Technical Information
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\iisstart.htm
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
Modifies file system
Creates the following files
- %TEMP%\_mei23042\crypto\cipher\_arc4.pyd
- C:\far2\plugins\editcase\ecaseeng.lng.enc
- C:\far2\plugins\editcase\ecaseeng.hlf.enc
- C:\far2\plugins\editcase\changelog.enc
- C:\far2\plugins\drawline\drawrus.lng.enc
- C:\far2\plugins\drawline\drawrus.hlf.enc
- C:\far2\plugins\drawline\drawline.map.enc
- C:\far2\plugins\drawline\drawline.dll.enc
- C:\far2\plugins\editcase\ecaserus.hlf.enc
- C:\far2\plugins\drawline\draweng.lng.enc
- C:\far2\plugins\drawline\changelog.enc
- C:\far2\plugins\compare\comprus.lng.enc
- C:\far2\plugins\compare\compeng.lng.enc
- C:\far2\plugins\compare\compare.map.enc
- C:\far2\plugins\compare\compare.dll.enc
- C:\far2\plugins\compare\cmprus.hlf.enc
- C:\far2\plugins\compare\cmpeng.hlf.enc
- C:\far2\plugins\drawline\draweng.hlf.enc
- C:\far2\plugins\editcase\ecaserus.lng.enc
- C:\far2\plugins\editcase\editcase.dll.enc
- C:\far2\plugins\editcase\editcase.map.enc
- C:\far2\plugins\filecase\caserus.hlf.enc
- C:\far2\plugins\filecase\caseeng.lng.enc
- C:\far2\plugins\filecase\caseeng.hlf.enc
- C:\far2\plugins\farcmds\farcmdsrus.lng.enc
- C:\far2\plugins\farcmds\farcmdsrus.hlf.enc
- C:\far2\plugins\farcmds\farcmdseng.lng.enc
- C:\far2\plugins\farcmds\farcmdseng.hlf.enc
- C:\far2\plugins\farcmds\farcmds.map.enc
- C:\far2\plugins\farcmds\farcmds.dll.enc
- C:\far2\plugins\farcmds\changelog.enc
- C:\far2\plugins\emenu\emenurus.lng.enc
- C:\far2\plugins\emenu\emenurus.hlf.enc
- C:\far2\plugins\emenu\emenueng.lng.enc
- C:\far2\plugins\emenu\emenueng.hlf.enc
- C:\far2\plugins\emenu\emenu.map.enc
- C:\far2\plugins\emenu\emenu.dll.enc
- C:\far2\plugins\emenu\changelog.enc
- C:\far2\plugins\compare\changelog.enc
- C:\far2\documentation\rus\far_faq.txt.enc
- C:\far2\plugins\brackets\changelog.enc
- C:\far2\plugins\brackets\brackrus.hlf.enc
- C:\far2\plugins\arclite\7z.dll.enc
- C:\far2\plugins\align\changelog.enc
- C:\far2\plugins\align\alignrus.lng.enc
- C:\far2\plugins\align\aligneng.lng.enc
- C:\far2\plugins\align\align.map.enc
- C:\far2\plugins\align\align.dll.enc
- C:\far2\fexcept\fexcept.dll.enc
- C:\far2\plugins\arclite\7z.sfx.enc
- C:\far2\fexcept\excdump.dll.enc
- C:\far2\fexcept\changelog.enc
- C:\far2\encyclopedia\tap\code.idb.enc
- C:\far2\encyclopedia\tap\code.bin.enc
- C:\far2\encyclopedia\tap\12_r0m.tap.enc
- C:\far2\encyclopedia\farencyclopedia_ru.chm.enc
- C:\far2\documentation\rus\techinfo.txt.enc
- C:\far2\documentation\rus\plugins_review.txt.enc
- C:\far2\fexcept\demangle32.dll.enc
- C:\far2\plugins\arclite\7zcon.sfx.enc
- C:\far2\plugins\arclite\7zs2.sfx.enc
- C:\far2\plugins\arclite\7zs2con.sfx.enc
- C:\far2\plugins\brackets\brackets.map.enc
- C:\far2\plugins\brackets\brackets.dll.enc
- C:\far2\plugins\brackets\brackeng.lng.enc
- C:\far2\plugins\brackets\brackeng.hlf.enc
- C:\far2\plugins\autowrap\wraprus.lng.enc
- C:\far2\plugins\autowrap\wrapeng.lng.enc
- C:\far2\plugins\autowrap\changelog.enc
- C:\far2\plugins\autowrap\autowrap.map.enc
- C:\far2\plugins\autowrap\autowrap.dll.enc
- C:\far2\plugins\arclite\changelog.enc
- C:\far2\plugins\arclite\arclite_rus.lng.enc
- C:\far2\plugins\arclite\arclite_rus.hlf.enc
- C:\far2\plugins\arclite\arclite_eng.lng.enc
- C:\far2\plugins\arclite\arclite_eng.hlf.enc
- C:\far2\plugins\arclite\arclite.map.enc
- C:\far2\plugins\arclite\arclite.dll.enc
