Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Classes\.DF01933C\shell\Open\command] '' = 'explorer.exe RecoveryManual.html'
Creates the following files on removable media
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\iisstart.htm
- <Drive name for removable media>:\browse.htm
- <Drive name for removable media>:\trivial-merge.htm
- <Drive name for removable media>:\alert.htm
- <Drive name for removable media>:\64bit_notes.htm
- <Drive name for removable media>:\tree_view.htm
- <Drive name for removable media>:\alert.html
- <Drive name for removable media>:\trivial-merge.html
- <Drive name for removable media>:\api-hashmap.html
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\1189.jpeg
- <Drive name for removable media>:\2.jpeg
- <Drive name for removable media>:\168.jpeg
- <Drive name for removable media>:\pushkin.jpeg
- <Drive name for removable media>:\3.jpg
- <Drive name for removable media>:\parnas_01.jpg
- <Drive name for removable media>:\pushkin.jpg
- <Drive name for removable media>:\13.jpg
- <Drive name for removable media>:\210252809.jpg
- <Drive name for removable media>:\region-north-karelia.jpg
- <Drive name for removable media>:\about.htm
- <Drive name for removable media>:\ituneshelpunavailable.htm
- <Drive name for removable media>:\aoc_saq_d_v3_merchant.docx
- <Drive name for removable media>:\holycrosschurchinstructions.docx
- <Drive name for removable media>:\thlps_keeper_mayer_1965.docx
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\1189.jpg
- <Drive name for removable media>:\parnas_01.jpeg
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\applicantform_en.doc
- <Drive name for removable media>:\hanni_umami_chapter.doc
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\weeklysheet1215.doc
- <Drive name for removable media>:\nwfieldnotes1966.docx
- <Drive name for removable media>:\recoverymanual.html
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\firefly1.mov
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
Modifies file system
Creates the following files
- <Full path to file>.log
- %TEMP%\~1077140.tmp
- <Current directory>\recoverymanual.html
- D:\recoverymanual.html
- C:\far2\addons\colors\custom_highlighting\recoverymanual.html
- C:\far2\addons\colors\default_highlighting\recoverymanual.html
- C:\far2\addons\colors\recoverymanual.html
- C:\far2\addons\recoverymanual.html
- C:\far2\addons\macros\recoverymanual.html
- C:\far2\addons\setup\recoverymanual.html
- C:\far2\addons\shell\recoverymanual.html
- C:\far2\addons\xlat\recoverymanual.html
- C:\far2\addons\xlat\russian\recoverymanual.html
- C:\far2\recoverymanual.html
Deletes the following files
- %TEMP%\~1077140.tmp
Modifies the following files
- D:\install.log.readmanual.df01933c
- <Drive name for removable media>:\hanni_umami_chapter.doc.readmanual.df01933c
- <Drive name for removable media>:\applicantform_en.doc.readmanual.df01933c
- <Drive name for removable media>:\pmd.cer.readmanual.df01933c
- <Drive name for removable media>:\testcertificate.cer.readmanual.df01933c
- <Drive name for removable media>:\contoso.cer.readmanual.df01933c
- <Drive name for removable media>:\testee.cer.readmanual.df01933c
- <Drive name for removable media>:\sdkfailsafeemulator.cer.readmanual.df01933c
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer.readmanual.df01933c
- <Drive name for removable media>:\contosoroot.cer.readmanual.df01933c
- <Drive name for removable media>:\dashborder_192.bmp.readmanual.df01933c
- <Drive name for removable media>:\dashborder_144.bmp.readmanual.df01933c
- <Drive name for removable media>:\coffee.bmp.readmanual.df01933c
- <Drive name for removable media>:\tileimage.bmp.readmanual.df01933c
- <Drive name for removable media>:\dashborder_96.bmp.readmanual.df01933c
- C:\far2\addons\colors\custom_highlighting\farcolors242.reg.readmanual.df01933c
- C:\far2\addons\colors\custom_highlighting\dn_like.reg.readmanual.df01933c
- C:\far2\addons\colors\custom_highlighting\descript.ion.readmanual.df01933c
- C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg.readmanual.df01933c
- C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg.readmanual.df01933c
- <Drive name for removable media>:\archer.avi.readmanual.df01933c
- C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg.readmanual.df01933c
- C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg.readmanual.df01933c
- C:\far2\addons\colors\custom_highlighting\black_from_july.reg.readmanual.df01933c
- <Drive name for removable media>:\000814251_video_01.avi.readmanual.df01933c
- C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg.readmanual.df01933c
- <Drive name for removable media>:\split.avi.readmanual.df01933c
- <Drive name for removable media>:\delete.avi.readmanual.df01933c
- <Drive name for removable media>:\ovp25012015.doc.readmanual.df01933c
- C:\far2\addons\colors\custom_highlighting\greenmile.reg.readmanual.df01933c
Modifies multiple files.
Substitutes the following files
- D:\install.log
- <Drive name for removable media>:\SDKSampleUnprivDeveloper.cer
- <Drive name for removable media>:\SDKFailsafeEmulator.cer
- <Drive name for removable media>:\testEE.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\TestCertificate.cer
- <Drive name for removable media>:\pmd.cer
- C:\Far2\Addons\Colors\Default_Highlighting\Descript.ion
- C:\Far2\Addons\Colors\Descript.ion
- C:\Far2\Addons\Descript.ion
- C:\Far2\Addons\Macros\Descript.ion
- C:\Far2\Addons\README.TXT
- C:\Far2\Addons\SetUp\Descript.ion
- C:\Far2\Addons\Shell\Descript.ion
- C:\Far2\Addons\XLat\Descript.ion
- C:\Far2\Addons\XLat\Russian\Descript.ion
- <Drive name for removable media>:\contosoroot.cer
- C:\Far2\changelog
- <Drive name for removable media>:\dashBorder_192.bmp
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\split.avi
- C:\Far2\Addons\Colors\Custom_Highlighting\black_from_Fonarev.reg
- <Drive name for removable media>:\000814251_video_01.avi
- C:\Far2\Addons\Colors\Custom_Highlighting\black_from_july.reg
- C:\Far2\Addons\Colors\Custom_Highlighting\black_from_Myodov.reg
- C:\Far2\Addons\Colors\Custom_Highlighting\Colors_from_admin_essp_ru.reg
- <Drive name for removable media>:\archer.avi
- C:\Far2\Addons\Colors\Custom_Highlighting\Colors_from_Gernichenko.reg
- C:\Far2\Addons\Colors\Custom_Highlighting\Colors_from_Sadovoj.reg
- C:\Far2\Addons\Colors\Custom_Highlighting\Descript.ion
- C:\Far2\Addons\Colors\Custom_Highlighting\dn_like.reg
- C:\Far2\Addons\Colors\Custom_Highlighting\FARColors242.reg
- <Drive name for removable media>:\dashBorder_96.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\dashBorder_144.bmp
- C:\Far2\changelog_eng
Modifies user data files (Trojan.Encoder).
Miscellaneous
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -windowstyle hidden -c $mypid='2460';[System.IO.File]::ReadAllText('%TEMP%\~1077140.tmp')|iex
- '<SYSTEM32>\whoami.exe' /groups /user
