Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\cveuropeo.doc.dpygskkey
- <Drive name for removable media>:\hanni_umami_chapter.doc
- <Drive name for removable media>:\hanni_umami_chapter.doc.dpygskkey
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\february_catalogue__2015.doc.dpygskkey
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\fi51.doc.dpygskkey
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
- <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc.dpygskkey
- <Drive name for removable media>:\stoc13_ml_quoc_le.pptx.dpygskkey
- <Drive name for removable media>:\hypothyroidism_slides.pptx.dpygskkey
- <Drive name for removable media>:\gruenspecht_02172016.pptx
- <Drive name for removable media>:\gruenspecht_02172016.pptx.dpygskkey
- <Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
- <Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx.dpygskkey
- <Drive name for removable media>:\samieee_obiee_presentation.pptx
- <Drive name for removable media>:\samieee_obiee_presentation.pptx.dpygskkey
- <Drive name for removable media>:\indogerman2010.pptx
- <Drive name for removable media>:\indogerman2010.pptx.dpygskkey
- <Drive name for removable media>:\hypothyroidism_slides.pptx
- <Drive name for removable media>:\cveuropeo.doc
- <Drive name for removable media>:\stoc13_ml_quoc_le.pptx
- <Drive name for removable media>:\testee.cer.dpygskkey
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\correct.avi.dpygskkey
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\join.avi.dpygskkey
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\split.avi.dpygskkey
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\dashborder_96.bmp.dpygskkey
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\toolbar.bmp.dpygskkey
- <Drive name for removable media>:\dialmap.bmp.dpygskkey
- <Drive name for removable media>:\sdksampleprivdeveloper.cer.dpygskkey
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\dashborder_120.bmp.dpygskkey
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\default.bmp.dpygskkey
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\testcertificate.cer.dpygskkey
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\contoso.cer.dpygskkey
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\decrypt-dpygsk-decrypt.hta
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Modifies file system
Creates the following files
- C:\$recycle.bin\s-1-5-18\desktop.ini
- C:\far2\plugins\farcmds\decrypt-dpygsk-decrypt.hta
- C:\far2\plugins\filecase\caseeng.hlf.dpygskkey
- C:\far2\plugins\filecase\caseeng.lng.dpygskkey
- C:\far2\plugins\filecase\caserus.hlf.dpygskkey
- C:\far2\plugins\filecase\caserus.lng.dpygskkey
- C:\far2\plugins\filecase\changelog.dpygskkey
- C:\far2\plugins\filecase\filecase.map.dpygskkey
- C:\far2\plugins\filecase\decrypt-dpygsk-decrypt.hta
- C:\far2\plugins\ftp\changelog.dpygskkey
- C:\far2\plugins\ftp\farftp.map.dpygskkey
- C:\far2\plugins\ftp\ftpcmds_rus.txt.dpygskkey
- C:\far2\plugins\ftp\notes_rus.txt.dpygskkey
- C:\far2\plugins\ftp\ftpeng.hlf.dpygskkey
- C:\far2\plugins\ftp\ftpeng.lng.dpygskkey
- C:\far2\plugins\ftp\ftprus.hlf.dpygskkey
- C:\far2\plugins\ftp\ftprus.lng.dpygskkey
- C:\far2\plugins\ftp\lib\ftpdirlist.fll.dpygskkey
- C:\far2\plugins\ftp\lib\ftpdirlist.map.dpygskkey
