Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im msftesql.exe
- '<SYSTEM32>\taskkill.exe' /f /im mysqld-opt.exe
- '<SYSTEM32>\taskkill.exe' /f /im dbeng50.exe
- '<SYSTEM32>\taskkill.exe' /f /im sqbcoreservice.exe
- '<SYSTEM32>\taskkill.exe' /f /im excel.exe
- '<SYSTEM32>\taskkill.exe' /f /im infopath.exe
- '<SYSTEM32>\taskkill.exe' /f /im msaccess.exe
- '<SYSTEM32>\taskkill.exe' /f /im mspub.exe
- '<SYSTEM32>\taskkill.exe' /f /im outlook.exe
- '<SYSTEM32>\taskkill.exe' /f /im wordpad.exe
- '<SYSTEM32>\taskkill.exe' /f /im powerpnt.exe
- '<SYSTEM32>\taskkill.exe' /f /im steam.exe
- '<SYSTEM32>\taskkill.exe' /f /im thebat.exe
- '<SYSTEM32>\taskkill.exe' /f /im thebat64.exe
- '<SYSTEM32>\taskkill.exe' /f /im thunderbird.exe
- '<SYSTEM32>\taskkill.exe' /f /im visio.exe
- '<SYSTEM32>\taskkill.exe' /f /im winword.exe
- '<SYSTEM32>\taskkill.exe' /f /im mysqld-nt.exe
- '<SYSTEM32>\taskkill.exe' /f /im onenote.exe
- '<SYSTEM32>\taskkill.exe' /f /im mysqld.exe
- '<SYSTEM32>\taskkill.exe' /f /im synctime.exe
- '<SYSTEM32>\taskkill.exe' /f /im sqlagent.exe
- '<SYSTEM32>\taskkill.exe' /f /im sqlbrowser.exe
- '<SYSTEM32>\taskkill.exe' /f /im sqlservr.exe
- '<SYSTEM32>\taskkill.exe' /f /im sqlwriter.exe
- '<SYSTEM32>\taskkill.exe' /f /im oracle.exe
- '<SYSTEM32>\taskkill.exe' /f /im ocssd.exe
- '<SYSTEM32>\taskkill.exe' /f /im dbsnmp.exe
- '<SYSTEM32>\taskkill.exe' /f /im mydesktopqos.exe
- '<SYSTEM32>\taskkill.exe' /f /im tbirdconfig.exe
- '<SYSTEM32>\taskkill.exe' /f /im agntsvc.exeisqlplussvc.exe
- '<SYSTEM32>\taskkill.exe' /f /im xfssvccon.exe
- '<SYSTEM32>\taskkill.exe' /f /im mydesktopservice.exe
- '<SYSTEM32>\taskkill.exe' /f /im ocautoupds.exe
- '<SYSTEM32>\taskkill.exe' /f /im agntsvc.exeagntsvc.exe
- '<SYSTEM32>\taskkill.exe' /f /im agntsvc.exeencsvc.exe
- '<SYSTEM32>\taskkill.exe' /f /im firefoxconfig.exe
- '<SYSTEM32>\taskkill.exe' /f /im ocomm.exe
- '<SYSTEM32>\taskkill.exe' /f /im tnslsnr.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\64bit_notes.htm
- %HOMEPATH%\desktop\tree_view.htm
- %HOMEPATH%\desktop\testee.cer
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\ituneshelpunavailable.htm
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\trivial-merge.htm
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\showkey.txt
- C:\far2\documentation\rus\plugins_review.txt.locked
- C:\far2\encyclopedia\farencyclopedia_ru.chm.locked
- C:\far2\documentation\rus\techinfo.txt.locked
- C:\far2\encyclopedia\tap\code.idb.locked
- C:\far2\pluginsdk\headers.c\farcolor.hpp.locked
- C:\totalcmd\readme.html
- C:\far2\fexcept\changelog.locked
- C:\far2\encyclopedia\tap\code.bin.locked
- C:\far2\pluginsdk\headers.c\plugin.hpp.locked
- C:\far2\pluginsdk\headers.pas\farkeysw.pas.locked
- C:\far2\pluginsdk\headers.pas\pluginw.pas.locked
- C:\far2\plugins\align\changelog.locked
- C:\far2\plugins\autowrap\changelog.locked
- C:\far2\plugins\brackets\changelog.locked
- C:\far2\pluginsdk\headers.c\farkeys.hpp.locked
- C:\far2\plugins\compare\changelog.locked
- C:\far2\pluginsdk\headers.pas\farcolorw.pas.locked
- C:\totalcmd\language\readme.html
- <Current directory>\readme.html
- %HOMEPATH%\voip\readme.html
- %HOMEPATH%\desktop\readme.html
- %HOMEPATH%\documents\readme.html
- %HOMEPATH%\downloads\readme.html
- %HOMEPATH%\favorites\readme.html
