Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'XO1XADpO01' = '"<Full path to file>"'
Creates the following files on removable media
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\contosoroot_1.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\restore-my-files.txt
- <Drive name for removable media>:\issi2013_template_for_posters.docx
- <Drive name for removable media>:\thlps_keeper_mayer_1965.docx
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- D:\restore-my-files.txt
- C:\far2\plugins\compare\restore-my-files.txt
- C:\far2\plugins\drawline\restore-my-files.txt
- C:\far2\plugins\editcase\restore-my-files.txt
- C:\far2\plugins\emenu\restore-my-files.txt
- C:\far2\plugins\farcmds\restore-my-files.txt
- C:\far2\plugins\filecase\restore-my-files.txt
- C:\far2\plugins\ftp\restore-my-files.txt
- C:\far2\plugins\ftp\lib\restore-my-files.txt
- C:\far2\plugins\hlfviewer\restore-my-files.txt
- C:\far2\plugins\macroview\restore-my-files.txt
- C:\far2\plugins\network\restore-my-files.txt
- C:\far2\plugins\proclist\restore-my-files.txt
- C:\far2\plugins\tmppanel\restore-my-files.txt
- C:\far2\pluginsdk\headers.c\restore-my-files.txt
- C:\far2\pluginsdk\headers.pas\restore-my-files.txt
- C:\far2\plugins\brackets\restore-my-files.txt
- %ProgramFiles%\dvd maker\restore-my-files.txt
- C:\far2\plugins\autowrap\restore-my-files.txt
- C:\far2\plugins\align\restore-my-files.txt
- C:\far2\addons\colors\custom_highlighting\restore-my-files.txt
- C:\far2\addons\colors\default_highlighting\restore-my-files.txt
- C:\far2\addons\colors\restore-my-files.txt
- C:\far2\addons\restore-my-files.txt
- C:\far2\addons\macros\restore-my-files.txt
- C:\far2\addons\setup\restore-my-files.txt
- C:\far2\addons\shell\restore-my-files.txt
- C:\far2\addons\xlat\restore-my-files.txt
- C:\far2\addons\xlat\russian\restore-my-files.txt
- C:\far2\restore-my-files.txt
- C:\far2\documentation\eng\restore-my-files.txt
- C:\far2\documentation\rus\restore-my-files.txt
- C:\far2\encyclopedia\restore-my-files.txt
- C:\far2\encyclopedia\tap\restore-my-files.txt
- C:\far2\fexcept\restore-my-files.txt
- C:\far2\plugins\arclite\restore-my-files.txt
- %ProgramFiles%\dvd maker\en-us\restore-my-files.txt
Moves the following files
- from %ProgramFiles%\dvd maker\audiodepthconverter.ax to %ProgramFiles%\dvd maker\audiodepthconverter.ax.lockbit
- from %ProgramFiles%\dvd maker\bod_r.ttf to %ProgramFiles%\dvd maker\bod_r.ttf.lockbit
- from %ProgramFiles%\dvd maker\directshowtap.ax to %ProgramFiles%\dvd maker\directshowtap.ax.lockbit
- from %ProgramFiles%\dvd maker\en-us\wmm2clip.dll.mui to %ProgramFiles%\dvd maker\en-us\wmm2clip.dll.mui.lockbit
- from %ProgramFiles%\dvd maker\en-us\omdproject.dll.mui to %ProgramFiles%\dvd maker\en-us\omdproject.dll.mui.lockbit
- from %ProgramFiles%\dvd maker\en-us\dvdmaker.exe.mui to %ProgramFiles%\dvd maker\en-us\dvdmaker.exe.mui.lockbit
- from %ProgramFiles%\dvd maker\eurosti.ttf to %ProgramFiles%\dvd maker\eurosti.ttf.lockbit
- from %ProgramFiles%\dvd maker\fieldswitch.ax to %ProgramFiles%\dvd maker\fieldswitch.ax.lockbit
- from %ProgramFiles%\dvd maker\offset.ax to %ProgramFiles%\dvd maker\offset.ax.lockbit
- from %ProgramFiles%\dvd maker\rtstreamsink.ax to %ProgramFiles%\dvd maker\rtstreamsink.ax.lockbit
- from %ProgramFiles%\dvd maker\rtstreamsource.ax to %ProgramFiles%\dvd maker\rtstreamsource.ax.lockbit
- from %ProgramFiles%\dvd maker\secretst.ttf to %ProgramFiles%\dvd maker\secretst.ttf.lockbit
- from %ProgramFiles%\dvd maker\shared\common.fxh to %ProgramFiles%\dvd maker\shared\common.fxh.lockbit
Substitutes the following files
- <Drive name for removable media>:\correct.avi
- C:\Far2\Plugins\Brackets\Brackets.map
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...
