Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\tcrjafpy
Creates the following files on removable media
- <Drive name for removable media>:\hhhlcert.pem
- <Drive name for removable media>:\osiris-b59c.htm
- <Drive name for removable media>:\tunpersonalca1.pem
- <Drive name for removable media>:\systisoft.pem
- <Drive name for removable media>:\irgeek.pem
- <Drive name for removable media>:\applicant.xlsx
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
Modifies file system
Creates the following files
- D:\osiris-a924.htm
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--70e79dbf--df2afe05b73f.osiris
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\osiris-a583.htm
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--c56d5853--2152ea404acb.osiris
- %ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\osiris-5a1f.htm
- %ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\yk034euj--nfyr--1a1r--9478bc94--067b9ca37933.osiris
- %ALLUSERSPROFILE%\microsoft\windows nt\msscan\osiris-1e9c.htm
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--13c6cc55--ce24497d26a5.osiris
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--f1ddc7b8--b848afa0d9e5.osiris
- C:\far2\addons\osiris-06c2.htm
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\yk034euj--nfyr--1a1r--e14243e4--61df733f9598.osiris
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\osiris-87e1.htm
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\yk034euj--nfyr--1a1r--3372d4e7--0ea1ff61d947.osiris
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\osiris-8b33.htm
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\yk034euj--nfyr--1a1r--027ac9d4--704cb889396a.osiris
- %ALLUSERSPROFILE%\microsoft\windows nt\msscan\yk034euj--nfyr--1a1r--97568f86--e6e298eac04e.osiris
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\osiris-7531.htm
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--f67becf4--267e78819fff.osiris
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--bc639581--9ad91b874397.osiris
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--76f070e8--717cc7b6ece5.osiris
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--51eb565e--0bb71955e95b.osiris
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--d62e57c1--9823639b6593.osiris
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--35dafdb2--4d3497f1e63f.osiris
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--79d0ca8f--8fc4a0b65ec6.osiris
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--10375a29--e71bda0b3690.osiris
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--4284b2b2--6218705e63e3.osiris
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--1b530ad7--32980ea12710.osiris
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--b9e14bcc--b2f9ed23ca2e.osiris
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--8f74f330--24c6dd042549.osiris
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--5d6d3a52--39857657f579.osiris
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--4a92bf93--516a615be2d0.osiris
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--5da7bc30--56d5e21ccb00.osiris
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--e14e7770--57faa1af129e.osiris
- %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\osiris-154f.htm
- C:\users\public\pictures\sample pictures\osiris-b085.htm
- %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\yk034euj--nfyr--1a1r--4f133a68--18cd2721f9ed.osiris
- %ALLUSERSPROFILE%\microsoft\ilscache\osiris-e098.htm
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\osiris-daa7.htm
- C:\far2\documentation\eng\osiris-1e32.htm
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\osiris-63b2.htm
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\osiris-c6d1.htm
- %ALLUSERSPROFILE%\microsoft toolkit\osiris-95a1.htm
- %ALLUSERSPROFILE%\sun\java\java update\osiris-54eb.htm
- C:\far2\plugins\ftp\osiris-3733.htm
- C:\far2\documentation\rus\osiris-135f.htm
- C:\far2\osiris-20da.htm
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\osiris-437d.htm
- C:\far2\addons\colors\osiris-306b.htm
- C:\far2\addons\colors\default_highlighting\osiris-3584.htm
- C:\far2\addons\colors\custom_highlighting\osiris-80eb.htm
- C:\totalcmd\osiris-d3b4.htm
- C:\far2\pluginsdk\headers.pas\osiris-d9e1.htm
- %HOMEPATH%\desktop\osiris-e2e5.htm
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--0fdaa12d--c60a0f64549c.osiris
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--95b96672--076f2a9b703b.osiris
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\osiris-5a19.htm
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\osiris-69f9.htm
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\osiris-28f0.htm
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\yk034euj--nfyr--1a1r--6587d533--703f1c4026ae.osiris
- %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\osiris-3e40.htm
- %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\yk034euj--nfyr--1a1r--da3550d3--f76c38502c7d.osiris
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\osiris-b476.htm
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\yk034euj--nfyr--1a1r--f42611d4--5faf53b4b7c3.osiris
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\osiris-b38b.htm
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\osiris-a07e.htm
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\osiris-c949.htm
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\osiris-6fc1.htm
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\osiris-9ea9.htm
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\osiris-9e2f.htm
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\osiris-2783.htm
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\osiris-db49.htm
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\osiris-7065.htm
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\osiris-c745.htm
- %ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\yk034euj--nfyr--1a1r--862a0bff--92052454a1ef.osiris
Deletes the following files
- <SYSTEM32>\tasks\tcrjafpy
Substitutes the following files
- D:\install.log
- C:\Far2\Documentation\eng\TechInfo.txt
- C:\Far2\Documentation\rus\Arc_Support.txt
- C:\Far2\Documentation\rus\Bug_Report.txt
- C:\Far2\Documentation\rus\Far_FAQ.txt
- C:\Far2\Documentation\rus\Plugins_Install.txt
- C:\Far2\Documentation\rus\Plugins_Review.txt
- C:\Far2\Documentation\rus\TechInfo.txt
- C:\totalcmd\HISTORY.TXT
- C:\Far2\Plugins\FTP\FtpCmds.txt
- C:\Far2\Plugins\FTP\FtpCmds_rus.txt
- C:\Far2\Plugins\FTP\Notes.txt
- C:\Far2\Plugins\FTP\Notes_rus.txt
- C:\totalcmd\KEYBOARD.TXT
- C:\Far2\Addons\README.TXT
- C:\totalcmd\SIZE!.TXT
- C:\Far2\Documentation\eng\Arc_Support.txt
- C:\Far2\Documentation\eng\Bug_Report.txt
- C:\Far2\Documentation\eng\Plugins_Review.txt
- C:\Far2\Documentation\eng\Far_FAQ.txt
- C:\Far2\SaveSettings.cmd
- C:\Far2\RestoreSettings.cmd
- <Drive name for removable media>:\hhhlcert.pem
- <Drive name for removable media>:\TunPersonalCA1.pem
- <Drive name for removable media>:\systisoft.pem
- <Drive name for removable media>:\IRGeek.pem
- %HOMEPATH%\Desktop\lisp_success.doc
- %HOMEPATH%\Desktop\508softwareandos.doc
- %HOMEPATH%\Desktop\applicantform_en.doc
- %HOMEPATH%\Desktop\hanni_umami_chapter.doc
- C:\Far2\PluginSDK\Headers.pas\FarColorW.pas
- C:\Far2\PluginSDK\Headers.pas\FarKeysW.pas
- C:\Far2\PluginSDK\Headers.pas\PluginW.pas
- C:\totalcmd\REGISTER.RTF
- %HOMEPATH%\Desktop\issi2013_template_for_posters.docx
- C:\Far2\Addons\Colors\Custom_Highlighting\import_colors.bat
- C:\Far2\Addons\Colors\Default_Highlighting\import_colors.bat
- C:\Far2\Addons\Colors\export_colors.bat
- C:\Far2\Addons\Colors\import_colors.bat
- C:\Far2\ClearPluginsCache.cmd
- C:\Far2\Documentation\eng\Plugins_Install.txt
Modifies user data files (Trojan.Encoder).
Network activity
Connects to
- '89.##8.83.189':80
- '18#.#6.11.101':80
TCP
HTTP POST requests
- http://18#.#6.11.101/checkupdate
- http://89.##8.83.189/checkupdate
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /Quiet /All' (with hidden window)