- C:\far2\plugins\arclite\7zsd.sfx.enc
- C:\far2\plugins\brackets\brackrus.lng.enc
- C:\far2\documentation\rus\plugins_install.txt.enc
- C:\far2\plugins\filecase\caserus.lng.enc
- C:\far2\plugins\ftp\ftpeng.lng.enc
- C:\far2\pluginsdk\headers.c\farkeys.hpp.enc
- C:\far2\pluginsdk\headers.c\farcolor.hpp.enc
- C:\far2\plugins\tmppanel\tmprus.lng.enc
- C:\far2\plugins\tmppanel\tmprus.hlf.enc
- C:\far2\plugins\tmppanel\tmppanel.map.enc
- C:\far2\plugins\tmppanel\tmppanel.dll.enc
- C:\far2\plugins\tmppanel\tmpeng.lng.enc
- C:\far2\pluginsdk\headers.pas\farcolorw.pas.enc
- C:\far2\pluginsdk\headers.c\plugin.hpp.enc
- C:\far2\plugins\tmppanel\shortcuts_eng.temp.enc
- C:\far2\plugins\tmppanel\disks_rus.temp.enc
- C:\far2\plugins\tmppanel\disks_eng.temp.enc
- C:\far2\plugins\tmppanel\changelog.enc
- C:\far2\plugins\proclist\procrus.lng.enc
- C:\far2\plugins\proclist\procrus.hlf.enc
- C:\far2\plugins\proclist\proclist.map.enc
- C:\far2\plugins\tmppanel\tmpeng.hlf.enc
- %TEMP%\_mei23042\importlib_metadata-6.0.0.dist-info\metadata
- C:\far2\pluginsdk\headers.pas\farkeysw.pas.enc
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlklr.cab.enc
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publr.cab.enc
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.msi.enc
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\pptlr.cab.enc
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.msi.enc
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.msi.enc
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab.enc
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.exe.enc
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab.enc
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab.enc
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.msi.enc
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms.enc
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pidgenx.dll.enc
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab.enc
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\osetup.dll.enc
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\ose.exe.enc
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.msi.enc
- C:\far2\plugins\proclist\proclist.dll.enc
- C:\far2\plugins\tmppanel\shortcuts_rus.temp.enc
- C:\far2\plugins\filecase\filecase.dll.enc
- C:\far2\plugins\filecase\changelog.enc
- C:\far2\plugins\proclist\changelog.enc
- C:\far2\plugins\ftp\ftprus.hlf.enc
- C:\far2\plugins\ftp\lib\ftpprogress.fll.enc
- C:\far2\plugins\ftp\lib\ftpdirlist.map.enc
- C:\far2\plugins\ftp\lib\ftpdirlist.fll.enc
- C:\far2\plugins\ftp\notes_rus.txt.enc
- C:\far2\plugins\ftp\notes.txt.enc
- C:\far2\plugins\ftp\ftprus.lng.enc
- C:\far2\plugins\hlfviewer\hlfviewer.map.enc
- C:\far2\plugins\hlfviewer\changelog.enc
- C:\far2\plugins\hlfviewer\hlfviewer.dll.enc
- C:\far2\plugins\ftp\ftpcmds_rus.txt.enc
- C:\far2\plugins\ftp\ftpcmds.txt.enc
- C:\far2\plugins\ftp\farftp.map.enc
- C:\far2\plugins\ftp\farftp.dll.enc
- C:\far2\plugins\ftp\changelog.enc
- C:\far2\plugins\filecase\filecase.map.enc
- C:\far2\plugins\ftp\ftpeng.hlf.enc
- C:\far2\plugins\hlfviewer\hlfviewereng.hlf.enc
- C:\far2\plugins\network\network.map.enc
- C:\far2\plugins\proclist\proceng.hlf.enc
- C:\far2\plugins\ftp\lib\ftpprogress.map.enc
- C:\far2\plugins\network\network.dll.enc
- C:\far2\plugins\network\netrus.lng.enc
- C:\far2\plugins\network\netrus.hlf.enc
- C:\far2\plugins\network\neteng.lng.enc
