Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\13.jpeg
- %HOMEPATH%\desktop\pushkin.jpeg
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\iisstart.htm
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\alert.html
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\64bit_notes.htm
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\168.jpeg
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\testcertificate.cer
Modifies file system
Creates the following files
- C:\far2\addons\colors\custom_highlighting\readme.txt
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\id.key
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\readme.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\readme.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\id.key
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\id.key
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\readme.txt
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\readme.txt
- C:\users\public\recorded tv\sample media\readme.txt
- %HOMEPATH%\searches\id.key
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\id.key
- %HOMEPATH%\searches\readme.txt
- %HOMEPATH%\favorites\links\id.key
- %HOMEPATH%\links\id.key
- %HOMEPATH%\links\readme.txt
- %HOMEPATH%\favorites\msn websites\id.key
- %HOMEPATH%\favorites\msn websites\readme.txt
- %HOMEPATH%\favorites\links for united states\id.key
- %HOMEPATH%\favorites\links for united states\readme.txt
- %HOMEPATH%\desktop\id.key
- %HOMEPATH%\contacts\id.key
- %HOMEPATH%\desktop\readme.txt
- %HOMEPATH%\contacts\readme.txt
- C:\users\public\videos\sample videos\id.key
- C:\users\public\videos\sample videos\readme.txt
- C:\far2\pluginsdk\headers.pas\id.key
- C:\users\public\recorded tv\sample media\id.key
- C:\users\public\music\sample music\readme.txt
- C:\users\public\music\sample music\id.key
- C:\users\public\pictures\sample pictures\id.key
- C:\users\public\pictures\sample pictures\readme.txt
- C:\users\public\libraries\id.key
- C:\users\public\libraries\readme.txt
- C:\users\public\desktop\id.key
- C:\users\public\desktop\readme.txt
- C:\users\default\id.key
- C:\users\default\readme.txt
- C:\totalcmd\language\id.key
- C:\totalcmd\language\readme.txt
- C:\totalcmd\id.key
- C:\totalcmd\readme.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\id.key
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\readme.txt
- C:\far2\pluginsdk\headers.pas\readme.txt
- C:\far2\plugins\arclite\id.key
- C:\far2\plugins\align\readme.txt
- C:\far2\fexcept\id.key
- C:\far2\fexcept\readme.txt
- C:\far2\encyclopedia\tap\id.key
- C:\far2\encyclopedia\tap\readme.txt
- C:\far2\encyclopedia\id.key
- C:\far2\encyclopedia\readme.txt
- C:\far2\documentation\rus\id.key
- C:\far2\documentation\rus\readme.txt
- C:\far2\documentation\eng\id.key
- C:\far2\id.key
- C:\far2\readme.txt
- C:\far2\addons\xlat\russian\id.key
- C:\far2\addons\xlat\russian\readme.txt
- C:\far2\plugins\align\id.key
- C:\far2\addons\xlat\id.key
- C:\far2\addons\shell\id.key
- C:\far2\addons\shell\readme.txt
- C:\far2\addons\setup\id.key
- C:\far2\addons\setup\readme.txt
- C:\far2\addons\macros\id.key
- C:\far2\addons\macros\readme.txt
- D:\id.key
- D:\readme.txt
- C:\far2\addons\id.key
- C:\far2\addons\colors\id.key
- C:\far2\addons\colors\readme.txt
- C:\far2\addons\colors\default_highlighting\id.key
- C:\far2\addons\colors\default_highlighting\readme.txt
- C:\far2\addons\colors\custom_highlighting\id.key
- C:\far2\addons\xlat\readme.txt
- C:\far2\plugins\filecase\id.key
- C:\far2\pluginsdk\headers.c\readme.txt
- C:\far2\documentation\eng\readme.txt
- C:\far2\plugins\tmppanel\id.key
- C:\far2\plugins\tmppanel\readme.txt
- C:\far2\plugins\proclist\id.key
- C:\far2\plugins\proclist\readme.txt
- C:\far2\plugins\network\id.key
- C:\far2\plugins\network\readme.txt
- C:\far2\plugins\autowrap\id.key
- C:\far2\plugins\macroview\id.key
- C:\far2\plugins\macroview\readme.txt
- C:\far2\plugins\hlfviewer\id.key
- C:\far2\plugins\hlfviewer\readme.txt
- C:\far2\plugins\ftp\lib\id.key
- C:\far2\plugins\ftp\lib\readme.txt
- C:\far2\plugins\ftp\id.key
- C:\far2\pluginsdk\headers.c\id.key
- C:\far2\plugins\ftp\readme.txt
- C:\far2\plugins\filecase\readme.txt
- C:\far2\plugins\farcmds\id.key
- C:\far2\plugins\farcmds\readme.txt
- C:\far2\plugins\emenu\id.key
- C:\far2\plugins\emenu\readme.txt
- C:\far2\plugins\editcase\id.key
- C:\far2\plugins\editcase\readme.txt
- C:\far2\plugins\drawline\id.key
- C:\far2\plugins\drawline\readme.txt
- C:\far2\plugins\compare\id.key
- C:\far2\plugins\compare\readme.txt
- C:\far2\plugins\autowrap\readme.txt
- C:\far2\plugins\brackets\id.key
- C:\far2\plugins\brackets\readme.txt
- C:\far2\plugins\arclite\readme.txt
- %HOMEPATH%\favorites\links\readme.txt
Substitutes the following files
- C:\Far2\Addons\README.TXT
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- '<LOCALNET>.41.1':445
- '<LOCALNET>.41.1':139
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\wbem\wmic.exe' SHADOWCOPY /nointeractive
- '<SYSTEM32>\vssvc.exe'
