Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\eng\Bug.Report.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\eng\Far.FAQ.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Addons\README.TXT"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\eng\Arc.Support.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\eng\TechInfo.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\rus\Arc.Support.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\eng\Plugins.Install.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\eng\Plugins.Review.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%APPDATA%\Microsoft\Internet Explorer\brndlog.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%HOMEPATH%\Templates\winword.doc"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Documents and Settings\Default User\Templates\excel4.xls"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Documents and Settings\Default User\Templates\powerpnt.ppt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%HOMEPATH%\Templates\excel4.xls"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%HOMEPATH%\Templates\powerpnt.ppt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%HOMEPATH%\Templates\winword2.doc"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%HOMEPATH%\Templates\excel.xls"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\FTP\Notes.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\FTP\Notes_rus.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\FTP\FtpCmds.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\FTP\FtpCmds_rus.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\rus\Plugins.Install.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\rus\Plugins.Review.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\rus\Bug.Report.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\rus\Far.FAQ.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\Colorer\hrc\changes.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\rus\TechInfo.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\7-Zip\far7z.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Documents and Settings\Default User\Templates\excel.xls"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Documents and Settings\Default User\Templates\winword.doc"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Documents and Settings\Default User\Templates\winword2.doc"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp"
Executes the following:
- '<SYSTEM32>\attrib.exe' +r +h "%APPDATA%\gnupg\random_seed"
- '<SYSTEM32>\attrib.exe' +r +h "%APPDATA%\gnupg\pubring.gpg"
- '<SYSTEM32>\attrib.exe' +r +h "%APPDATA%\gnupg"
- '<SYSTEM32>\attrib.exe' +r +h "%APPDATA%\gnupg\trustdb.gpg"
- '<SYSTEM32>\attrib.exe' +r +h "%APPDATA%\gnupg\pubring.bak"
- '<SYSTEM32>\chcp.com' 1251
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\csrss.bat" "
- '<SYSTEM32>\attrib.exe' -s -h -r "%APPDATA%\gnupg"
- '<SYSTEM32>\attrib.exe' -s -h -r "%APPDATA%\gnupg\*.*"
Modifies file system :
Creates the following files:
- %TEMP%\nsx2.tmp\ExecDos.dll
- %TEMP%\uncrypt.t
- %TEMP%\svchost.exe
- %APPDATA%\gnupg\pubring.bak
- %APPDATA%\gnupg\trustdb.gpg
- %APPDATA%\gnupg\random_seed
- %APPDATA%\gnupg\pubring.gpg
- %TEMP%\iconv.dll
- %TEMP%\gnupg\pubring.gpg
- %TEMP%\gnupg\pubring.bak
- %TEMP%\nsx2.tmp\System.dll
- %TEMP%\gnupg\random_seed
- %TEMP%\csrss.bat
- %TEMP%\gnupg\trustdb.gpg
- %TEMP%\gnupg\secring.gpg
Sets the 'hidden' attribute to the following files:
- %APPDATA%\gnupg\random_seed
- %APPDATA%\gnupg\trustdb.gpg
- %APPDATA%\gnupg\pubring.bak
- %APPDATA%\gnupg\pubring.gpg
Deletes the following files:
- %TEMP%\gnupg\secring.gpg
- %TEMP%\gnupg\trustdb.gpg
- %TEMP%\gnupg\random_seed
- %TEMP%\gnupg\pubring.bak
- %TEMP%\gnupg\pubring.gpg
