Trojan.Encoder.43738

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%HOMEPATH%\start menu\programs\startup\readme_how_to_unlock.txt
%HOMEPATH%\start menu\programs\startup\readme_how_to_unlock.html

Creates the following files on removable media

<Drive name for removable media>:\delete.avi
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\applicantform_en.doc
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\cveuropeo.doc

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)

deletes volume shadow copies.

Executes the following

'%WINDIR%\syswow64\net.exe' stop vss
'%WINDIR%\syswow64\net.exe' stop swprv
'%WINDIR%\syswow64\net.exe' stop srservice

Reads files which store third party applications passwords

%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\sdkfailsafeemulator.cer
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\weeklysheet1215.doc

Modifies file system

Creates the following files

<SYSTEM32>\windowspowershell\v1.0\19b140a9.exe
C:\kms\readme_how_to_unlock.txt
C:\kms\readme_how_to_unlock.html
C:\msocache\readme_how_to_unlock.txt
C:\msocache\readme_how_to_unlock.html
C:\perflogs\readme_how_to_unlock.txt
C:\perflogs\readme_how_to_unlock.html
C:\recovery\readme_how_to_unlock.txt
C:\recovery\readme_how_to_unlock.html
C:\users\readme_how_to_unlock.txt
C:\users\readme_how_to_unlock.html
<Current directory>\readme_how_to_unlock.txt
<Current directory>\readme_how_to_unlock.html
C:\msocache\all users\readme_how_to_unlock.txt
C:\msocache\all users\readme_how_to_unlock.html
C:\recovery\windowsre\readme_how_to_unlock.txt
C:\recovery\windowsre\readme_how_to_unlock.html
C:\users\default\readme_how_to_unlock.txt
C:\users\default\readme_how_to_unlock.html
C:\users\public\readme_how_to_unlock.txt
C:\users\public\readme_how_to_unlock.html
%HOMEPATH%\readme_how_to_unlock.txt
%HOMEPATH%\readme_how_to_unlock.html
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\readme_how_to_unlock.html
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.html
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.html
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.html
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.html
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.html
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.html
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.html
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.html
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.html
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.html
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.html
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.html
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.html
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\readme_how_to_unlock.html
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.html
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\readme_how_to_unlock.html
C:\users\default\appdata\readme_how_to_unlock.txt
C:\users\default\appdata\readme_how_to_unlock.html
C:\users\default\desktop\readme_how_to_unlock.txt
C:\users\default\desktop\readme_how_to_unlock.html
C:\users\default\documents\readme_how_to_unlock.txt
C:\users\default\documents\readme_how_to_unlock.html
C:\users\default\downloads\readme_how_to_unlock.txt
C:\users\default\downloads\readme_how_to_unlock.html
C:\users\default\favorites\readme_how_to_unlock.txt
C:\users\default\favorites\readme_how_to_unlock.html
C:\users\default\links\readme_how_to_unlock.txt
C:\users\default\links\readme_how_to_unlock.html
C:\users\default\music\readme_how_to_unlock.txt
C:\users\default\music\readme_how_to_unlock.html
C:\users\default\pictures\readme_how_to_unlock.txt
C:\users\default\pictures\readme_how_to_unlock.html
C:\users\default\saved games\readme_how_to_unlock.txt
C:\users\default\saved games\readme_how_to_unlock.html
C:\users\default\videos\readme_how_to_unlock.txt
C:\users\default\videos\readme_how_to_unlock.html
C:\users\public\accountpictures\readme_how_to_unlock.txt
C:\users\public\accountpictures\readme_how_to_unlock.html
C:\users\public\desktop\readme_how_to_unlock.txt
C:\users\public\desktop\readme_how_to_unlock.html
C:\users\public\documents\readme_how_to_unlock.txt
C:\users\public\documents\readme_how_to_unlock.html
C:\users\public\downloads\readme_how_to_unlock.txt
C:\users\public\downloads\readme_how_to_unlock.html
C:\users\public\libraries\readme_how_to_unlock.txt
C:\users\public\libraries\readme_how_to_unlock.html
C:\users\public\music\readme_how_to_unlock.txt
C:\users\public\music\readme_how_to_unlock.html
C:\users\public\pictures\readme_how_to_unlock.txt
C:\users\public\pictures\readme_how_to_unlock.html
C:\users\public\videos\readme_how_to_unlock.txt
C:\users\public\videos\readme_how_to_unlock.html
%HOMEPATH%\.oracle_jre_usage\readme_how_to_unlock.txt
%HOMEPATH%\.oracle_jre_usage\readme_how_to_unlock.html
%HOMEPATH%\3d objects\readme_how_to_unlock.txt
%HOMEPATH%\3d objects\readme_how_to_unlock.html
%HOMEPATH%\appdata\readme_how_to_unlock.txt
%HOMEPATH%\appdata\readme_how_to_unlock.html
%HOMEPATH%\contacts\readme_how_to_unlock.txt
%HOMEPATH%\contacts\readme_how_to_unlock.html
%HOMEPATH%\desktop\readme_how_to_unlock.txt
%HOMEPATH%\desktop\readme_how_to_unlock.html
%HOMEPATH%\documents\readme_how_to_unlock.txt
%HOMEPATH%\documents\readme_how_to_unlock.html
%HOMEPATH%\downloads\readme_how_to_unlock.txt
%HOMEPATH%\downloads\readme_how_to_unlock.html
%HOMEPATH%\favorites\readme_how_to_unlock.txt
%HOMEPATH%\favorites\readme_how_to_unlock.html
%HOMEPATH%\links\readme_how_to_unlock.txt
%HOMEPATH%\links\readme_how_to_unlock.html
%HOMEPATH%\music\readme_how_to_unlock.txt
%HOMEPATH%\music\readme_how_to_unlock.html
%HOMEPATH%\pictures\readme_how_to_unlock.txt
%HOMEPATH%\pictures\readme_how_to_unlock.html
%HOMEPATH%\saved games\readme_how_to_unlock.txt
%HOMEPATH%\saved games\readme_how_to_unlock.html
%HOMEPATH%\searches\readme_how_to_unlock.txt
%HOMEPATH%\searches\readme_how_to_unlock.html
%HOMEPATH%\videos\readme_how_to_unlock.txt
%HOMEPATH%\videos\readme_how_to_unlock.html
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\readme_how_to_unlock.html
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\readme_how_to_unlock.html
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\readme_how_to_unlock.html
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\readme_how_to_unlock.txt
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\readme_how_to_unlock.html
%HOMEPATH%\favorites\links\readme_how_to_unlock.txt
%HOMEPATH%\favorites\links\readme_how_to_unlock.html
%HOMEPATH%\pictures\camera roll\readme_how_to_unlock.txt
%HOMEPATH%\pictures\camera roll\readme_how_to_unlock.html

Modifies the following files

<Drive name for removable media>:\delete.avi
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\applicantform_en.doc
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\cveuropeo.doc

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'<SYSTEM32>\windowspowershell\v1.0\19b140a9.exe'

Executes the following

'%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\services\VSS" /v Start /t REG_DWORD /d 4 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\net1.exe' stop swprv
'%WINDIR%\syswow64\net1.exe' stop vss
'%WINDIR%\syswow64\net1.exe' stop srservice
'%WINDIR%\syswow64\wbem\wmic.exe' shadowcopy delete /nointeractive' (with hidden window)
'%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\services\VSS" /v Start /t REG_DWORD /d 4 /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop vss' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop swprv' (with hidden window)
'%WINDIR%\syswow64\net.exe' stop srservice' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней