Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\readme.htm
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Modifies file system
Creates the following files
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\readme.htm
- C:\far2\plugins\brackets\readme.htm
- C:\far2\plugins\compare\readme.htm
- C:\far2\plugins\drawline\readme.htm
- C:\far2\plugins\editcase\readme.htm
- C:\far2\plugins\emenu\readme.htm
- C:\far2\plugins\farcmds\readme.htm
- C:\far2\plugins\filecase\readme.htm
- C:\far2\plugins\ftp\readme.htm
- C:\far2\plugins\ftp\lib\readme.htm
- C:\far2\plugins\hlfviewer\readme.htm
- C:\far2\plugins\macroview\readme.htm
- C:\far2\plugins\network\readme.htm
- C:\far2\plugins\proclist\readme.htm
- C:\far2\plugins\tmppanel\readme.htm
- C:\far2\pluginsdk\headers.c\readme.htm
- C:\far2\plugins\autowrap\readme.htm
- C:\far2\pluginsdk\headers.pas\readme.htm
- C:\far2\plugins\arclite\readme.htm
- C:\far2\readme.htm
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\readme.htm
- D:\readme.htm
- C:\far2\addons\colors\custom_highlighting\readme.htm
- C:\far2\addons\colors\default_highlighting\readme.htm
- C:\far2\addons\colors\readme.htm
- C:\far2\addons\readme.htm
- C:\far2\addons\macros\readme.htm
- C:\far2\addons\setup\readme.htm
- C:\far2\addons\shell\readme.htm
- C:\far2\addons\xlat\readme.htm
- C:\far2\addons\xlat\russian\readme.htm
- C:\far2\documentation\eng\readme.htm
- C:\far2\documentation\rus\readme.htm
- C:\far2\encyclopedia\readme.htm
- C:\far2\encyclopedia\tap\readme.htm
- C:\far2\plugins\align\readme.htm
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\readme.htm
Modifies the following files
- <Drive name for removable media>:\join.avi
- C:\far2\documentation\eng\arc_support.txt
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- C:\far2\addons\xlat\russian\descript.ion
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- C:\far2\addons\xlat\descript.ion
- <Drive name for removable media>:\coffee.bmp
- C:\far2\addons\shell\descript.ion
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\default.bmp
- C:\far2\addons\setup\descript.ion
- C:\far2\addons\readme.txt
- C:\far2\addons\macros\descript.ion
- <Drive name for removable media>:\split.avi
- C:\far2\addons\descript.ion
- C:\far2\addons\colors\descript.ion
- C:\far2\addons\colors\default_highlighting\descript.ion
- C:\far2\addons\colors\custom_highlighting\descript.ion
- <Drive name for removable media>:\000814251_video_01.avi
- D:\install.log
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini
- <Drive name for removable media>:\toolbar.bmp
- C:\far2\documentation\eng\bug_report.txt
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\vssadmin.exe' delete shadows /all /quiet' (with hidden window)
