Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'svchost.exe' = '"%APPDATA%\Microsoft\Windows\svchost.exe" -start'
Creates the following files on removable media
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
- <Drive name for removable media>:\asaprojectcompetition.pptx
- <Drive name for removable media>:\waterresourcesag.pptx
- <Drive name for removable media>:\hypothyroidism_slides.pptx
- <Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe
- <Drive name for removable media>:\winmine.exe
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\cveuropeo.doc
- <Drive name for removable media>:\applicantform_en.doc
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\recovery.txt
- <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
- <Drive name for removable media>:\indogerman2010.pptx
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Modifies file system
Creates the following files
- %TEMP%\9af184e4.zeppelin
- C:\far2\plugins\ftp\recovery.txt
- C:\far2\plugins\ftp\lib\recovery.txt
- C:\far2\plugins\hlfviewer\recovery.txt
- C:\far2\plugins\macroview\recovery.txt
- C:\far2\plugins\network\recovery.txt
- C:\far2\plugins\proclist\recovery.txt
- C:\far2\plugins\tmppanel\recovery.txt
- C:\far2\pluginsdk\headers.c\recovery.txt
- C:\far2\pluginsdk\headers.pas\recovery.txt
- C:\far2\plugins\farcmds\recovery.txt
- C:\far2\plugins\filecase\recovery.txt
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\recovery.txt
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\recovery.txt
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\recovery.txt
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\recovery.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\recovery.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\recovery.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\recovery.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\recovery.txt
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\recovery.txt
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\recovery.txt
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\recovery.txt
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\recovery.txt
- C:\far2\plugins\emenu\recovery.txt
- C:\far2\plugins\editcase\recovery.txt
- C:\far2\plugins\drawline\recovery.txt
- %TEMP%\f5932c2d.zeppelin
- %TEMP%\~temp001.bat
- C:\far2\recovery.txt
- C:\far2\addons\recovery.txt
- C:\far2\addons\colors\recovery.txt
- C:\far2\addons\colors\custom_highlighting\recovery.txt
- C:\far2\addons\colors\default_highlighting\recovery.txt
- C:\far2\addons\macros\recovery.txt
- C:\far2\addons\setup\recovery.txt
- C:\far2\addons\shell\recovery.txt
- %APPDATA%\microsoft\windows\svchost.exe
- C:\far2\addons\xlat\recovery.txt
- C:\far2\documentation\eng\recovery.txt
- C:\far2\documentation\rus\recovery.txt
- C:\far2\encyclopedia\recovery.txt
- C:\far2\encyclopedia\tap\recovery.txt
- C:\far2\fexcept\recovery.txt
- C:\far2\plugins\align\recovery.txt
- C:\far2\plugins\arclite\recovery.txt
- C:\far2\plugins\autowrap\recovery.txt
- C:\far2\plugins\brackets\recovery.txt
- C:\far2\plugins\compare\recovery.txt
- C:\far2\addons\xlat\russian\recovery.txt
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\recovery.txt
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\recovery.txt
Deletes the following files
- %TEMP%\9af184e4.zeppelin
- %TEMP%\f5932c2d.zeppelin
Moves the following files
- from %ProgramFiles%\360tray\360tray.exe to %ProgramFiles%\360tray\360tray.exe.ec6-a16-200
- from %ProgramFiles%\amsn\amsn.exe to %ProgramFiles%\amsn\amsn.exe.ec6-a16-200
- from %ProgramFiles%\anti-trojan\anti-trojan.exe to %ProgramFiles%\anti-trojan\anti-trojan.exe.ec6-a16-200
- from %ProgramFiles%\antivirus\antivirus.exe to %ProgramFiles%\antivirus\antivirus.exe.ec6-a16-200
- from %ProgramFiles%\aoltbserver\aoltbserver.exe to %ProgramFiles%\aoltbserver\aoltbserver.exe.ec6-a16-200
- from %ProgramFiles%\armor2net\armor2net.exe to %ProgramFiles%\armor2net\armor2net.exe.ec6-a16-200
- from %ProgramFiles%\armorsurf\armorsurf.exe to %ProgramFiles%\armorsurf\armorsurf.exe.ec6-a16-200
- from %ProgramFiles%\ash\ash.exe to %ProgramFiles%\ash\ash.exe.ec6-a16-200