- %HOMEPATH%\favorites\links\readme.html
- %HOMEPATH%\favorites\links for united states\readme.html
- %HOMEPATH%\readme.html
- %HOMEPATH%\favorites\msn websites\readme.html
- %HOMEPATH%\favorites\microsoft websites\readme.html
- %HOMEPATH%\favorites\windows live\readme.html
- %HOMEPATH%\links\readme.html
- %HOMEPATH%\music\readme.html
- %HOMEPATH%\pictures\readme.html
- %HOMEPATH%\saved games\readme.html
- %HOMEPATH%\searches\readme.html
- C:\far2\documentation\rus\plugins_install.txt.locked
- %HOMEPATH%\videos\readme.html
- C:\users\public\videos\sample videos\readme.html
- %HOMEPATH%\contacts\readme.html
- C:\far2\plugins\drawline\changelog.locked
- C:\far2\plugins\ftp\ftpcmds_rus.txt.locked
- C:\users\public\music\sample music\kalimba.mp3.locked
- C:\users\public\music\sample music\maid with the flaxen hair.mp3.locked
- C:\users\public\music\sample music\sleep away.mp3.locked
- C:\users\public\pictures\sample pictures\chrysanthemum.jpg.locked
- C:\users\public\pictures\sample pictures\desert.jpg.locked
- C:\users\public\pictures\sample pictures\hydrangeas.jpg.locked
- C:\users\public\music\sample music\albumart_{5fa05d35-a682-4af6-96f7-0773e42d4d16}_large.jpg.locked
- C:\users\public\music\sample music\folder.jpg.locked
- C:\users\public\pictures\sample pictures\jellyfish.jpg.locked
- C:\users\public\pictures\sample pictures\penguins.jpg.locked
- C:\users\public\videos\sample videos\wildlife.wmv.locked
- C:\users\public\pictures\sample pictures\tulips.jpg.locked
- %HOMEPATH%\contacts\user.contact.locked
- %HOMEPATH%\desktop\64bit_notes.htm.locked
- C:\totalcmd\history.txt.locked
- C:\users\public\pictures\sample pictures\koala.jpg.locked
- C:\users\public\pictures\sample pictures\lighthouse.jpg.locked
- C:\users\public\music\sample music\albumart_{5fa05d35-a682-4af6-96f7-0773e42d4d16}_small.jpg.locked
- C:\users\default\ntuser.dat.log.locked
- C:\users\default\favorites\readme.html
- C:\far2\plugins\ftp\notes.txt.locked
- C:\far2\plugins\ftp\notes_rus.txt.locked
- C:\far2\plugins\ftp\changelog.locked
- C:\far2\plugins\farcmds\changelog.locked
- C:\far2\plugins\filecase\changelog.locked
- C:\far2\plugins\hlfviewer\changelog.locked
- C:\far2\plugins\macroview\changelog.locked
- C:\far2\plugins\network\changelog.locked
- C:\far2\plugins\proclist\changelog.locked
- C:\far2\plugins\tmppanel\changelog.locked
- C:\far2\plugins\arclite\changelog.locked
- C:\far2\restoresettings.cmd.locked
- C:\far2\savesettings.cmd.locked
- C:\far2\changelog.locked
- C:\users\default\ntuser.dat.locked
- C:\far2\plugins\emenu\changelog.locked
- C:\far2\plugins\ftp\ftpcmds.txt.locked
- C:\far2\plugins\editcase\changelog.locked
- C:\users\public\videos\readme.html
- C:\users\public\recorded tv\sample media\readme.html
- C:\users\public\recorded tv\readme.html
- C:\far2\encyclopedia\tap\readme.html
- C:\far2\fexcept\readme.html
- C:\far2\pluginsdk\readme.html
- C:\far2\pluginsdk\headers.c\readme.html
- C:\far2\pluginsdk\headers.pas\readme.html
- C:\far2\clearpluginscache.cmd.locked
- C:\far2\plugins\readme.html
- C:\far2\encyclopedia\readme.html
- C:\far2\plugins\align\readme.html
- C:\far2\plugins\brackets\readme.html
- C:\far2\plugins\compare\readme.html
- C:\far2\plugins\drawline\readme.html
- C:\far2\plugins\emenu\readme.html
- C:\far2\plugins\editcase\readme.html
