Far2\Addons\README.TXT
- C:\Far2\Addons\SetUp\Default165.reg
- C:\Far2\Addons\SetUp\Descript.ion
- C:\Far2\Addons\SetUp\Executor_4NT.reg
- C:\Far2\Addons\SetUp\WindowsGUI.reg
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
- C:\Far2\Addons\Shell\Descript.ion
- C:\Far2\Addons\XLat\Descript.ion
- C:\Far2\Addons\XLat\Russian\AltR.reg
- C:\Far2\Addons\XLat\Russian\Apps.reg
- C:\Far2\Addons\XLat\Russian\CtrlR.reg
- C:\Far2\Addons\XLat\Russian\CtrlShiftX.reg
- C:\Far2\Addons\Macros\View_ShiftInsSearch.reg
- C:\Far2\Addons\Macros\View_PgDn.reg
- C:\Far2\Addons\Macros\View_NextPrevFile.reg
- C:\Far2\Addons\Macros\View_CtrlUpDown.reg
- C:\Far2\Addons\Macros\ShiftTab.reg
- C:\Far2\Addons\Macros\ShiftF1.reg
- C:\Far2\Addons\Macros\ShiftBS.reg
- C:\Far2\Addons\Macros\Panel_SpaceToSelect.reg
- C:\Far2\Addons\Macros\Panel_SelectFromClipboard.reg
- C:\Far2\Addons\SetUp\Executor_CMD.reg
- C:\Far2\Addons\Macros\Panel_Numpad.reg
- C:\Far2\Addons\Macros\Panel_MouseWheelTilt.reg
- <Drive name for removable media>:\weeklysheet1215.doc
- <Drive name for removable media>:\february_catalogue__2015.doc
- C:\Far2\Addons\Macros\Panel_Lynx_mot.reg
- C:\Far2\Addons\Macros\Panel_JumpToSelectedFile.reg
- C:\Far2\Addons\Macros\Panel_Esc.reg
- C:\Far2\Addons\XLat\Russian\Descript.ion
- C:\Far2\Addons\XLat\Russian\Qwerty.reg
- C:\Far2\changelog
- C:\Far2\changelog_eng
- C:\Far2\FarEng.hlf
- C:\Far2\FarEng.lng
- C:\Far2\FarGer.lng
- C:\Far2\FarHun.hlf
- C:\Far2\FarHun.lng
- C:\Far2\FarPol.lng
- C:\Far2\FarRus.lng
- C:\Far2\Addons\Macros\Panel_Del.reg
- C:\Far2\FarSpa.lng
- C:\Far2\FExcept\changelog
- C:\Far2\FExcept\SetFarExceptionHandler.reg
- C:\Far2\File_id.diz
- C:\Far2\Plugins\Align\Align.map
- C:\Far2\Plugins\Align\AlignEng.lng
- C:\Far2\FarCze.lng
- C:\Far2\Documentation\rus\Bug_Report.txt
- C:\Far2\far.map
- C:\Far2\Documentation\rus\Arc_Support.txt
- C:\Far2\Documentation\eng\Arc_Support.txt
- C:\Far2\Documentation\eng\Bug_Report.txt
- C:\Far2\Documentation\eng\Far_FAQ.txt
- C:\Far2\Documentation\eng\Plugins_Install.txt
- C:\Far2\Documentation\eng\Plugins_Review.txt
- C:\Far2\Documentation\eng\TechInfo.txt
- C:\Far2\Plugins\Align\AlignRus.lng
- C:\Far2\Encyclopedia\tap\code.bin
- C:\Far2\Documentation\rus\Far_FAQ.txt
- C:\Far2\Documentation\rus\Plugins_Install.txt
- C:\Far2\Documentation\rus\Plugins_Review.txt
- C:\Far2\Documentation\rus\TechInfo.txt
- C:\Far2\Encyclopedia\FarEncyclopedia_ru.chm
- C:\Far2\Encyclopedia\tap\12_r0m.tap
- C:\Far2\Encyclopedia\tap\code.idb
- C:\Far2\FarRus.hlf
- C:\Far2\Addons\Macros\Panel_CtrlShiftPgUpDn.reg
- C:\Far2\Addons\Macros\MacroConsts.reg
- C:\Far2\Addons\Colors\Custom_Highlighting\Colors_from_Gernichenko.reg
- <Drive name for removable media>:\fi51.doc
- C:\Far2\Addons\Colors\Custom_Highlighting\Colors_from_Sadovoj.reg
- C:\Far2\Addons\Colors\Custom_Highlighting\Descript.ion
- C:\Far2\Addons\Colors\Custom_Highlighting\dn_like.reg
- C:\Far2\Addons\Colors\Custom_Highlighting\FARColors242.reg
- C:\Far2\Addons\Colors\Custom_Highlighting\hell.reg
- <Drive name for removable media>:\dial.bmp
- C:\Far2\Addons\Colors\Custom_Highlighting\nc5pal2.reg