- from %ProgramFiles%\ashavast\ashavast.exe to %ProgramFiles%\ashavast\ashavast.exe.ec6-a16-200
- from %ProgramFiles%\ashavsrv\ashavsrv.exe to %ProgramFiles%\ashavsrv\ashavsrv.exe.ec6-a16-200
- from %ProgramFiles%\ashchest\ashchest.exe to %ProgramFiles%\ashchest\ashchest.exe.ec6-a16-200
- from %ProgramFiles%\ashdisp\ashdisp.exe to %ProgramFiles%\ashdisp\ashdisp.exe.ec6-a16-200
- from %ProgramFiles%\ashdug\ashdug.exe to %ProgramFiles%\ashdug\ashdug.exe.ec6-a16-200
- from %ProgramFiles%\ashenhcd\ashenhcd.exe to %ProgramFiles%\ashenhcd\ashenhcd.exe.ec6-a16-200
- from %ProgramFiles%\ashlogv\ashlogv.exe to %ProgramFiles%\ashlogv\ashlogv.exe.ec6-a16-200
- from %ProgramFiles%\ashmaisv\ashmaisv.exe to %ProgramFiles%\ashmaisv\ashmaisv.exe.ec6-a16-200
- from %ProgramFiles%\ashpopwz\ashpopwz.exe to %ProgramFiles%\ashpopwz\ashpopwz.exe.ec6-a16-200
- from %ProgramFiles%\ashquick\ashquick.exe to %ProgramFiles%\ashquick\ashquick.exe.ec6-a16-200
- from %ProgramFiles%\amon\amon.exe to %ProgramFiles%\amon\amon.exe.ec6-a16-200
- from %ProgramFiles%\ashserv\ashserv.exe to %ProgramFiles%\ashserv\ashserv.exe.ec6-a16-200
- from %ProgramFiles%\alsvc\alsvc.exe to %ProgramFiles%\alsvc\alsvc.exe.ec6-a16-200
- from %ProgramFiles%\airdefense\airdefense.exe to %ProgramFiles%\airdefense\airdefense.exe.ec6-a16-200
- from %ProgramFiles%\a2cmd\a2cmd.exe to %ProgramFiles%\a2cmd\a2cmd.exe.ec6-a16-200
- from %ProgramFiles%\a2guard\a2guard.exe to %ProgramFiles%\a2guard\a2guard.exe.ec6-a16-200
- from %ProgramFiles%\a2hijackfree\a2hijackfree.exe to %ProgramFiles%\a2hijackfree\a2hijackfree.exe.ec6-a16-200
- from %ProgramFiles%\a2scan\a2scan.exe to %ProgramFiles%\a2scan\a2scan.exe.ec6-a16-200
- from %ProgramFiles%\a2service\a2service.exe to %ProgramFiles%\a2service\a2service.exe.ec6-a16-200
- from %ProgramFiles%\a2start\a2start.exe to %ProgramFiles%\a2start\a2start.exe.ec6-a16-200
- from %ProgramFiles%\a2upd\a2upd.exe to %ProgramFiles%\a2upd\a2upd.exe.ec6-a16-200
- from %ProgramFiles%\a2wizard\a2wizard.exe to %ProgramFiles%\a2wizard\a2wizard.exe.ec6-a16-200
- from %ProgramFiles%\aavshield\aavshield.exe to %ProgramFiles%\aavshield\aavshield.exe.ec6-a16-200
- from %ProgramFiles%\about\about.exe to %ProgramFiles%\about\about.exe.ec6-a16-200
- from %ProgramFiles%\ackwin32\ackwin32.exe to %ProgramFiles%\ackwin32\ackwin32.exe.ec6-a16-200
- from %ProgramFiles%\admunch\admunch.exe to %ProgramFiles%\admunch\admunch.exe.ec6-a16-200
- from %ProgramFiles%\agb5\agb5.exe to %ProgramFiles%\agb5\agb5.exe.ec6-a16-200
- from %ProgramFiles%\ageofconan\ageofconan.exe to %ProgramFiles%\ageofconan\ageofconan.exe.ec6-a16-200
- from %ProgramFiles%\ahnsd\ahnsd.exe to %ProgramFiles%\ahnsd\ahnsd.exe.ec6-a16-200
- from %ProgramFiles%\aim6\aim6.exe to %ProgramFiles%\aim6\aim6.exe.ec6-a16-200
- from %ProgramFiles%\aimpro\aimpro.exe to %ProgramFiles%\aimpro\aimpro.exe.ec6-a16-200
- from %ProgramFiles%\almon\almon.exe to %ProgramFiles%\almon\almon.exe.ec6-a16-200
- from %ProgramFiles%\ashsimp2\ashsimp2.exe to %ProgramFiles%\ashsimp2\ashsimp2.exe.ec6-a16-200
Modifies the following files
- C:\far2\changelog
- C:\far2\addons\descript.ion
- C:\far2\file_id.diz
- C:\far2\farspa.lng
- C:\far2\farrus.lng
- C:\far2\farrus.hlf
- C:\far2\farpol.lng
- C:\far2\farhun.lng
- C:\far2\farhun.hlf
- C:\far2\farger.lng
- C:\far2\fareng.lng
- C:\far2\fareng.hlf
- C:\far2\farcze.lng
- C:\far2\far.map
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\cveuropeo.doc
- <Drive name for removable media>:\applicantform_en.doc
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\000814251_video_01.avi
- C:\far2\changelog_eng
- C:\far2\addons\readme.txt
- C:\far2\addons\colors\descript.ion
Modifies multiple files.
Moves itself
- from <Full path to file> to <Full path to file>.ec6-a16-200
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\svchost.exe' -start
- '%APPDATA%\microsoft\windows\svchost.exe' -agent 1
- '%APPDATA%\microsoft\windows\svchost.exe' -agent 0
- '%APPDATA%\microsoft\windows\svchost.exe' -agent 2
- '%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C %TEMP%\~temp001.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet
- '%WINDIR%\syswow64\cmd.exe' /C %TEMP%\~temp001.bat