Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\contoso.cer.kcgvaqkey
- <Drive name for removable media>:\hanni_umami_chapter.doc
- <Drive name for removable media>:\hanni_umami_chapter.doc.kcgvaqkey
- <Drive name for removable media>:\applicantform_en.doc
- <Drive name for removable media>:\applicantform_en.doc.kcgvaqkey
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\508softwareandos.doc.kcgvaqkey
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\ovp25012015.doc.kcgvaqkey
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\lisp_success.doc.kcgvaqkey
- <Drive name for removable media>:\samieee_obiee_presentation.pptx
- <Drive name for removable media>:\samieee_obiee_presentation.pptx.kcgvaqkey
- <Drive name for removable media>:\gruenspecht_02172016.pptx
- <Drive name for removable media>:\gruenspecht_02172016.pptx.kcgvaqkey
- <Drive name for removable media>:\waterresourcesag.pptx
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer.kcgvaqkey
- <Drive name for removable media>:\waterresourcesag.pptx.kcgvaqkey
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\archer.avi.kcgvaqkey
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\dial.bmp.kcgvaqkey
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\tileimage.bmp.kcgvaqkey
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\dashborder_96.bmp.kcgvaqkey
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\dashborder_120.bmp.kcgvaqkey
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\dashborder_192.bmp.kcgvaqkey
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\testcertificate.cer.kcgvaqkey
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer.kcgvaqkey
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\testee.cer.kcgvaqkey
- <Drive name for removable media>:\contosoroot_1.cer.kcgvaqkey
- <Drive name for removable media>:\decrypt-kcgvaq-decrypt.hta
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Modifies file system
Creates the following files
- C:\$recycle.bin\s-1-5-18\desktop.ini
- C:\far2\plugins\filecase\caserus.hlf.kcgvaqkey
- C:\far2\plugins\filecase\caserus.lng.kcgvaqkey
- C:\far2\plugins\filecase\changelog.kcgvaqkey
- C:\far2\plugins\filecase\filecase.map.kcgvaqkey
- C:\far2\plugins\filecase\decrypt-kcgvaq-decrypt.hta
- C:\far2\plugins\ftp\changelog.kcgvaqkey
- C:\far2\plugins\ftp\farftp.map.kcgvaqkey
- C:\far2\plugins\ftp\ftpcmds.txt.kcgvaqkey
- C:\far2\plugins\ftp\ftpcmds_rus.txt.kcgvaqkey
- C:\far2\plugins\hlfviewer\changelog.kcgvaqkey
- C:\far2\plugins\filecase\caseeng.lng.kcgvaqkey
- C:\far2\plugins\filecase\caseeng.hlf.kcgvaqkey
- C:\far2\plugins\ftp\ftprus.lng.kcgvaqkey
- C:\far2\plugins\ftp\lib\ftpdirlist.fll.kcgvaqkey
- C:\far2\plugins\ftp\lib\ftpdirlist.map.kcgvaqkey
- C:\far2\plugins\ftp\lib\ftpprogress.fll.kcgvaqkey
- C:\far2\plugins\ftp\lib\ftpprogress.map.kcgvaqkey
- C:\far2\plugins\ftp\lib\decrypt-kcgvaq-decrypt.hta