- C:\Far2\Addons\Colors\Custom_Highlighting\Rodion_Doroshkevich.reg
- C:\Far2\Addons\Colors\Custom_Highlighting\VaxColors.reg
- C:\Far2\Addons\Colors\Default_Highlighting\black_from_Fonarev.reg
- C:\Far2\Addons\Colors\Default_Highlighting\black_from_july.reg
- C:\Far2\Addons\Colors\Default_Highlighting\black_from_Myodov.reg
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\TestCertificate.cer
- <Drive name for removable media>:\SDKSamplePrivDeveloper.cer
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\SDKFailsafeEmulator.cer
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\dashBorder_144.bmp
- <Drive name for removable media>:\dashBorder_120.bmp
- C:\Far2\Addons\Colors\Custom_Highlighting\GreenMile.reg
- C:\Far2\Addons\Colors\Custom_Highlighting\Colors_from_admin_essp_ru.reg
- <Drive name for removable media>:\split.avi
- C:\Far2\Addons\Colors\Custom_Highlighting\black_from_Myodov.reg
- C:\Far2\Addons\Colors\Custom_Highlighting\black_from_july.reg
- C:\Far2\Addons\Colors\Custom_Highlighting\black_from_Fonarev.reg
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\delete.avi
- C:\Far2\Addons\Colors\Default_Highlighting\Colors_from_admin_essp_ru.reg
- C:\Far2\Addons\Colors\Default_Highlighting\Colors_from_Gernichenko.reg
- C:\Far2\Addons\Colors\Default_Highlighting\Colors_from_Sadovoj.reg
- C:\Far2\Addons\Colors\Default_Highlighting\Descript.ion
- C:\Far2\Addons\Macros\Edit_Notepad.reg
- C:\Far2\Addons\Macros\Edit_SaveAndExit.reg
- C:\Far2\Addons\Macros\Edit_SaveFile.reg
- C:\Far2\Addons\Macros\F3.reg
- C:\Far2\Addons\Macros\F9DeactivateMenu.reg
- C:\Far2\Addons\Macros\F9Table.reg
- C:\Far2\Addons\Macros\OpeningLastFile.reg
- C:\Far2\Addons\Macros\Panel_CtrlShiftBackSlash.reg
- C:\Far2\Addons\Macros\Panel_AltBS.reg
- C:\Far2\Addons\Macros\Panel_Apps.reg
- C:\Far2\Addons\Macros\Panel_BS.reg
- C:\Far2\Addons\Macros\Panel_CtrlIns__.reg
- C:\Far2\Addons\Macros\Panel_CtrlLeft.reg
- C:\Far2\Addons\Macros\Panel_CtrlQ.reg
- C:\Far2\Addons\Macros\Dialog_AltDown.reg
- C:\Far2\Addons\Colors\Descript.ion
- <Drive name for removable media>:\cveuropeo.doc
- C:\Far2\Addons\Colors\Default_Highlighting\VaxColors.reg
- C:\Far2\Addons\Colors\Default_Highlighting\dn_like.reg
- C:\Far2\Addons\Colors\Default_Highlighting\FARColors242.reg
- C:\Far2\Addons\Colors\Default_Highlighting\GreenMile.reg
- C:\Far2\Addons\Colors\Default_Highlighting\hell.reg
- C:\Far2\Addons\Colors\Default_Highlighting\nc5pal2.reg
- C:\Far2\Addons\Colors\Default_Highlighting\Rodion_Doroshkevich.reg
- C:\Far2\Addons\Macros\Panel_CtrlRight.reg
- C:\Far2\Addons\Macros\CtrlF10.reg
- C:\Far2\Addons\Descript.ion
- C:\Far2\Addons\Macros\AltMenu.reg
- C:\Far2\Addons\Macros\AltScreens.reg
- C:\Far2\Addons\Macros\AltSearch.reg
- C:\Far2\Addons\Macros\AltX.reg
- C:\Far2\Addons\Macros\CtrlDel.reg
- C:\Far2\Addons\Macros\Descript.ion
- C:\Far2\Plugins\Align\changelog
Modifies user data files (Trojan.Encoder).
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -windowstyle hidden -c $mypid='2420';[System.IO.File]::ReadAllText('%TEMP%\~1059106.tmp')|iex
- '<SYSTEM32>\vssvc.exe'