- C:\far2\documentation\eng\arc_support.txt.locked
- C:\far2\documentation\eng\readme.html
- C:\far2\plugins\autowrap\readme.html
- C:\far2\documentation\readme.html
- C:\far2\addons\xlat\russian\readme.html
- %ALLUSERSPROFILE%\public.txt
- C:\far2\readme.html
- C:\far2\addons\readme.html
- C:\far2\addons\colors\readme.html
- C:\far2\addons\colors\custom_highlighting\readme.html
- %ALLUSERSPROFILE%\encfile.txt
- C:\far2\addons\colors\custom_highlighting\import_colors.bat.locked
- C:\far2\addons\colors\default_highlighting\readme.html
- nul
- C:\far2\addons\colors\import_colors.bat.locked
- C:\far2\addons\macros\readme.html
- C:\far2\addons\colors\export_colors.bat.locked
- C:\far2\addons\setup\readme.html
- C:\far2\addons\shell\readme.html
- C:\far2\addons\xlat\readme.html
- C:\far2\addons\readme.txt.locked
- C:\far2\documentation\eng\far_faq.txt.locked
- C:\far2\addons\colors\default_highlighting\import_colors.bat.locked
- C:\far2\documentation\eng\bug_report.txt.locked
- C:\far2\documentation\rus\readme.html
- C:\far2\plugins\ftp\readme.html
- C:\users\default\pictures\readme.html
- C:\users\default\videos\readme.html
- C:\users\public\readme.html
- C:\users\public\desktop\readme.html
- C:\far2\documentation\eng\techinfo.txt.locked
- C:\far2\documentation\rus\arc_support.txt.locked
- C:\users\public\documents\readme.html
- C:\users\public\downloads\readme.html
- C:\users\public\favorites\readme.html
- C:\far2\documentation\rus\bug_report.txt.locked
- C:\users\public\libraries\readme.html
- C:\users\public\music\readme.html
- C:\far2\documentation\rus\far_faq.txt.locked
- C:\users\public\music\sample music\readme.html
- C:\users\public\pictures\readme.html
- C:\users\public\pictures\sample pictures\readme.html
- C:\users\default\music\readme.html
- C:\far2\plugins\ftp\lib\readme.html
- C:\users\default\saved games\readme.html
- C:\users\public\music\sample music\albumartsmall.jpg.locked
- C:\totalcmd\keyboard.txt.locked
- C:\users\default\downloads\readme.html
- C:\far2\documentation\eng\plugins_install.txt.locked
- C:\far2\plugins\filecase\readme.html
- C:\far2\plugins\hlfviewer\readme.html
- C:\far2\documentation\eng\plugins_review.txt.locked
- C:\far2\plugins\macroview\readme.html
- C:\far2\plugins\network\readme.html
- C:\far2\plugins\proclist\readme.html
- C:\far2\plugins\farcmds\readme.html
- C:\far2\plugins\tmppanel\readme.html
- C:\msocache\readme.html
- C:\perflogs\readme.html
- C:\perflogs\admin\readme.html
- C:\users\readme.html
- C:\users\default\readme.html
- C:\users\default\desktop\readme.html
- C:\users\default\documents\readme.html
- C:\far2\plugins\arclite\readme.html
- C:\users\default\links\readme.html
- C:\totalcmd\language\wcmd_chn.inc.locked
Modifies the following files
- C:\far2\addons\colors\custom_highlighting\import_colors.bat
- C:\far2\pluginsdk\headers.pas\pluginw.pas
- C:\far2\pluginsdk\headers.pas\farkeysw.pas
- C:\far2\pluginsdk\headers.pas\farcolorw.pas
- C:\far2\pluginsdk\headers.c\plugin.hpp
- C:\far2\pluginsdk\headers.c\farkeys.hpp
- C:\far2\pluginsdk\headers.c\farcolor.hpp
- C:\far2\fexcept\changelog
- C:\far2\encyclopedia\tap\code.idb
- C:\far2\documentation\rus\plugins_review.txt
- C:\far2\encyclopedia\farencyclopedia_ru.chm
- C:\far2\documentation\rus\techinfo.txt