- C:\far2\plugins\ftp\notes.txt.kcgvaqkey
- C:\far2\plugins\ftp\notes_rus.txt.kcgvaqkey
- C:\far2\plugins\ftp\decrypt-kcgvaq-decrypt.hta
- C:\far2\plugins\ftp\ftpeng.hlf.kcgvaqkey
- C:\far2\plugins\ftp\ftprus.hlf.kcgvaqkey
- C:\far2\plugins\drawline\draweng.lng.kcgvaqkey
- C:\far2\plugins\ftp\ftpeng.lng.kcgvaqkey
- C:\far2\plugins\emenu\changelog.kcgvaqkey
- C:\far2\plugins\drawline\drawrus.hlf.kcgvaqkey
- C:\far2\plugins\drawline\drawrus.lng.kcgvaqkey
- C:\far2\plugins\drawline\decrypt-kcgvaq-decrypt.hta
- C:\far2\plugins\editcase\changelog.kcgvaqkey
- C:\far2\plugins\editcase\ecaseeng.hlf.kcgvaqkey
- C:\far2\plugins\editcase\ecaseeng.lng.kcgvaqkey
- C:\far2\plugins\editcase\ecaserus.hlf.kcgvaqkey
- C:\far2\plugins\editcase\ecaserus.lng.kcgvaqkey
- C:\far2\plugins\editcase\editcase.map.kcgvaqkey
- C:\far2\plugins\farcmds\farcmdsrus.hlf.kcgvaqkey
- C:\far2\plugins\farcmds\decrypt-kcgvaq-decrypt.hta
- C:\far2\plugins\farcmds\farcmdsrus.lng.kcgvaqkey
- C:\far2\plugins\emenu\emenueng.hlf.kcgvaqkey
- C:\far2\plugins\emenu\emenueng.lng.kcgvaqkey
- C:\far2\plugins\emenu\emenurus.hlf.kcgvaqkey
- C:\far2\plugins\emenu\emenurus.lng.kcgvaqkey
- C:\far2\plugins\emenu\decrypt-kcgvaq-decrypt.hta
- C:\far2\plugins\farcmds\changelog.kcgvaqkey
- C:\far2\plugins\farcmds\farcmds.map.kcgvaqkey
- C:\far2\plugins\farcmds\farcmdseng.hlf.kcgvaqkey
- C:\far2\plugins\farcmds\farcmdseng.lng.kcgvaqkey
- C:\far2\plugins\editcase\decrypt-kcgvaq-decrypt.hta
- C:\far2\plugins\emenu\emenu.map.kcgvaqkey
- C:\far2\plugins\drawline\drawline.map.kcgvaqkey
- C:\far2\plugins\hlfviewer\hlfviewer.map.kcgvaqkey
- C:\far2\plugins\hlfviewer\hlfviewerrus.lng.kcgvaqkey
- C:\far2\plugins\tmppanel\shortcuts_eng.temp.kcgvaqkey
- C:\far2\plugins\tmppanel\shortcuts_rus.temp.kcgvaqkey
- C:\far2\plugins\tmppanel\tmpeng.hlf.kcgvaqkey
- C:\far2\plugins\tmppanel\tmpeng.lng.kcgvaqkey
- C:\far2\plugins\tmppanel\tmppanel.map.kcgvaqkey
- C:\far2\plugins\tmppanel\tmprus.hlf.kcgvaqkey
- C:\far2\plugins\tmppanel\tmprus.lng.kcgvaqkey
- C:\far2\plugins\tmppanel\decrypt-kcgvaq-decrypt.hta
- C:\far2\plugins\decrypt-kcgvaq-decrypt.hta
- C:\far2\plugins\tmppanel\disks_eng.temp.kcgvaqkey
- C:\far2\plugins\tmppanel\disks_rus.temp.kcgvaqkey
- C:\far2\pluginsdk\headers.c\farcolor.hpp.kcgvaqkey
- C:\far2\pluginsdk\headers.c\decrypt-kcgvaq-decrypt.hta
- C:\far2\pluginsdk\headers.pas\farcolorw.pas.kcgvaqkey
- C:\far2\pluginsdk\headers.pas\farkeysw.pas.kcgvaqkey
- C:\far2\pluginsdk\headers.pas\pluginw.pas.kcgvaqkey
- C:\far2\pluginsdk\headers.pas\decrypt-kcgvaq-decrypt.hta
- C:\far2\pluginsdk\decrypt-kcgvaq-decrypt.hta
- C:\far2\decrypt-kcgvaq-decrypt.hta
- <Current directory>\decrypt-kcgvaq-decrypt.hta
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\boot.sdi.kcgvaqkey
- C:\far2\pluginsdk\headers.c\farkeys.hpp.kcgvaqkey
- C:\far2\pluginsdk\headers.c\plugin.hpp.kcgvaqkey
