Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop "audioendpointbuilder" /y
- '%WINDIR%\syswow64\net.exe' stop "samss" /y
Modifies file system
Creates the following files
- <Current directory>\wwikullkcrep.exe
- C:\far2\addons\setup\ryukreadme.html
- C:\far2\addons\macros\ryukreadme.html
- C:\far2\addons\colors\default_highlighting\ryukreadme.html
- C:\far2\addons\colors\custom_highlighting\ryukreadme.html
- C:\far2\addons\colors\ryukreadme.html
- C:\far2\addons\ryukreadme.html
- C:\far2\ryukreadme.html
- C:\documents and settings\ryukreadme.html
- C:\far2\addons\shell\ryukreadme.html
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\ryukreadme.html
- C:\ryukreadme.html
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\ryukreadme.html
- D:\$recycle.bin\ryukreadme.html
- D:\ryukreadme.html
- %TEMP%\ryukreadme.html
- C:\users\public\ryukreadme.html
- <Current directory>\abfdijxjwlan.exe
- <Current directory>\prszvjcvrlan.exe
- C:\$recycle.bin\ryukreadme.html
- C:\far2\addons\xlat\ryukreadme.html
Sets the 'hidden' attribute to the following files
- <Current directory>\wwikullkcrep.exe
- <Current directory>\prszvjcvrlan.exe
- <Current directory>\abfdijxjwlan.exe
Modifies the following files
- C:\far2\addons\setup\default165.reg
- C:\far2\addons\xlat\russian\altr.reg
- C:\far2\addons\colors\custom_highlighting\import_colors.bat
- C:\far2\addons\colors\default_highlighting\rodion_doroshkevich.reg
- C:\far2\addons\macros\view_space.reg
- C:\far2\addons\xlat\russian\apps.reg
- C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg
- C:\far2\addons\macros\altmenu.reg
- C:\far2\addons\xlat\russian\qwerty.reg
- C:\far2\addons\macros\wheelscreenswitch.reg
- C:\far2\addons\macros\altsearch.reg
- C:\far2\addons\macros\altscreens.reg
- C:\far2\addons\descript.ion
- C:\far2\addons\xlat\russian\ctrlshiftx.reg
- C:\far2\addons\setup\executor_cmd.reg
Network activity
UDP
- '<LOCALNET>.22.1':7
- '22#.0.0.22':7
Miscellaneous
Creates and executes the following
- '<Current directory>\wwikullkcrep.exe' 9 REP
- '<Current directory>\prszvjcvrlan.exe' 8 LAN
- '<Current directory>\abfdijxjwlan.exe' 8 LAN
- '<Current directory>\wwikullkcrep.exe' 9 REP' (with hidden window)
- '<Current directory>\prszvjcvrlan.exe' 8 LAN' (with hidden window)
- '<Current directory>\abfdijxjwlan.exe' 8 LAN' (with hidden window)
- '%WINDIR%\syswow64\icacls.exe' "A:\*" /grant Everyone:F /T /C /Q' (with hidden window)
- '%WINDIR%\syswow64\icacls.exe' "C:\*" /grant Everyone:F /T /C /Q' (with hidden window)
- '%WINDIR%\syswow64\icacls.exe' "D:\*" /grant Everyone:F /T /C /Q' (with hidden window)
- '%WINDIR%\syswow64\icacls.exe' "E:\*" /grant Everyone:F /T /C /Q' (with hidden window)
- '%WINDIR%\syswow64\icacls.exe' "<Drive name for removable media>:\*" /grant Everyone:F /T /C /Q' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "audioendpointbuilder" /y' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop "samss" /y' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\icacls.exe' "A:\*" /grant Everyone:F /T /C /Q
- '%WINDIR%\syswow64\icacls.exe' "C:\*" /grant Everyone:F /T /C /Q
- '%WINDIR%\syswow64\icacls.exe' "D:\*" /grant Everyone:F /T /C /Q
- '%WINDIR%\syswow64\icacls.exe' "E:\*" /grant Everyone:F /T /C /Q
- '%WINDIR%\syswow64\icacls.exe' "<Drive name for removable media>:\*" /grant Everyone:F /T /C /Q
- '%WINDIR%\syswow64\net1.exe' stop "audioendpointbuilder" /y
- '%WINDIR%\syswow64\net1.exe' stop "samss" /y
