Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'services.exe' = '"%APPDATA%\Microsoft\Windows\services.exe" -start'
Creates the following files on removable media
- <Drive name for removable media>:\!!! how to back your files !!!.txt
- <Drive name for removable media>:\cveuropeo.doc
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\middaugh_keynote.pptx
- <Drive name for removable media>:\asaprojectcompetition.pptx
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Modifies file system
Creates the following files
- %TEMP%\ba71329b.imposter
- C:\far2\documentation\!!! how to back your files !!!.txt
- C:\far2\documentation\eng\!!! how to back your files !!!.txt
- C:\far2\documentation\rus\!!! how to back your files !!!.txt
- C:\far2\encyclopedia\!!! how to back your files !!!.txt
- C:\far2\encyclopedia\tap\!!! how to back your files !!!.txt
- C:\far2\fexcept\!!! how to back your files !!!.txt
- C:\far2\plugins\!!! how to back your files !!!.txt
- C:\far2\plugins\align\!!! how to back your files !!!.txt
- C:\far2\addons\xlat\!!! how to back your files !!!.txt
- C:\far2\addons\xlat\russian\!!! how to back your files !!!.txt
- C:\far2\plugins\arclite\!!! how to back your files !!!.txt
- C:\far2\plugins\compare\!!! how to back your files !!!.txt
- C:\far2\plugins\drawline\!!! how to back your files !!!.txt
- C:\far2\plugins\editcase\!!! how to back your files !!!.txt
- C:\far2\plugins\emenu\!!! how to back your files !!!.txt
- C:\far2\plugins\farcmds\!!! how to back your files !!!.txt
- C:\far2\plugins\filecase\!!! how to back your files !!!.txt
- C:\far2\plugins\ftp\!!! how to back your files !!!.txt
- C:\far2\plugins\ftp\lib\!!! how to back your files !!!.txt
- C:\far2\plugins\autowrap\!!! how to back your files !!!.txt
- C:\far2\plugins\brackets\!!! how to back your files !!!.txt
- C:\far2\addons\shell\!!! how to back your files !!!.txt
- C:\far2\addons\setup\!!! how to back your files !!!.txt
- C:\far2\addons\macros\!!! how to back your files !!!.txt
- %TEMP%\edb7477f.imposter
- %TEMP%\~temp001.bat
- D:\$recycle.bin\.imposter
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.imposter
- D:\!!! how to back your files !!!.txt
- D:\$recycle.bin\!!! how to back your files !!!.txt
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\!!! how to back your files !!!.txt
- C:\$recycle.bin\.imposter
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.imposter
- %APPDATA%\microsoft\windows\services.exe
- <Current directory>\.imposter
- C:\$recycle.bin\!!! how to back your files !!!.txt
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\!!! how to back your files !!!.txt
- <Current directory>\!!! how to back your files !!!.txt
- C:\documents and settings\!!! how to back your files !!!.txt
- C:\far2\!!! how to back your files !!!.txt
- C:\far2\addons\!!! how to back your files !!!.txt
- C:\far2\addons\colors\!!! how to back your files !!!.txt
- C:\far2\addons\colors\custom_highlighting\!!! how to back your files !!!.txt
- C:\far2\addons\colors\default_highlighting\!!! how to back your files !!!.txt
- C:\!!! how to back your files !!!.txt
- C:\far2\plugins\hlfviewer\!!! how to back your files !!!.txt
- C:\far2\plugins\macroview\!!! how to back your files !!!.txt
Deletes the following files
- %TEMP%\ba71329b.imposter
- %TEMP%\edb7477f.imposter
Moves itself
- from <Full path to file> to <Full path to file>.25c-cde-34e
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\services.exe' -start
- '%APPDATA%\microsoft\windows\services.exe' -agent 0
- '%APPDATA%\microsoft\windows\services.exe' -agent 1
- '%APPDATA%\microsoft\windows\services.exe' -agent 2
- '%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C %TEMP%\~temp001.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet
- '%WINDIR%\syswow64\cmd.exe' /C %TEMP%\~temp001.bat
