Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'JyhFHsTCvKH' = '%APPDATA%\osk.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\я
- %HOMEPATH%\Start Menu\Programs\Startup\desktop.ini
- %HOMEPATH%\Start Menu\Programs\Startup\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk
Malicious functions:
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cscript.exe
Modifies file system:
Creates the following files:
- %APPDATA%\osk.exe
- C:\Far2\Addons\Colors\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Addons\Colors\Custom Highlighting\я
- C:\Far2\Addons\Colors\Custom Highlighting\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Addons\Colors\Default Highlighting\я
- C:\Far2\Addons\Colors\Default Highlighting\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Addons\Macros\я
- C:\Far2\Addons\Macros\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Addons\SetUp\я
- C:\Far2\Addons\SetUp\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Addons\Shell\я
- C:\Far2\Addons\Shell\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\My Documents\My Music\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Addons\XLat\я
- C:\Far2\Addons\XLat\Russian\я
- C:\Far2\Addons\XLat\Russian\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Documentation\eng\я
- C:\Far2\Documentation\eng\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Documentation\rus\я
- C:\Far2\Documentation\rus\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Encyclopedia\я
- C:\Far2\Encyclopedia\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\FExcept\я
- C:\Far2\FExcept\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\7-Zip\я
- C:\Far2\Addons\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Addons\Colors\я
- C:\Far2\Addons\я
- C:\Far2\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\я
- %TEMP%\tmp2.tmp
- C:\я
- C:\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\я
- %HOMEPATH%\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Favorites\я
- %HOMEPATH%\Favorites\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Favorites\Links\я
- %HOMEPATH%\Favorites\Links\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\My Documents\я
- %HOMEPATH%\My Documents\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Plugins\7-Zip\HOW TO RECOVER ENCRYPTED FILES.TXT
- C:\Far2\Addons\XLat\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\My Documents\My Music\я
- %HOMEPATH%\My Documents\My Pictures\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Start Menu\я
- %HOMEPATH%\Start Menu\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Start Menu\Programs\я
- %HOMEPATH%\Start Menu\Programs\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\я
- %HOMEPATH%\Start Menu\Programs\Accessories\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\я
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\HOW TO RECOVER ENCRYPTED FILES.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\я
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\HOW TO RECOVER ENCRYPTED FILES.TXT
- %TEMP%\tmp1.tmp
- %HOMEPATH%\My Documents\My Pictures\я
- C:\Far2\Plugins\Align\я
Deletes the following files:
- %APPDATA%\osk.exe
- C:\Far2\Encyclopedia\я
- C:\Far2\Documentation\rus\я
- C:\Far2\Documentation\eng\я
- C:\Far2\Addons\XLat\Russian\я
- C:\Far2\Addons\XLat\я
- C:\Far2\Addons\Shell\я
- C:\Far2\Addons\SetUp\я
- C:\Far2\Addons\Macros\я
- C:\Far2\Addons\Colors\Default Highlighting\я
- C:\Far2\Addons\Colors\Custom Highlighting\я
- C:\Far2\Addons\Colors\я
- C:\Far2\Addons\я
- C:\Far2\я
- C:\Far2\FExcept\я
- %HOMEPATH%\Start Menu\Programs\Startup\я
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\я
- %HOMEPATH%\Start Menu\Programs\Accessories\я
- %HOMEPATH%\Start Menu\Programs\я
- %HOMEPATH%\Start Menu\я
- %HOMEPATH%\My Documents\My Pictures\я
- %HOMEPATH%\My Documents\My Music\я
- %HOMEPATH%\My Documents\я
- %HOMEPATH%\Favorites\Links\я
- %HOMEPATH%\Favorites\я
- %HOMEPATH%\я
- C:\я
- %TEMP%\tmp1.tmp
- <Full path to file>
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\я
- C:\Far2\Plugins\7-Zip\я
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following:
- '%APPDATA%\osk.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c copy /y "<Full path to file>" "%APPDATA%\osk.exe"
- '<SYSTEM32>\mshta.exe' "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('<File name>.exe');close()}catch(e){}},10);"
- '<SYSTEM32>\mshta.exe' "javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\Software\\Microsoft\\...
- '<SYSTEM32>\mshta.exe' "javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\Software\\DAOZA\\MBU[L'));close();"
- '<SYSTEM32>\cmd.exe' /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0
- '<SYSTEM32>\cmd.exe' /c wmic SHADOWCOPY DELETE
- '<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /All /Quiet
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {default} recoveryenabled No
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