- C:\far2\encyclopedia\tap\code.bin
- C:\far2\documentation\rus\plugins_install.txt
- C:\far2\documentation\rus\far_faq.txt
- C:\far2\documentation\rus\bug_report.txt
- C:\far2\documentation\rus\arc_support.txt
- C:\far2\documentation\eng\techinfo.txt
- C:\far2\documentation\eng\plugins_review.txt
- C:\far2\documentation\eng\plugins_install.txt
- C:\far2\documentation\eng\bug_report.txt
- C:\far2\documentation\eng\far_faq.txt
- C:\far2\documentation\eng\arc_support.txt
- C:\far2\clearpluginscache.cmd
- C:\far2\addons\readme.txt
- C:\far2\addons\colors\export_colors.bat
- C:\far2\addons\colors\default_highlighting\import_colors.bat
- C:\far2\addons\colors\import_colors.bat
- C:\far2\plugins\align\changelog
- C:\far2\plugins\autowrap\changelog
Modifies multiple files.
Substitutes the following files
- C:\Far2\Addons\Colors\Custom_Highlighting\import_colors.bat
- C:\Users\Default\NTUSER.DAT.LOG
- C:\Far2\SaveSettings.cmd
- C:\Users\Default\NTUSER.DAT
- C:\Far2\changelog
- C:\Far2\RestoreSettings.cmd
- C:\Far2\Plugins\arclite\changelog
- C:\Far2\Plugins\FTP\Notes.txt
- C:\Far2\Plugins\TmpPanel\changelog
- C:\Far2\Plugins\Network\changelog
- C:\Far2\Plugins\MacroView\changelog
- C:\Far2\Plugins\HlfViewer\changelog
- C:\Far2\Plugins\FileCase\changelog
- C:\Far2\Plugins\FarCmds\changelog
- C:\Far2\Plugins\FTP\changelog
- C:\Far2\Plugins\ProcList\changelog
- C:\Far2\Plugins\FTP\Notes_rus.txt
- C:\Users\Public\Music\Sample Music\AlbumArtSmall.jpg
- C:\Users\Public\Pictures\Sample Pictures\Desert.jpg
- %HOMEPATH%\Contacts\user.contact
- %HOMEPATH%\Desktop\64bit_notes.htm
- C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg
- C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
- C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg
- C:\Users\Public\Pictures\Sample Pictures\Koala.jpg
- C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg
- C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg
- C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
- C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
- C:\Users\Public\Music\Sample Music\Sleep Away.mp3
- C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
- C:\Users\Public\Music\Sample Music\Kalimba.mp3
- C:\Users\Public\Music\Sample Music\Folder.jpg
- C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
- C:\Far2\Plugins\FTP\FtpCmds_rus.txt
- C:\Far2\Plugins\FTP\FtpCmds.txt
- C:\Far2\Plugins\EditCase\changelog
- C:\Far2\Documentation\rus\Arc_Support.txt
- C:\Far2\Documentation\rus\Bug_Report.txt
- C:\Far2\Documentation\eng\TechInfo.txt
- C:\Far2\Documentation\eng\Plugins_Review.txt
- C:\Far2\Documentation\eng\Plugins_Install.txt
- C:\Far2\Documentation\rus\Plugins_Install.txt
- C:\Far2\Documentation\eng\Bug_Report.txt
- C:\Far2\Documentation\eng\Arc_Support.txt
- C:\Far2\ClearPluginsCache.cmd
- C:\Far2\Addons\README.TXT
- C:\Far2\Addons\Colors\export_colors.bat
- C:\Far2\Addons\Colors\import_colors.bat
- C:\Far2\Addons\Colors\Default_Highlighting\import_colors.bat
- C:\Far2\Documentation\eng\Far_FAQ.txt
- C:\Far2\Documentation\rus\TechInfo.txt
- C:\Far2\Documentation\rus\Far_FAQ.txt
- C:\Far2\Encyclopedia\FarEncyclopedia_ru.chm
- C:\Far2\Plugins\DrawLine\changelog
- C:\Far2\PluginSDK\Headers.pas\FarKeysW.pas
- C:\Far2\Plugins\EMenu\changelog
- C:\Far2\Plugins\Compare\changelog
