Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
deletes volume shadow copies.
Terminates or attempts to terminate
the following system processes:
- System
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\toolbar.bmp
Modifies file system
Creates the following files
- C:\far2\!!read_me_how_to_recover_my_files.html
- %HOMEPATH%\favorites\microsoft websites\!!read_me_how_to_recover_my_files.html
- %HOMEPATH%\favorites\links for united states\!!read_me_how_to_recover_my_files.html
- %HOMEPATH%\favorites\links\!!read_me_how_to_recover_my_files.html
- C:\users\public\pictures\sample pictures\!!read_me_how_to_recover_my_files.html
- C:\users\public\music\sample music\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\user account pictures\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\mf\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\ilscache\!!read_me_how_to_recover_my_files.html
- %HOMEPATH%\favorites\msn websites\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\crypto\keys\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\3082\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\2052\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1050\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1049\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1046\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1042\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1041\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1040\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1036\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1031\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1033\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\msdn\7.0\1028\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\dbgclr\7.1\1033\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\sun\java\java update\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\rac\publisheddata\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\rac\statedata\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\mozilla\logs\!!read_me_how_to_recover_my_files.html
- C:\users\public\videos\sample videos\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\!!read_me_how_to_recover_my_files.html
- C:\users\public\recorded tv\sample media\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft\network\downloader\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\!!read_me_how_to_recover_my_files.html
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\!!read_me_how_to_recover_my_files.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\!!read_me_how_to_recover_my_files.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\!!read_me_how_to_recover_my_files.html
- C:\far2\plugins\farcmds\!!read_me_how_to_recover_my_files.html
- C:\far2\plugins\emenu\!!read_me_how_to_recover_my_files.html
- C:\far2\plugins\editcase\!!read_me_how_to_recover_my_files.html
- C:\far2\plugins\drawline\!!read_me_how_to_recover_my_files.html
- C:\far2\plugins\compare\!!read_me_how_to_recover_my_files.html
- C:\far2\addons\colors\!!read_me_how_to_recover_my_files.html
- C:\far2\plugins\brackets\!!read_me_how_to_recover_my_files.html
- C:\far2\plugins\autowrap\!!read_me_how_to_recover_my_files.html
- C:\far2\plugins\arclite\!!read_me_how_to_recover_my_files.html
- C:\far2\plugins\align\!!read_me_how_to_recover_my_files.html
- C:\far2\encyclopedia\tap\!!read_me_how_to_recover_my_files.html
- C:\far2\documentation\rus\!!read_me_how_to_recover_my_files.html
- C:\far2\documentation\eng\!!read_me_how_to_recover_my_files.html
- C:\far2\addons\xlat\!!read_me_how_to_recover_my_files.html
- C:\far2\addons\shell\!!read_me_how_to_recover_my_files.html
- C:\far2\addons\setup\!!read_me_how_to_recover_my_files.html
- C:\far2\addons\macros\!!read_me_how_to_recover_my_files.html
- D:\!!read_me_how_to_recover_my_files.html
- C:\users\default\!!read_me_how_to_recover_my_files.html
- C:\totalcmd\language\!!read_me_how_to_recover_my_files.html
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\!!read_me_how_to_recover_my_files.html
- C:\far2\fexcept\!!read_me_how_to_recover_my_files.html
- C:\far2\encyclopedia\!!read_me_how_to_recover_my_files.html
- C:\far2\addons\!!read_me_how_to_recover_my_files.html
- C:\totalcmd\!!read_me_how_to_recover_my_files.html
- C:\far2\plugins\filecase\!!read_me_how_to_recover_my_files.html
- C:\far2\plugins\ftp\!!read_me_how_to_recover_my_files.html
- C:\far2\plugins\hlfviewer\!!read_me_how_to_recover_my_files.html
- C:\far2\plugins\macroview\!!read_me_how_to_recover_my_files.html
- C:\far2\plugins\ftp\lib\!!read_me_how_to_recover_my_files.html
- C:\far2\addons\xlat\russian\!!read_me_how_to_recover_my_files.html
- C:\far2\addons\colors\default_highlighting\!!read_me_how_to_recover_my_files.html
- C:\far2\addons\colors\custom_highlighting\!!read_me_how_to_recover_my_files.html
- %HOMEPATH%\contacts\!!read_me_how_to_recover_my_files.html
- %HOMEPATH%\desktop\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft toolkit\!!read_me_how_to_recover_my_files.html
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\!!read_me_how_to_recover_my_files.html
- %ALLUSERSPROFILE%\microsoft help\!!read_me_how_to_recover_my_files.html
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\!!read_me_how_to_recover_my_files.html
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\!!read_me_how_to_recover_my_files.html
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\!!read_me_how_to_recover_my_files.html
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\!!read_me_how_to_recover_my_files.html
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\!!read_me_how_to_recover_my_files.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\!!read_me_how_to_recover_my_files.html
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\!!read_me_how_to_recover_my_files.html
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\!!read_me_how_to_recover_my_files.html
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\!!read_me_how_to_recover_my_files.html
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\!!read_me_how_to_recover_my_files.html
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\!!read_me_how_to_recover_my_files.html
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\!!read_me_how_to_recover_my_files.html
- C:\far2\pluginsdk\headers.pas\!!read_me_how_to_recover_my_files.html
- C:\far2\pluginsdk\headers.c\!!read_me_how_to_recover_my_files.html
- C:\far2\plugins\tmppanel\!!read_me_how_to_recover_my_files.html
- C:\far2\plugins\proclist\!!read_me_how_to_recover_my_files.html
- C:\far2\plugins\network\!!read_me_how_to_recover_my_files.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\!!read_me_how_to_recover_my_files.html
- nul
Deletes itself.
Modifies user data files (Trojan.Encoder).
Network activity
Connects to
- '10#.#71.172.189':90
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} recoveryenabled no' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall set allprofiles state off' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1>nul & del /q <Full path to file>' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} recoveryenabled no
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall set allprofiles state off
- '<SYSTEM32>\bcdedit.exe' /set {current} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\netsh.exe' advfirewall set allprofiles state off
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\svchost.exe' -k swprv
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1>nul & del /q <Full path to file>
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1