- C:\far2\plugins\network\neteng.hlf.enc
- C:\far2\plugins\network\changelog.enc
- C:\far2\plugins\macroview\macroview.map.enc
- C:\far2\plugins\macroview\macroview.dll.enc
- C:\far2\plugins\macroview\macrorus.lng.enc
- C:\far2\plugins\macroview\macrorus.hlf.enc
- C:\far2\plugins\macroview\macroeng.lng.enc
- C:\far2\plugins\macroview\macroeng.hlf.enc
- C:\far2\plugins\macroview\changelog.enc
- C:\far2\plugins\hlfviewer\hlfviewerrus.lng.enc
- C:\far2\plugins\hlfviewer\hlfviewerrus.hlf.enc
- C:\far2\plugins\hlfviewer\hlfviewereng.lng.enc
- C:\far2\plugins\proclist\proceng.lng.enc
- C:\far2\documentation\rus\bug_report.txt.enc
- C:\far2\documentation\rus\arc_support.txt.enc
- C:\far2\documentation\eng\techinfo.txt.enc
- %TEMP%\_mei23042\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei23042\_ssl.pyd
- %TEMP%\_mei23042\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei23042\_socket.pyd
- %TEMP%\_mei23042\_multiprocessing.pyd
- %TEMP%\_mei23042\_lzma.pyd
- %TEMP%\_mei23042\_hashlib.pyd
- %TEMP%\_mei23042\_decimal.pyd
- %TEMP%\_mei23042\_ctypes.pyd
- %TEMP%\_mei23042\_cffi_backend.cp37-win_amd64.pyd
- %TEMP%\_mei23042\_bz2.pyd
- %TEMP%\_mei23042\_queue.pyd
- %TEMP%\_mei23042\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei23042\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei23042\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei23042\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei23042\vcruntime140.dll
- %TEMP%\_mei23042\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei23042\crypto\util\_strxor.pyd
- %TEMP%\_mei23042\crypto\publickey\_x25519.pyd
- %TEMP%\_mei23042\crypto\cipher\_raw_ocb.pyd
- %TEMP%\_mei23042\crypto\cipher\_raw_eksblowfish.pyd
- %TEMP%\_mei23042\crypto\cipher\_raw_ecb.pyd
- %TEMP%\_mei23042\crypto\cipher\_raw_des3.pyd
- %TEMP%\_mei23042\crypto\cipher\_raw_des.pyd
- %TEMP%\_mei23042\crypto\cipher\_raw_ctr.pyd
- %TEMP%\_mei23042\crypto\cipher\_raw_cfb.pyd
- %TEMP%\_mei23042\crypto\cipher\_raw_ofb.pyd
- %TEMP%\_mei23042\crypto\cipher\_raw_cbc.pyd
- %TEMP%\_mei23042\crypto\cipher\_raw_blowfish.pyd
- %TEMP%\_mei23042\crypto\cipher\_raw_arc2.pyd
- %TEMP%\_mei23042\crypto\cipher\_raw_aesni.pyd
- %TEMP%\_mei23042\crypto\cipher\_raw_aes.pyd
- %TEMP%\_mei23042\crypto\cipher\_pkcs1_decode.pyd
- %TEMP%\_mei23042\crypto\cipher\_chacha20.pyd
- %TEMP%\_mei23042\crypto\cipher\_salsa20.pyd
- %TEMP%\_mei23042\crypto\cipher\_raw_cast.pyd
- %TEMP%\_mei23042\crypto\hash\_blake2b.pyd
- %TEMP%\_mei23042\crypto\hash\_blake2s.pyd
- %TEMP%\_mei23042\crypto\hash\_md2.pyd
- %TEMP%\_mei23042\crypto\publickey\_ed448.pyd
- %TEMP%\_mei23042\crypto\publickey\_ed25519.pyd
- %TEMP%\_mei23042\crypto\publickey\_ec_ws.pyd
- %TEMP%\_mei23042\crypto\protocol\_scrypt.pyd
- %TEMP%\_mei23042\crypto\math\_modexp.pyd
- %TEMP%\_mei23042\crypto\hash\_poly1305.pyd
- %TEMP%\_mei23042\crypto\hash\_keccak.pyd
- %TEMP%\_mei23042\crypto\hash\_ghash_portable.pyd
- %TEMP%\_mei23042\crypto\hash\_ghash_clmul.pyd
- %TEMP%\_mei23042\crypto\hash\_sha512.pyd
- %TEMP%\_mei23042\crypto\hash\_sha384.pyd
- %TEMP%\_mei23042\crypto\hash\_sha256.pyd
- %TEMP%\_mei23042\crypto\hash\_sha224.pyd
- %TEMP%\_mei23042\crypto\hash\_sha1.pyd
- %TEMP%\_mei23042\crypto\hash\_ripemd160.pyd
- %TEMP%\_mei23042\crypto\hash\_md5.pyd
- %TEMP%\_mei23042\crypto\hash\_md4.pyd
- %TEMP%\_mei23042\crypto\util\_cpuid_c.pyd
- %TEMP%\_mei23042\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei23042\api-ms-win-crt-heap-l1-1-0.dll