- C:\Far2\Plugins\Brackets\changelog
- C:\Far2\Plugins\AutoWrap\changelog
- C:\Far2\Plugins\Align\changelog
- C:\Far2\PluginSDK\Headers.pas\PluginW.pas
- C:\Far2\PluginSDK\Headers.pas\FarColorW.pas
- C:\Far2\Documentation\rus\Plugins_Review.txt
- C:\Far2\PluginSDK\Headers.c\plugin.hpp
- C:\Far2\PluginSDK\Headers.c\farkeys.hpp
- C:\Far2\PluginSDK\Headers.c\farcolor.hpp
- C:\Far2\FExcept\changelog
- C:\Far2\Encyclopedia\tap\code.idb
- C:\Far2\Encyclopedia\tap\code.bin
- C:\totalcmd\HISTORY.TXT
- C:\totalcmd\KEYBOARD.TXT
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- '19#.#6.29.183':80
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im msftesql.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im mysqld-nt.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im mysqld-opt.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im dbeng50.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im sqbcoreservice.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im excel.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im infopath.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im msaccess.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im mspub.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im onenote.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im outlook.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im powerpnt.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im steam.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im thebat.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im thebat64.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im thunderbird.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im visio.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im winword.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im mysqld.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im wordpad.exe"
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im ocomm.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im firefoxconfig.exe "
- '<SYSTEM32>\cmd.exe' /c "schtasks /delete /tn WM /F "
- '<SYSTEM32>\schtasks.exe' /delete /tn WM /F
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im sqlagent.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im sqlbrowser.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im sqlservr.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im sqlwriter.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im oracle.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im ocssd.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im dbsnmp.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im synctime.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im mydesktopqos.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im agntsvc.exeisqlplussvc.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im xfssvccon.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im mydesktopservice.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im ocautoupds.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im agntsvc.exeagntsvc.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im agntsvc.exeencsvc.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im tbirdconfig.exe "
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im tnslsnr.exe"