- C:\far2\plugins\ftp\lib\ftpprogress.fll.dpygskkey
- C:\far2\plugins\ftp\lib\ftpprogress.map.dpygskkey
- C:\far2\plugins\ftp\lib\decrypt-dpygsk-decrypt.hta
- C:\far2\plugins\ftp\notes.txt.dpygskkey
- C:\far2\plugins\farcmds\farcmdsrus.lng.dpygskkey
- C:\far2\plugins\ftp\ftpcmds.txt.dpygskkey
- C:\far2\plugins\farcmds\farcmdsrus.hlf.dpygskkey
- C:\far2\plugins\editcase\ecaserus.lng.dpygskkey
- C:\far2\plugins\drawline\draweng.hlf.dpygskkey
- C:\far2\plugins\drawline\draweng.lng.dpygskkey
- C:\far2\plugins\drawline\drawline.map.dpygskkey
- C:\far2\plugins\drawline\drawrus.hlf.dpygskkey
- C:\far2\plugins\drawline\drawrus.lng.dpygskkey
- C:\far2\plugins\drawline\decrypt-dpygsk-decrypt.hta
- C:\far2\plugins\editcase\changelog.dpygskkey
- C:\far2\plugins\editcase\ecaseeng.hlf.dpygskkey
- C:\far2\plugins\editcase\ecaseeng.lng.dpygskkey
- C:\far2\plugins\editcase\ecaserus.hlf.dpygskkey
- C:\far2\plugins\editcase\editcase.map.dpygskkey
- C:\far2\plugins\farcmds\farcmdseng.hlf.dpygskkey
- C:\far2\plugins\editcase\decrypt-dpygsk-decrypt.hta
- C:\far2\plugins\emenu\changelog.dpygskkey
- C:\far2\plugins\emenu\emenu.map.dpygskkey
- C:\far2\plugins\emenu\emenueng.hlf.dpygskkey
- C:\far2\plugins\emenu\emenueng.lng.dpygskkey
- C:\far2\plugins\emenu\emenurus.hlf.dpygskkey
- C:\far2\plugins\emenu\emenurus.lng.dpygskkey
- C:\far2\plugins\emenu\decrypt-dpygsk-decrypt.hta
- C:\far2\plugins\farcmds\changelog.dpygskkey
- C:\far2\plugins\farcmds\farcmds.map.dpygskkey
- C:\far2\plugins\farcmds\farcmdseng.lng.dpygskkey
- C:\far2\plugins\macroview\decrypt-dpygsk-decrypt.hta
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\boot.sdi.dpygskkey
- C:\far2\plugins\hlfviewer\hlfviewer.map.dpygskkey
- C:\far2\plugins\tmppanel\changelog.dpygskkey
- C:\far2\plugins\tmppanel\disks_eng.temp.dpygskkey
- C:\far2\plugins\tmppanel\disks_rus.temp.dpygskkey
- C:\far2\plugins\tmppanel\shortcuts_eng.temp.dpygskkey
- C:\far2\plugins\tmppanel\shortcuts_rus.temp.dpygskkey
- C:\far2\plugins\tmppanel\tmpeng.hlf.dpygskkey
- C:\far2\plugins\tmppanel\tmpeng.lng.dpygskkey
- C:\far2\plugins\tmppanel\tmppanel.map.dpygskkey
- C:\far2\plugins\tmppanel\tmprus.hlf.dpygskkey
- C:\far2\plugins\tmppanel\tmprus.lng.dpygskkey
- C:\far2\plugins\decrypt-dpygsk-decrypt.hta
- C:\far2\plugins\hlfviewer\changelog.dpygskkey
- C:\far2\pluginsdk\headers.c\farcolor.hpp.dpygskkey
- C:\far2\pluginsdk\headers.c\farkeys.hpp.dpygskkey
- C:\far2\pluginsdk\headers.c\plugin.hpp.dpygskkey
- C:\far2\pluginsdk\headers.c\decrypt-dpygsk-decrypt.hta
- C:\far2\pluginsdk\headers.pas\farcolorw.pas.dpygskkey
- C:\far2\pluginsdk\headers.pas\farkeysw.pas.dpygskkey
- C:\far2\pluginsdk\headers.pas\pluginw.pas.dpygskkey
- C:\far2\pluginsdk\headers.pas\decrypt-dpygsk-decrypt.hta
- C:\far2\pluginsdk\decrypt-dpygsk-decrypt.hta
- C:\far2\decrypt-dpygsk-decrypt.hta
- C:\far2\plugins\proclist\decrypt-dpygsk-decrypt.hta
- C:\far2\plugins\drawline\changelog.dpygskkey
- C:\far2\plugins\proclist\procrus.lng.dpygskkey
- C:\far2\plugins\macroview\macroview.map.dpygskkey
- C:\far2\plugins\hlfviewer\hlfviewereng.hlf.dpygskkey
- C:\far2\plugins\hlfviewer\hlfviewereng.lng.dpygskkey
- C:\far2\plugins\hlfviewer\hlfviewerrus.hlf.dpygskkey
- C:\far2\plugins\hlfviewer\hlfviewerrus.lng.dpygskkey
- C:\far2\plugins\hlfviewer\decrypt-dpygsk-decrypt.hta