- C:\far2\plugins\hlfviewer\hlfviewereng.lng.kcgvaqkey
- C:\far2\plugins\hlfviewer\hlfviewereng.hlf.kcgvaqkey
- C:\far2\plugins\proclist\procrus.lng.kcgvaqkey
- C:\far2\plugins\hlfviewer\decrypt-kcgvaq-decrypt.hta
- C:\far2\plugins\macroview\changelog.kcgvaqkey
- C:\far2\plugins\macroview\macroeng.hlf.kcgvaqkey
- C:\far2\plugins\macroview\macroeng.lng.kcgvaqkey
- C:\far2\plugins\macroview\macrorus.hlf.kcgvaqkey
- C:\far2\plugins\macroview\macrorus.lng.kcgvaqkey
- C:\far2\plugins\macroview\macroview.map.kcgvaqkey
- C:\far2\plugins\macroview\decrypt-kcgvaq-decrypt.hta
- C:\far2\plugins\proclist\decrypt-kcgvaq-decrypt.hta
- C:\far2\plugins\hlfviewer\hlfviewerrus.hlf.kcgvaqkey
- C:\far2\plugins\tmppanel\changelog.kcgvaqkey
- C:\far2\plugins\network\changelog.kcgvaqkey
- C:\far2\plugins\network\netrus.lng.kcgvaqkey
- C:\far2\plugins\network\network.map.kcgvaqkey
- C:\far2\plugins\network\decrypt-kcgvaq-decrypt.hta
- C:\far2\plugins\proclist\changelog.kcgvaqkey
- C:\far2\plugins\proclist\proceng.hlf.kcgvaqkey
- C:\far2\plugins\proclist\proceng.lng.kcgvaqkey
- C:\far2\plugins\proclist\proclist.map.kcgvaqkey
- C:\far2\plugins\proclist\procrus.hlf.kcgvaqkey
- C:\far2\plugins\network\neteng.hlf.kcgvaqkey
- C:\far2\plugins\network\neteng.lng.kcgvaqkey
- C:\far2\plugins\network\netrus.hlf.kcgvaqkey
- C:\far2\plugins\drawline\draweng.hlf.kcgvaqkey
- C:\far2\plugins\drawline\changelog.kcgvaqkey
- C:\far2\plugins\compare\decrypt-kcgvaq-decrypt.hta
- C:\far2\addons\xlat\russian\decrypt-kcgvaq-decrypt.hta
- C:\far2\addons\xlat\decrypt-kcgvaq-decrypt.hta
- C:\far2\addons\decrypt-kcgvaq-decrypt.hta
- C:\far2\changelog.kcgvaqkey
- C:\far2\changelog_eng.kcgvaqkey
- C:\far2\documentation\eng\arc_support.txt.kcgvaqkey
- C:\far2\documentation\eng\bug_report.txt.kcgvaqkey
- C:\far2\documentation\eng\far_faq.txt.kcgvaqkey
- C:\far2\documentation\eng\plugins_install.txt.kcgvaqkey
- C:\far2\addons\xlat\descript.ion.kcgvaqkey
- C:\far2\encyclopedia\tap\12_r0m.tap.kcgvaqkey
- C:\far2\addons\shell\decrypt-kcgvaq-decrypt.hta
- C:\far2\documentation\rus\arc_support.txt.kcgvaqkey
- C:\far2\documentation\rus\bug_report.txt.kcgvaqkey
- C:\far2\documentation\rus\far_faq.txt.kcgvaqkey
- C:\far2\documentation\rus\plugins_install.txt.kcgvaqkey
- C:\far2\documentation\rus\plugins_review.txt.kcgvaqkey
- C:\far2\documentation\rus\techinfo.txt.kcgvaqkey
- C:\far2\documentation\rus\decrypt-kcgvaq-decrypt.hta
- C:\far2\documentation\decrypt-kcgvaq-decrypt.hta
- C:\far2\encyclopedia\farencyclopedia_ru.chm.kcgvaqkey
- C:\far2\documentation\eng\techinfo.txt.kcgvaqkey
- C:\far2\documentation\eng\plugins_review.txt.kcgvaqkey
- C:\far2\documentation\eng\decrypt-kcgvaq-decrypt.hta
- C:\far2\addons\shell\descript.ion.kcgvaqkey
- C:\far2\addons\colors\default_highlighting\descript.ion.kcgvaqkey
- %TEMP%\microsoft\windows\pjzxtv\windows.sys:qvqhfjkvnrdtqgtt
- %TEMP%\microsoft\windows\qxigz0\windows.sys:dhpkxqkdun
