Trojan:ALisp/Recfas

Installation 

Trojan:ALisp/Recfas variants usually arrive on your PC as the file acad.vlx together with a clean AutoCAD drawing.

When run, the malware makes a copy of itself in the following location, depending on the version of AutoCAD installed on your PC:

• %APPDATA%\Roaming\Autodesk\<AutoCAD version>\R19.0\enu\Support\acad.vlx, for example %APPDATA%\Roaming\Autodesk\AutoCAD 2013 - English\R19.0\enu\Support\acad.vlx

It also makes a copy of itself in the location of any drawings which are opened when it is running.

Payload

Modifies AutoCAD drawings

This threat can make changes to your AutoCAD drawings. 

When an AutoCAD drawing is opened while the malware is running, the contents of the clean drawing are replaced with the message "MUST re_cover!":

The malware deletes any backup of the drawing file with the extension .bak.

It also sets up the AutoLISP command "RE_COVER" which can be used to undo the changes to the drawing. The malware must be running in order for this to work.

Analysis by Raymond Roberts