Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\file recovery.txt
- <Drive name for removable media>:\holycrosschurchinstructions.docx
- <Drive name for removable media>:\nwfieldnotes1966.docx
- <Drive name for removable media>:\issi2013_template_for_posters.docx
- <Drive name for removable media>:\hadac_newsletter_july_2010_final.docx
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\file_p_00000000_1371597592.docx
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\hanni_umami_chapter.doc
- <Drive name for removable media>:\thlps_keeper_mayer_1965.docx
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Modifies file system
Creates the following files
- D:\file recovery.txt
- C:\far2\plugins\filecase\file recovery.txt
- C:\far2\plugins\farcmds\file recovery.txt
- C:\far2\plugins\emenu\file recovery.txt
- C:\far2\plugins\editcase\file recovery.txt
- C:\far2\plugins\drawline\file recovery.txt
- C:\far2\plugins\compare\file recovery.txt
- C:\far2\plugins\brackets\file recovery.txt
- C:\far2\plugins\autowrap\file recovery.txt
- C:\far2\plugins\arclite\file recovery.txt
- C:\far2\plugins\align\file recovery.txt
- C:\far2\fexcept\file recovery.txt
- C:\far2\encyclopedia\file recovery.txt
- C:\far2\encyclopedia\tap\file recovery.txt
- C:\far2\documentation\file recovery.txt
- C:\far2\plugins\ftp\lib\file recovery.txt
- C:\far2\documentation\rus\file recovery.txt
- C:\far2\addons\file recovery.txt
- C:\far2\addons\xlat\file recovery.txt
- C:\far2\addons\xlat\russian\file recovery.txt
- C:\far2\addons\shell\file recovery.txt
- C:\far2\addons\setup\file recovery.txt
- C:\far2\addons\macros\file recovery.txt
- C:\far2\addons\colors\file recovery.txt
- C:\far2\addons\colors\default_highlighting\file recovery.txt
- C:\far2\addons\colors\custom_highlighting\file recovery.txt
- C:\$recycle.bin\file recovery.txt
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\file recovery.txt
- C:\file recovery.txt
- D:\$recycle.bin\file recovery.txt
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\file recovery.txt
- C:\far2\documentation\eng\file recovery.txt
- C:\far2\plugins\ftp\file recovery.txt
Modifies the following files
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\file_p_00000000_1371597592.docx
- <Drive name for removable media>:\issi2013_template_for_posters.docx
- <Drive name for removable media>:\nwfieldnotes1966.docx
- <Drive name for removable media>:\hadac_newsletter_july_2010_final.docx
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\holycrosschurchinstructions.docx
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\hanni_umami_chapter.doc
- <Drive name for removable media>:\thlps_keeper_mayer_1965.docx
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- '22#.0.0.22':445
- '22#.0.0.22':135
UDP
- DNS ASK ap#.#pify.org
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\vssadmin.exe' delete shadows /all /quiet' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {current} recoveryenabled no' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&...
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {current} recoveryenabled no
- '%WINDIR%\syswow64\sc.exe' delete "MSSQLFDLauncher"