- %TEMP%\microsoft\windows\yvob9c\windows.sys:qxoyhxveerelbnrwg
- z:\$recycle.bin\s-1-5-18\desktop.ini
- D:\install.log.kcgvaqkey
- z:\xeldz.kcgvaqkey
- z:\xeldz.kcgvaq
- C:\far2\addons\colors\custom_highlighting\descript.ion.kcgvaqkey
- D:\decrypt-kcgvaq-decrypt.hta
- C:\far2\addons\shell\farhere.inf.kcgvaqkey
- C:\far2\encyclopedia\tap\code.idb.kcgvaqkey
- D:\$recycle.bin\s-1-5-18\desktop.ini
- C:\far2\addons\colors\default_highlighting\decrypt-kcgvaq-decrypt.hta
- C:\far2\addons\colors\descript.ion.kcgvaqkey
- C:\far2\addons\colors\decrypt-kcgvaq-decrypt.hta
- C:\far2\addons\descript.ion.kcgvaqkey
- C:\far2\addons\macros\descript.ion.kcgvaqkey
- C:\far2\addons\macros\decrypt-kcgvaq-decrypt.hta
- C:\far2\addons\readme.txt.kcgvaqkey
- C:\far2\addons\setup\descript.ion.kcgvaqkey
- C:\far2\addons\setup\decrypt-kcgvaq-decrypt.hta
- C:\far2\addons\colors\custom_highlighting\decrypt-kcgvaq-decrypt.hta
- z:\decrypt-kcgvaq-decrypt.hta
- C:\far2\addons\xlat\russian\descript.ion.kcgvaqkey
- C:\far2\encyclopedia\tap\decrypt-kcgvaq-decrypt.hta
- C:\far2\plugins\arclite\arclite_rus.hlf.kcgvaqkey
- C:\far2\plugins\arclite\changelog.kcgvaqkey
- C:\far2\plugins\arclite\decrypt-kcgvaq-decrypt.hta
- C:\far2\plugins\autowrap\autowrap.map.kcgvaqkey
- C:\far2\plugins\autowrap\changelog.kcgvaqkey
- C:\far2\plugins\autowrap\wrapeng.lng.kcgvaqkey
- C:\far2\plugins\autowrap\wraprus.lng.kcgvaqkey
- C:\far2\plugins\autowrap\decrypt-kcgvaq-decrypt.hta
- C:\far2\plugins\brackets\brackeng.hlf.kcgvaqkey
- C:\far2\plugins\arclite\arclite_eng.lng.kcgvaqkey
- C:\far2\plugins\arclite\arclite.map.kcgvaqkey
- C:\far2\plugins\arclite\arclite_rus.lng.kcgvaqkey
- C:\far2\plugins\brackets\brackeng.lng.kcgvaqkey
- C:\far2\plugins\brackets\changelog.kcgvaqkey
- C:\far2\plugins\brackets\decrypt-kcgvaq-decrypt.hta
- C:\far2\plugins\compare\changelog.kcgvaqkey
- C:\far2\plugins\compare\cmpeng.hlf.kcgvaqkey
- C:\far2\plugins\compare\cmprus.hlf.kcgvaqkey
- C:\far2\plugins\compare\compare.map.kcgvaqkey
- C:\far2\plugins\compare\compeng.lng.kcgvaqkey
- C:\far2\plugins\compare\comprus.lng.kcgvaqkey
- C:\far2\plugins\brackets\brackets.map.kcgvaqkey
- C:\far2\plugins\brackets\brackrus.hlf.kcgvaqkey
- C:\far2\plugins\brackets\brackrus.lng.kcgvaqkey
- C:\far2\plugins\arclite\arclite_eng.hlf.kcgvaqkey
- C:\far2\plugins\arclite\7zsd.sfx.kcgvaqkey
- C:\far2\encyclopedia\decrypt-kcgvaq-decrypt.hta
- C:\far2\farcze.lng.kcgvaqkey
- C:\far2\fareng.hlf.kcgvaqkey
- C:\far2\fareng.lng.kcgvaqkey
- C:\far2\farger.lng.kcgvaqkey
- C:\far2\farhun.hlf.kcgvaqkey
- C:\far2\farhun.lng.kcgvaqkey
- C:\far2\farpol.lng.kcgvaqkey
- C:\far2\farrus.hlf.kcgvaqkey
- C:\far2\farrus.lng.kcgvaqkey
- C:\far2\farspa.lng.kcgvaqkey
- C:\far2\far.map.kcgvaqkey
- C:\far2\fexcept\changelog.kcgvaqkey
- C:\far2\file_id.diz.kcgvaqkey
- C:\far2\plugins\align\align.map.kcgvaqkey