- C:\far2\plugins\macroview\changelog.dpygskkey
- C:\far2\plugins\macroview\macroeng.hlf.dpygskkey
- C:\far2\plugins\macroview\macroeng.lng.dpygskkey
- C:\far2\plugins\macroview\macrorus.hlf.dpygskkey
- C:\far2\plugins\macroview\macrorus.lng.dpygskkey
- C:\far2\plugins\ftp\decrypt-dpygsk-decrypt.hta
- C:\far2\plugins\proclist\proclist.map.dpygskkey
- C:\far2\plugins\network\changelog.dpygskkey
- C:\far2\plugins\network\neteng.hlf.dpygskkey
- C:\far2\plugins\network\neteng.lng.dpygskkey
- C:\far2\plugins\network\netrus.hlf.dpygskkey
- C:\far2\plugins\network\netrus.lng.dpygskkey
- C:\far2\plugins\network\network.map.dpygskkey
- C:\far2\plugins\network\decrypt-dpygsk-decrypt.hta
- C:\far2\plugins\proclist\changelog.dpygskkey
- C:\far2\plugins\proclist\proceng.hlf.dpygskkey
- C:\far2\plugins\proclist\proceng.lng.dpygskkey
- C:\far2\plugins\proclist\procrus.hlf.dpygskkey
- C:\far2\plugins\tmppanel\decrypt-dpygsk-decrypt.hta
- C:\far2\plugins\compare\decrypt-dpygsk-decrypt.hta
- C:\far2\plugins\autowrap\decrypt-dpygsk-decrypt.hta
- C:\far2\addons\xlat\descript.ion.dpygskkey
- C:\far2\addons\xlat\russian\descript.ion.dpygskkey
- C:\far2\addons\xlat\russian\decrypt-dpygsk-decrypt.hta
- C:\far2\addons\xlat\decrypt-dpygsk-decrypt.hta
- C:\far2\addons\decrypt-dpygsk-decrypt.hta
- C:\far2\changelog.dpygskkey
- C:\far2\changelog_eng.dpygskkey
- C:\far2\documentation\eng\arc_support.txt.dpygskkey
- C:\far2\documentation\eng\bug_report.txt.dpygskkey
- C:\far2\documentation\eng\far_faq.txt.dpygskkey
- C:\far2\documentation\eng\plugins_review.txt.dpygskkey
- C:\far2\encyclopedia\farencyclopedia_ru.chm.dpygskkey
- C:\far2\documentation\eng\techinfo.txt.dpygskkey
- C:\far2\documentation\eng\decrypt-dpygsk-decrypt.hta
- C:\far2\documentation\rus\arc_support.txt.dpygskkey
- C:\far2\documentation\rus\bug_report.txt.dpygskkey
- C:\far2\documentation\rus\far_faq.txt.dpygskkey
- C:\far2\documentation\rus\plugins_install.txt.dpygskkey
- C:\far2\documentation\rus\plugins_review.txt.dpygskkey
- C:\far2\documentation\rus\techinfo.txt.dpygskkey
- C:\far2\documentation\rus\decrypt-dpygsk-decrypt.hta
- C:\far2\documentation\decrypt-dpygsk-decrypt.hta
- C:\far2\addons\shell\decrypt-dpygsk-decrypt.hta
- C:\far2\documentation\eng\plugins_install.txt.dpygskkey
- C:\far2\addons\shell\farhere.inf.dpygskkey
- z:\xeldz.dpygsk
- D:\$recycle.bin\s-1-5-18\desktop.ini
- %TEMP%\microsoft\windows\itlxcn\windows.sys:qvqhfjkvnrdtqgtt
- %TEMP%\microsoft\windows\o10inb\windows.sys:dhpkxqkdun
- %TEMP%\microsoft\windows\pfn1u4\windows.sys:qxoyhxveerelbnrwg
- z:\$recycle.bin\s-1-5-18\desktop.ini
- <Current directory>\decrypt-dpygsk-decrypt.hta
- D:\install.log.dpygskkey
- D:\decrypt-dpygsk-decrypt.hta
- z:\xeldz.dpygskkey
- z:\decrypt-dpygsk-decrypt.hta
- C:\far2\addons\colors\custom_highlighting\descript.ion.dpygskkey
- C:\far2\addons\setup\decrypt-dpygsk-decrypt.hta
- C:\far2\addons\colors\custom_highlighting\decrypt-dpygsk-decrypt.hta
- C:\far2\addons\colors\default_highlighting\descript.ion.dpygskkey
- C:\far2\addons\colors\default_highlighting\decrypt-dpygsk-decrypt.hta
- C:\far2\addons\colors\descript.ion.dpygskkey
- C:\far2\addons\colors\decrypt-dpygsk-decrypt.hta
- C:\far2\addons\descript.ion.dpygskkey
- C:\far2\addons\macros\descript.ion.dpygskkey
- C:\far2\addons\macros\decrypt-dpygsk-decrypt.hta
