Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Modifies file system
Creates the following files
- C:\far2\addons\colors\custom_highlighting\readme.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\id.key
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\readme.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\id.key
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\readme.txt
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\readme.txt
- C:\far2\pluginsdk\headers.pas\id.key
- C:\far2\pluginsdk\headers.pas\readme.txt
- C:\far2\pluginsdk\headers.c\id.key
- C:\far2\pluginsdk\headers.c\readme.txt
- C:\far2\plugins\tmppanel\id.key
- C:\far2\plugins\tmppanel\readme.txt
- C:\far2\plugins\proclist\id.key
- C:\far2\plugins\proclist\readme.txt
- C:\far2\plugins\network\id.key
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\readme.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\id.key
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\id.key
- C:\users\public\music\sample music\id.key
- C:\users\public\music\sample music\readme.txt
- C:\users\public\libraries\id.key
- C:\users\public\libraries\readme.txt
- C:\users\public\desktop\id.key
- C:\users\public\desktop\readme.txt
- C:\users\default\id.key
- C:\users\default\readme.txt
- C:\totalcmd\language\id.key
- C:\totalcmd\language\readme.txt
- C:\totalcmd\id.key
- C:\totalcmd\readme.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\id.key
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\readme.txt
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\id.key
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\readme.txt
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\readme.txt
- C:\users\public\pictures\sample pictures\readme.txt
- C:\far2\plugins\network\readme.txt
- C:\far2\plugins\macroview\id.key
- C:\far2\plugins\macroview\readme.txt
- C:\far2\encyclopedia\readme.txt
- C:\far2\documentation\rus\id.key
- C:\far2\documentation\rus\readme.txt
- C:\far2\documentation\eng\id.key
- C:\far2\documentation\eng\readme.txt
- C:\far2\id.key
- C:\far2\readme.txt
- C:\far2\addons\xlat\russian\id.key
- C:\far2\addons\xlat\russian\readme.txt
- C:\far2\addons\xlat\id.key
- C:\far2\addons\xlat\readme.txt
- C:\far2\addons\shell\id.key
- C:\far2\addons\shell\readme.txt
- C:\far2\addons\setup\id.key
- C:\far2\addons\setup\readme.txt
- C:\far2\addons\macros\id.key
- C:\far2\addons\macros\readme.txt
- D:\id.key
- D:\readme.txt
- C:\far2\addons\id.key
- C:\far2\addons\colors\id.key
- C:\far2\addons\colors\readme.txt
- C:\far2\addons\colors\default_highlighting\id.key
- C:\far2\addons\colors\default_highlighting\readme.txt
- C:\far2\addons\colors\custom_highlighting\id.key
- C:\far2\encyclopedia\id.key
- C:\far2\encyclopedia\tap\readme.txt
- C:\far2\encyclopedia\tap\id.key
- C:\far2\fexcept\readme.txt
- C:\far2\plugins\hlfviewer\readme.txt
- C:\far2\plugins\ftp\lib\id.key
- C:\far2\plugins\ftp\lib\readme.txt
- C:\far2\plugins\ftp\id.key
- C:\far2\plugins\ftp\readme.txt
- C:\far2\plugins\filecase\id.key
- C:\far2\plugins\filecase\readme.txt
- C:\far2\plugins\farcmds\id.key
- C:\far2\plugins\farcmds\readme.txt
- C:\far2\plugins\emenu\id.key
- C:\far2\plugins\emenu\readme.txt
- C:\far2\plugins\editcase\id.key
- C:\far2\plugins\drawline\id.key
- C:\far2\plugins\editcase\readme.txt
- C:\far2\plugins\drawline\readme.txt
- C:\far2\plugins\compare\id.key
- C:\far2\plugins\compare\readme.txt
- C:\far2\plugins\brackets\id.key
- C:\far2\plugins\brackets\readme.txt
- C:\far2\plugins\autowrap\id.key
- C:\far2\plugins\autowrap\readme.txt
- C:\far2\plugins\arclite\id.key
- C:\far2\plugins\arclite\readme.txt
- C:\far2\plugins\align\id.key
- C:\far2\plugins\align\readme.txt
- C:\far2\fexcept\id.key
- C:\far2\plugins\hlfviewer\id.key
- C:\users\public\pictures\sample pictures\id.key
Substitutes the following files
- C:\Far2\Addons\README.TXT
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- '<LOCALNET>.69.1':445
- '<LOCALNET>.69.1':139
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\wbem\wmic.exe' SHADOWCOPY /nointeractive
- '<SYSTEM32>\vssvc.exe'