- C:\far2\restoresettings.cmd.enc
- C:\far2\farhun.hlf.enc
- C:\far2\file_id.diz.enc
- C:\far2\farspa.lng.enc
- C:\far2\farrus.lng.enc
- C:\far2\farrus.hlf.enc
- C:\far2\farpol.lng.enc
- C:\far2\farhun.lng.enc
- C:\far2\addons\readme.txt.enc
- C:\far2\savesettings.cmd.enc
- C:\far2\addons\descript.ion.enc
- C:\far2\fareng.hlf.enc
- C:\far2\farcze.lng.enc
- C:\far2\far.map.enc
- C:\far2\far.exe.enc
- C:\far2\clearpluginscache.cmd.enc
- C:\far2\changelog_eng.enc
- C:\far2\fareng.lng.enc
- C:\far2\addons\colors\descript.ion.enc
- C:\far2\documentation\eng\plugins_review.txt.enc
- C:\far2\changelog.enc
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.enc
- C:\far2\documentation\eng\plugins_install.txt.enc
- C:\far2\documentation\eng\far_faq.txt.enc
- C:\far2\documentation\eng\bug_report.txt.enc
- C:\far2\documentation\eng\arc_support.txt.enc
- C:\far2\addons\xlat\russian\descript.ion.enc
- C:\far2\addons\xlat\descript.ion.enc
- C:\far2\addons\shell\farhere.inf.enc
- C:\far2\addons\shell\descript.ion.enc
- C:\far2\addons\setup\descript.ion.enc
- C:\far2\addons\macros\descript.ion.enc
- C:\far2\addons\colors\default_highlighting\import_colors.bat.enc
- C:\far2\addons\colors\default_highlighting\descript.ion.enc
- C:\far2\addons\colors\custom_highlighting\import_colors.bat.enc
- C:\far2\addons\colors\custom_highlighting\descript.ion.enc
- C:\far2\addons\colors\import_colors.bat.enc
- C:\far2\addons\colors\export_colors.bat.enc
- C:\far2\farger.lng.enc
- <Full path to file>.enc
- %HOMEPATH%\desktop\skypesetup.exe.enc
- %TEMP%\_mei23042\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei23042\libssl-1_1.dll
- %TEMP%\_mei23042\win32api.pyd
- %TEMP%\_mei23042\unicodedata.pyd
- %TEMP%\_mei23042\ucrtbase.dll
- %TEMP%\_mei23042\select.pyd
- %TEMP%\_mei23042\pywin32_system32\pywintypes37.dll
- %TEMP%\_mei23042\python37.dll
- %TEMP%\_mei23042\pyexpat.pyd
- %TEMP%\_mei23042\libcrypto-1_1.dll
- %TEMP%\_mei23042\importlib_metadata-6.0.0.dist-info\installer
- %TEMP%\_mei23042\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei23042\api-ms-win-crt-math-l1-1-0.dll
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.msi.enc
- C:\far2\pluginsdk\headers.pas\pluginw.pas.enc
- %TEMP%\_mei23042\importlib_metadata-6.0.0.dist-info\license
- %TEMP%\_mei23042\importlib_metadata-6.0.0.dist-info\wheel
- %TEMP%\_mei23042\base_library.zip
- %HOMEPATH%\desktop\dialmap.bmp.enc
- %HOMEPATH%\desktop\desktop.ini.enc
- %HOMEPATH%\desktop\dashborder_144.bmp.enc
- %HOMEPATH%\desktop\contosoroot_1.cer.enc
- %HOMEPATH%\desktop\chromesetup.exe.enc
- %HOMEPATH%\desktop\browse.htm.enc
- %HOMEPATH%\desktop\alert.htm.enc
- %HOMEPATH%\desktop\about.html.enc
- %TEMP%\_mei23042\wheel-0.38.4.dist-info\top_level.txt
- %TEMP%\_mei23042\wheel-0.38.4.dist-info\entry_points.txt
- %TEMP%\_mei23042\wheel-0.38.4.dist-info\wheel
- %TEMP%\_mei23042\wheel-0.38.4.dist-info\record
- %TEMP%\_mei23042\wheel-0.38.4.dist-info\metadata
- %TEMP%\_mei23042\wheel-0.38.4.dist-info\license.txt
- %TEMP%\_mei23042\wheel-0.38.4.dist-info\installer
- %TEMP%\_mei23042\importlib_metadata-6.0.0.dist-info\top_level.txt
- %TEMP%\_mei23042\importlib_metadata-6.0.0.dist-info\record
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordlr.cab.enc
Deletes itself.
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c "fsutil fsinfo drivetype C:\"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "fsutil fsinfo drivetype C:\"
- '<SYSTEM32>\fsutil.exe' fsinfo drivetype C:\
