Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im sql*
- '%WINDIR%\syswow64\taskkill.exe' /f /im oracle*
- '%WINDIR%\syswow64\taskkill.exe' /f /im mysq*
- '%WINDIR%\syswow64\taskkill.exe' /f /im chrome*
- '%WINDIR%\syswow64\taskkill.exe' /f /im veeam*
- '%WINDIR%\syswow64\taskkill.exe' /f /im firefox*
- '%WINDIR%\syswow64\taskkill.exe' /f /im excel*
- '%WINDIR%\syswow64\taskkill.exe' /f /im msaccess*
- '%WINDIR%\syswow64\taskkill.exe' /f /im onenote*
- '%WINDIR%\syswow64\taskkill.exe' /f /im outlook*
- '%WINDIR%\syswow64\taskkill.exe' /f /im powerpnt*
- '%WINDIR%\syswow64\taskkill.exe' /f /im winword*
- '%WINDIR%\syswow64\taskkill.exe' /f /im wuauclt*
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\icon.ico
- C:\far2\plugins\editcase\readme.06d732028.txt
- C:\far2\plugins\emenu\readme.06d732028.txt
- C:\far2\plugins\farcmds\readme.06d732028.txt
- C:\far2\plugins\ftp\readme.06d732028.txt
- C:\far2\plugins\filecase\readme.06d732028.txt
- C:\far2\plugins\macroview\readme.06d732028.txt
- C:\far2\plugins\network\readme.06d732028.txt
- C:\far2\plugins\proclist\readme.06d732028.txt
- C:\far2\plugins\tmppanel\readme.06d732028.txt
- C:\far2\pluginsdk\headers.c\readme.06d732028.txt
- C:\far2\plugins\hlfviewer\readme.06d732028.txt
- %HOMEPATH%\desktop\readme.06d732028.txt
- C:\far2\pluginsdk\headers.pas\readme.06d732028.txt
- %HOMEPATH%\contacts\readme.06d732028.txt
- C:\far2\addons\colors\custom_highlighting\readme.06d732028.txt
- C:\far2\plugins\compare\readme.06d732028.txt
- C:\far2\addons\xlat\russian\readme.06d732028.txt
- C:\far2\plugins\drawline\readme.06d732028.txt
- C:\far2\plugins\autowrap\readme.06d732028.txt
- %ALLUSERSPROFILE%\1.bat
- C:\far2\readme.06d732028.txt
- C:\totalcmd\readme.06d732028.txt
- C:\far2\fexcept\readme.06d732028.txt
- C:\far2\encyclopedia\readme.06d732028.txt
- C:\totalcmd\language\readme.06d732028.txt
- nul
- C:\far2\addons\macros\readme.06d732028.txt
- C:\far2\addons\setup\readme.06d732028.txt
- C:\far2\documentation\eng\readme.06d732028.txt
- C:\far2\addons\shell\readme.06d732028.txt
- C:\far2\documentation\rus\readme.06d732028.txt
- C:\far2\encyclopedia\tap\readme.06d732028.txt
- C:\far2\plugins\align\readme.06d732028.txt
- C:\far2\plugins\arclite\readme.06d732028.txt
- C:\far2\plugins\brackets\readme.06d732028.txt
- C:\far2\plugins\ftp\lib\readme.06d732028.txt
Modifies the following files
- C:\far2\changelog.06d732028
- C:\totalcmd\language\wcmd_cz.mnu.06d732028
- C:\totalcmd\language\wcmd_cz.lng.06d732028
- C:\totalcmd\language\wcmd_chn.inc.06d732028
- C:\totalcmd\language\wcmd_chn.mnu.06d732028
- C:\totalcmd\language\wcmd_chn.lng.06d732028
- C:\far2\fexcept\changelog.06d732028
- C:\far2\encyclopedia\farencyclopedia_ru.chm.06d732028
- C:\totalcmd\wcmicons.inc.06d732028
- C:\totalcmd\totalcmd.inc.06d732028
- C:\totalcmd\totalcmd.chm.06d732028
- C:\totalcmd\tcunin64.wul.06d732028
- C:\totalcmd\register.rtf.06d732028
- C:\totalcmd\keyboard.txt.06d732028
- C:\totalcmd\history.txt.06d732028
- C:\totalcmd\descript.ion.06d732028
- C:\far2\farspa.lng.06d732028
- C:\far2\farrus.lng.06d732028
- C:\far2\farrus.hlf.06d732028
- C:\far2\farhun.lng.06d732028
- C:\far2\farpol.lng.06d732028
- C:\far2\farhun.hlf.06d732028
- C:\far2\fareng.lng.06d732028
- C:\far2\farger.lng.06d732028
- C:\far2\fareng.hlf.06d732028
- C:\far2\farcze.lng.06d732028
- C:\far2\far.map.06d732028
- C:\far2\changelog_eng.06d732028
- C:\totalcmd\language\wcmd_dan.inc.06d732028
- C:\totalcmd\language\wcmd_cz.inc.06d732028
Modifies multiple files.
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Searches for the following windows
- ClassName: 'ConsoleWindowClass' WindowName: '<Full path to file>'
- ClassName: '' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c "wmic shadowcopy delete /nointeractive"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "vssadmin Delete Shadows /All /Quiet"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %ALLUSERSPROFILE%\1.bat' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "wmic shadowcopy delete /nointeractive"
- '<SYSTEM32>\cmd.exe' /c "vssadmin Delete Shadows /All /Quiet"
- '%WINDIR%\syswow64\cmd.exe' /c %ALLUSERSPROFILE%\1.bat
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 2