- C:\far2\addons\readme.txt.dpygskkey
- C:\far2\addons\setup\descript.ion.dpygskkey
- C:\far2\addons\shell\descript.ion.dpygskkey
- C:\far2\farspa.lng.dpygskkey
- C:\far2\plugins\compare\compeng.lng.dpygskkey
- C:\far2\encyclopedia\tap\decrypt-dpygsk-decrypt.hta
- C:\far2\plugins\arclite\arclite_eng.hlf.dpygskkey
- C:\far2\plugins\arclite\arclite_eng.lng.dpygskkey
- C:\far2\plugins\arclite\arclite_rus.hlf.dpygskkey
- C:\far2\plugins\arclite\arclite_rus.lng.dpygskkey
- C:\far2\plugins\arclite\changelog.dpygskkey
- C:\far2\plugins\arclite\decrypt-dpygsk-decrypt.hta
- C:\far2\plugins\autowrap\autowrap.map.dpygskkey
- C:\far2\plugins\autowrap\changelog.dpygskkey
- C:\far2\plugins\autowrap\wrapeng.lng.dpygskkey
- C:\far2\plugins\autowrap\wraprus.lng.dpygskkey
- C:\far2\plugins\brackets\brackeng.hlf.dpygskkey
- C:\far2\encyclopedia\tap\code.idb.dpygskkey
- C:\far2\plugins\brackets\brackeng.lng.dpygskkey
- C:\far2\plugins\brackets\brackets.map.dpygskkey
- C:\far2\plugins\brackets\brackrus.hlf.dpygskkey
- C:\far2\plugins\brackets\brackrus.lng.dpygskkey
- C:\far2\plugins\brackets\changelog.dpygskkey
- C:\far2\plugins\brackets\decrypt-dpygsk-decrypt.hta
- C:\far2\plugins\compare\changelog.dpygskkey
- C:\far2\plugins\compare\cmpeng.hlf.dpygskkey
- C:\far2\plugins\compare\cmprus.hlf.dpygskkey
- C:\far2\plugins\compare\compare.map.dpygskkey
- C:\far2\plugins\arclite\arclite.map.dpygskkey
- C:\far2\plugins\compare\comprus.lng.dpygskkey
- C:\far2\plugins\arclite\7zsd.sfx.dpygskkey
- C:\far2\farrus.lng.dpygskkey
- C:\far2\encyclopedia\decrypt-dpygsk-decrypt.hta
- C:\far2\far.map.dpygskkey
- C:\far2\farcze.lng.dpygskkey
- C:\far2\fareng.hlf.dpygskkey
- C:\far2\fareng.lng.dpygskkey
- C:\far2\farger.lng.dpygskkey
- C:\far2\farhun.hlf.dpygskkey
- C:\far2\farhun.lng.dpygskkey
- C:\far2\farpol.lng.dpygskkey
- C:\far2\farrus.hlf.dpygskkey
- C:\far2\encyclopedia\tap\12_r0m.tap.dpygskkey
- C:\far2\plugins\arclite\7zs2.sfx.dpygskkey
- C:\far2\fexcept\changelog.dpygskkey
- C:\far2\fexcept\decrypt-dpygsk-decrypt.hta
- C:\far2\file_id.diz.dpygskkey
- C:\far2\plugins\align\align.map.dpygskkey
- C:\far2\plugins\align\aligneng.lng.dpygskkey
- C:\far2\plugins\align\alignrus.lng.dpygskkey
- C:\far2\plugins\align\changelog.dpygskkey
- C:\far2\plugins\align\decrypt-dpygsk-decrypt.hta
- C:\far2\plugins\arclite\7z.sfx.dpygskkey
- C:\far2\plugins\arclite\7zcon.sfx.dpygskkey
- C:\far2\plugins\arclite\7zs2con.sfx.dpygskkey
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\winre.wim.dpygskkey
Sets the 'hidden' attribute to the following files
- C:\$recycle.bin\s-1-5-18\desktop.ini
- D:\$recycle.bin\s-1-5-18\desktop.ini
- z:\$recycle.bin\s-1-5-18\desktop.ini
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- '51.##.171.35':80
- '<LOCALNET>.84.1':445
- '<LOCALNET>.84.1':135
TCP
HTTP POST requests
- http://51.##.171.35/fgate
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin Delete Shadows /All /Quiet
- '<SYSTEM32>\vssvc.exe'
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled No
- '%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin DELETE SYSTEMSTATEBACKUP
- '%WINDIR%\syswow64\cmd.exe' /C wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
- '%WINDIR%\syswow64\cmd.exe' /C wmic SHADOWCOPY /nointeractive
- '%WINDIR%\syswow64\wbem\wmic.exe' SHADOWCOPY /nointeractive
