Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\ako-readme.txt
- <Drive name for removable media>:\do_not_remove_ako.juu58b_id.key
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\dashborder_120.bmp
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
deletes volume shadow copies.
Modifies file system
Creates the following files
- C:\far2\addons\colors\custom_highlighting\ako-readme.txt
- C:\far2\plugins\ftp\ako-readme.txt
- C:\far2\plugins\filecase\do_not_remove_ako.juu58b_id.key
- C:\far2\plugins\filecase\ako-readme.txt
- C:\far2\plugins\farcmds\do_not_remove_ako.juu58b_id.key
- C:\far2\plugins\farcmds\ako-readme.txt
- C:\far2\plugins\emenu\do_not_remove_ako.juu58b_id.key
- C:\far2\plugins\autowrap\do_not_remove_ako.juu58b_id.key
- C:\far2\plugins\emenu\ako-readme.txt
- C:\far2\plugins\editcase\ako-readme.txt
- C:\far2\plugins\drawline\do_not_remove_ako.juu58b_id.key
- C:\far2\plugins\drawline\ako-readme.txt
- C:\far2\plugins\compare\do_not_remove_ako.juu58b_id.key
- C:\far2\plugins\compare\ako-readme.txt
- C:\far2\plugins\brackets\do_not_remove_ako.juu58b_id.key
- C:\far2\plugins\editcase\do_not_remove_ako.juu58b_id.key
- C:\far2\plugins\brackets\ako-readme.txt
- C:\far2\plugins\ftp\do_not_remove_ako.juu58b_id.key
- C:\far2\plugins\proclist\ako-readme.txt
- C:\far2\pluginsdk\headers.pas\do_not_remove_ako.juu58b_id.key
- C:\far2\pluginsdk\headers.pas\ako-readme.txt
- C:\far2\pluginsdk\headers.c\do_not_remove_ako.juu58b_id.key
- C:\far2\pluginsdk\headers.c\ako-readme.txt
- C:\far2\plugins\tmppanel\do_not_remove_ako.juu58b_id.key
- C:\far2\plugins\tmppanel\ako-readme.txt
- C:\far2\plugins\ftp\lib\do_not_remove_ako.juu58b_id.key
- C:\far2\plugins\ftp\lib\ako-readme.txt
- C:\far2\plugins\network\do_not_remove_ako.juu58b_id.key
- C:\far2\plugins\network\ako-readme.txt
- C:\far2\plugins\macroview\do_not_remove_ako.juu58b_id.key
- C:\far2\plugins\macroview\ako-readme.txt
- C:\far2\plugins\hlfviewer\do_not_remove_ako.juu58b_id.key
- C:\far2\plugins\hlfviewer\ako-readme.txt
- C:\far2\plugins\proclist\do_not_remove_ako.juu58b_id.key
- C:\far2\plugins\autowrap\ako-readme.txt
- C:\far2\plugins\arclite\do_not_remove_ako.juu58b_id.key
- C:\far2\plugins\arclite\ako-readme.txt
- C:\far2\addons\setup\do_not_remove_ako.juu58b_id.key
- C:\far2\addons\setup\ako-readme.txt
- C:\far2\addons\macros\do_not_remove_ako.juu58b_id.key
- C:\far2\addons\macros\ako-readme.txt
- C:\far2\addons\do_not_remove_ako.juu58b_id.key
- C:\far2\addons\shell\do_not_remove_ako.juu58b_id.key
- C:\far2\addons\ako-readme.txt
- C:\far2\addons\colors\ako-readme.txt
- D:\do_not_remove_ako.juu58b_id.key
- D:\ako-readme.txt
- C:\far2\addons\colors\default_highlighting\do_not_remove_ako.juu58b_id.key
- C:\far2\addons\colors\default_highlighting\ako-readme.txt
- C:\far2\addons\colors\custom_highlighting\do_not_remove_ako.juu58b_id.key
- C:\far2\addons\colors\do_not_remove_ako.juu58b_id.key
- C:\far2\addons\xlat\ako-readme.txt
- C:\far2\addons\shell\ako-readme.txt
- C:\far2\addons\xlat\do_not_remove_ako.juu58b_id.key
- C:\far2\plugins\align\do_not_remove_ako.juu58b_id.key
- C:\far2\encyclopedia\ako-readme.txt
- C:\far2\plugins\align\ako-readme.txt
- C:\far2\fexcept\do_not_remove_ako.juu58b_id.key
- C:\far2\fexcept\ako-readme.txt
- C:\far2\encyclopedia\tap\do_not_remove_ako.juu58b_id.key
- C:\far2\encyclopedia\tap\ako-readme.txt
- C:\far2\encyclopedia\do_not_remove_ako.juu58b_id.key
- C:\far2\documentation\rus\do_not_remove_ako.juu58b_id.key
- C:\far2\addons\xlat\russian\ako-readme.txt
- C:\far2\documentation\rus\ako-readme.txt
- C:\far2\documentation\eng\do_not_remove_ako.juu58b_id.key
- C:\far2\documentation\eng\ako-readme.txt
- C:\far2\do_not_remove_ako.juu58b_id.key
- C:\far2\ako-readme.txt
- C:\far2\addons\xlat\russian\do_not_remove_ako.juu58b_id.key
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\ako-readme.txt
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\do_not_remove_ako.juu58b_id.key
Modifies the following files
- C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg
- <Drive name for removable media>:\delete.avi
- C:\far2\addons\colors\default_highlighting\greenmile.reg
- <Drive name for removable media>:\correct.avi
- C:\far2\addons\colors\default_highlighting\farcolors242.reg
- C:\far2\addons\colors\default_highlighting\dn_like.reg
- C:\far2\addons\colors\default_highlighting\descript.ion
- C:\far2\addons\colors\default_highlighting\colors_from_sadovoj.reg
- C:\far2\addons\colors\default_highlighting\colors_from_gernichenko.reg
- C:\far2\addons\colors\default_highlighting\colors_from_admin_essp_ru.reg
- C:\far2\addons\colors\default_highlighting\black_from_myodov.reg
- C:\far2\addons\colors\default_highlighting\black_from_july.reg
- C:\far2\addons\colors\default_highlighting\black_from_fonarev.reg
- D:\install.log
- C:\far2\addons\colors\custom_highlighting\vaxcolors.reg
- C:\far2\addons\colors\custom_highlighting\rodion_doroshkevich.reg
- C:\far2\addons\colors\custom_highlighting\nc5pal2.reg
- C:\far2\addons\colors\custom_highlighting\import_colors.bat
- C:\far2\addons\colors\custom_highlighting\hell.reg
- C:\far2\addons\colors\custom_highlighting\greenmile.reg
- C:\far2\addons\colors\custom_highlighting\farcolors242.reg
- C:\far2\addons\colors\custom_highlighting\dn_like.reg
- C:\far2\addons\colors\custom_highlighting\descript.ion
- C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg
- C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg
- C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg
- C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg
- C:\far2\addons\colors\custom_highlighting\black_from_july.reg
- C:\far2\addons\colors\default_highlighting\hell.reg
- C:\far2\addons\colors\default_highlighting\import_colors.bat
Modifies multiple files.
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- '<LOCALNET>.34.1':445
- '<LOCALNET>.34.1':139
Miscellaneous
Executes the following
- '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTATEBACKUP
- '<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTATEBACKUP -deleteOldest
- '<SYSTEM32>\wbem\wmic.exe' SHADOWCOPY /nointeractive
