Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{4F8BFEC6-5CEC-5A3D-679E-64E087247B25}' = 'notepad.exe "%HOMEPATH%\HOW TO RECOVER ENCRYPTED FILES.TXT"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '{4F8BFEC6-5CEC-5A3D-679E-64E087247B25}' = '%APPDATA%\winsystem64.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk
Infects the following executable files:
- C:\Far2\Plugins\EMenu\EMenu.dll
- C:\Far2\Plugins\ExtSearch\esearch.dll
- C:\Far2\Plugins\FarCmds\FARCmds.dll
- C:\Far2\Plugins\EditCase\EditCase.dll
- C:\Far2\Plugins\Colorer\bin\colorer.dll
- C:\Far2\Plugins\Compare\Compare.dll
- C:\Far2\Plugins\DrawLine\DrawLine.dll
- C:\Far2\Plugins\FileCase\FileCase.dll
- C:\Far2\Plugins\ProcList\Proclist.dll
- C:\Far2\Plugins\TmpPanel\TmpPanel.dll
- C:\Far2\Plugins\WinSCP\WinSCP.dll
- C:\Far2\Plugins\Network\Network.dll
- C:\Far2\Plugins\FTP\FarFtp.dll
- C:\Far2\Plugins\HlfViewer\HlfViewer.dll
- C:\Far2\Plugins\MacroView\MacroView.dll
- C:\Far2\Plugins\Brackets\Brackets.dll
- C:\Far2\Plugins\7-Zip\7-ZipFar64.dll
- C:\Far2\Plugins\7-Zip\7z.dll
- C:\Far2\Plugins\Align\Align.dll
- C:\Far2\Plugins\7-Zip\7-ZipFar.dll
- C:\Far2\FExcept\demangle32.dll
- C:\Far2\FExcept\ExcDump.dll
- C:\Far2\FExcept\FExcept.dll
- C:\Far2\Plugins\arclite\7z.dll
- C:\Far2\Plugins\arclite\7zSD.sfx
- C:\Far2\Plugins\arclite\arclite.dll
- C:\Far2\Plugins\AutoWrap\AutoWrap.dll
- C:\Far2\Plugins\arclite\7zS2con.sfx
- C:\Far2\Plugins\arclite\7z.sfx
- C:\Far2\Plugins\arclite\7zCon.sfx
- C:\Far2\Plugins\arclite\7zS2.sfx
Malicious functions:
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Executes the following:
- '<SYSTEM32>\cmd.exe' /c start /max notepad.exe "%HOMEPATH%\HOW TO RECOVER ENCRYPTED FILES.TXT"
- '<SYSTEM32>\cmd.exe' /c %TEMP%\{AEAC95C6-2AA1-DB82-419A-AA1B8AD01BE2}.bat
- '<SYSTEM32>\notepad.exe' "%HOMEPATH%\HOW TO RECOVER ENCRYPTED FILES.TXT"
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '%APPDATA%\winsystem64.exe'
- '<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /All /Quiet
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {default} recoveryenabled No
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cscript.exe
Modifies file system:
Creates the following files:
- C:\Far2\Plugins\DrawLine\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\EditCase\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\Colorer\hrd\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\Compare\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\ExtSearch\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\ExtSearch\sources\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\EMenu\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\ExtSearch\doc\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\AutoWrap\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\Brackets\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\Align\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\arclite\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\Colorer\hrc\auto\types\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\Colorer\hrc\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\Colorer\bin\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\Colorer\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\ExtSearch\sources\RegExp\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\PluginSDK\Headers.c\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\PluginSDK\Headers.pas\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\TmpPanel\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\WinSCP\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Desktop\HOW TO RECOVER ENCRYPTED FILES.TXT
- %TEMP%\{AEAC95C6-2AA1-DB82-419A-AA1B8AD01BE2}.bat
- <STUBS_DIR>\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\FTP\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\FTP\lib\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\FarCmds\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\FileCase\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\Network\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\ProcList\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\HlfViewer\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\MacroView\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Start Menu\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\My Documents\My Pictures\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Recent\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Start Menu\Programs\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Templates\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Favorites\Links\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Favorites\HOW TO RECOVER ENCRYPTED FILES.TXT
- %APPDATA%\winsystem64.exe
- %HOMEPATH%\Cookies\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\My Documents\My Music\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Local Settings\History\History.IE5\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Documents and Settings\Default User\Cookies\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Documentation\eng\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Documentation\rus\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Addons\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Addons\Shell\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\FExcept\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\7-Zip\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Encyclopedia\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Documents and Settings\Default User\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Documents and Settings\Default User\Templates\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\HOW TO RECOVER ENCRYPTED FILES.TXT
Deletes the following files:
- %APPDATA%\winsystem64.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