- C:\far2\plugins\align\aligneng.lng.kcgvaqkey
- C:\far2\plugins\align\alignrus.lng.kcgvaqkey
- C:\far2\plugins\align\changelog.kcgvaqkey
- C:\far2\plugins\align\decrypt-kcgvaq-decrypt.hta
- C:\far2\plugins\arclite\7z.sfx.kcgvaqkey
- C:\far2\plugins\arclite\7zcon.sfx.kcgvaqkey
- C:\far2\plugins\arclite\7zs2.sfx.kcgvaqkey
- C:\far2\plugins\arclite\7zs2con.sfx.kcgvaqkey
- C:\far2\fexcept\decrypt-kcgvaq-decrypt.hta
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\winre.wim.kcgvaqkey
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\decrypt-kcgvaq-decrypt.hta
Modifies the following files
- D:\install.log.kcgvaq
- C:\far2\addons\setup\descript.ion.kcgvaq
- C:\far2\addons\readme.txt.kcgvaq
- C:\far2\addons\macros\descript.ion.kcgvaq
- <Drive name for removable media>:\waterresourcesag.pptx.kcgvaq
- <Drive name for removable media>:\gruenspecht_02172016.pptx.kcgvaq
- <Drive name for removable media>:\samieee_obiee_presentation.pptx.kcgvaq
- C:\far2\addons\descript.ion.kcgvaq
- C:\far2\addons\colors\descript.ion.kcgvaq
- C:\far2\addons\colors\default_highlighting\descript.ion.kcgvaq
- <Drive name for removable media>:\lisp_success.doc.kcgvaq
- <Drive name for removable media>:\ovp25012015.doc.kcgvaq
- <Drive name for removable media>:\508softwareandos.doc.kcgvaq
- <Drive name for removable media>:\applicantform_en.doc.kcgvaq
- <Drive name for removable media>:\hanni_umami_chapter.doc.kcgvaq
- <Drive name for removable media>:\contoso.cer.kcgvaq
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer.kcgvaq
- <Drive name for removable media>:\contosoroot_1.cer.kcgvaq
- <Drive name for removable media>:\testee.cer.kcgvaq
- <Drive name for removable media>:\sdkfailsafeemulator.cer.kcgvaq
- C:\far2\addons\colors\custom_highlighting\descript.ion.kcgvaq
- <Drive name for removable media>:\testcertificate.cer.kcgvaq
- <Drive name for removable media>:\dashborder_192.bmp.kcgvaq
- <Drive name for removable media>:\dashborder_120.bmp.kcgvaq
- <Drive name for removable media>:\dashborder_96.bmp.kcgvaq
- <Drive name for removable media>:\tileimage.bmp.kcgvaq
- <Drive name for removable media>:\dial.bmp.kcgvaq
- <Drive name for removable media>:\archer.avi.kcgvaq
- C:\far2\addons\shell\descript.ion.kcgvaq
- C:\far2\addons\shell\farhere.inf.kcgvaq
Modifies multiple files.
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- '51.##.171.35':80
- '<LOCALNET>.17.1':445
- '<LOCALNET>.17.1':135
- '<LOCALNET>.17.1':139
TCP
HTTP POST requests
- http://51.##.171.35/fgate
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin Delete Shadows /All /Quiet
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled No
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin DELETE SYSTEMSTATEBACKUP
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
- '%WINDIR%\syswow64\cmd.exe' /C wmic SHADOWCOPY /nointeractive
- '%WINDIR%\syswow64\wbem\wmic.exe' SHADOWCOPY /nointeractive
