Trojan.Encoder.31461

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1' = '"%WINDIR%\SysWOW64\cmd.exe"'

Changes the following executable system files

%WINDIR%\syswow64\ac3acm.acm
%WINDIR%\syswow64\en-us\dfshim.dll.mui
%WINDIR%\syswow64\flashplayercplapp.cpl

Creates the following files on removable media

<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\dashborder_120.bmp
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\testee.cer

Malicious functions

Injects code into

the following system processes:

%WINDIR%\syswow64\cmd.exe

Modifies file system

Moves the following system files

from %WINDIR%\syswow64\ac3acm.acm to %WINDIR%\syswow64\ac3acm.acm.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\macromed\flash\mms.cfg to %WINDIR%\syswow64\macromed\flash\mms.cfg.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\macromed\flash\plugin.vch to %WINDIR%\syswow64\macromed\flash\plugin.vch.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\mapisvc.inf to %WINDIR%\syswow64\mapisvc.inf.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\msvcr71.pdb to %WINDIR%\syswow64\msvcr71.pdb.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\msvcr71d.pdb to %WINDIR%\syswow64\msvcr71d.pdb.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\noise.chs to %WINDIR%\syswow64\noise.chs.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\noise.cht to %WINDIR%\syswow64\noise.cht.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\desktop.ini to %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\desktop.ini.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\noise.dat to %WINDIR%\syswow64\noise.dat.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\noise.tha to %WINDIR%\syswow64\noise.tha.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\perfstringbackup.ini to %WINDIR%\syswow64\perfstringbackup.ini.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\recovery\reagent.xml to %WINDIR%\syswow64\recovery\reagent.xml.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\ticrf.rat to %WINDIR%\syswow64\ticrf.rat.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\wbem\servicemodel.mof to %WINDIR%\syswow64\wbem\servicemodel.mof.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\wbem\servicemodel.mof.uninstall to %WINDIR%\syswow64\wbem\servicemodel.mof.uninstall.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\windowspowershell\v1.0\examples\profile.ps1 to %WINDIR%\syswow64\windowspowershell\v1.0\examples\profile.ps1.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\macromed\flash\flashinstall.log to %WINDIR%\syswow64\macromed\flash\flashinstall.log.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\macromed\flash\flashplayer.xpt to %WINDIR%\syswow64\macromed\flash\flashplayer.xpt.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\macromed\flash\activex.vch to %WINDIR%\syswow64\macromed\flash\activex.vch.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\license.rtf to %WINDIR%\syswow64\license.rtf.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\korwbrkr.lex to %WINDIR%\syswow64\korwbrkr.lex.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\desktop.ini to %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\desktop.ini.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\index.dat to %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\index.dat.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0ps72r2m\desktop.ini to %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0ps72r2m\desktop.ini.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\62axopq5\desktop.ini to %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\62axopq5\desktop.ini.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\desktop.ini to %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\desktop.ini.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\fzg8ckj5\desktop.ini to %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\fzg8ckj5\desktop.ini.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\index.dat to %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\index.dat.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\windowspowershell\v1.0\modules\psdiagnostics\psdiagnostics.psd1 to %WINDIR%\syswow64\windowspowershell\v1.0\modules\psdiagnostics\psdiagnostics.psd1.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\noise.kor to %WINDIR%\syswow64\noise.kor.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\lixmvqoa\desktop.ini to %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\lixmvqoa\desktop.ini.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\7b2238aaccedc3f1ffe8e7eb5f575ec9 to %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\7b2238aaccedc3f1ffe8e7eb5f575ec9.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015 to %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\index.dat to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\index.dat.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\dssec.dat to %WINDIR%\syswow64\dssec.dat.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\en-us\dfshim.dll.mui to %WINDIR%\syswow64\en-us\dfshim.dll.mui.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\flashplayercplapp.cpl to %WINDIR%\syswow64\flashplayercplapp.cpl.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\icrav03.rat to %WINDIR%\syswow64\icrav03.rat.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\desktop.ini to %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\desktop.ini.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\7b2238aaccedc3f1ffe8e7eb5f575ec9 to %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\7b2238aaccedc3f1ffe8e7eb5f575ec9.[5fc0aef7].[admcphel@protonmail.ch].makop
from %WINDIR%\syswow64\windowspowershell\v1.0\modules\psdiagnostics\psdiagnostics.psm1 to %WINDIR%\syswow64\windowspowershell\v1.0\modules\psdiagnostics\psdiagnostics.psm1.[5fc0aef7].[admcphel@protonmail.ch].makop

Modifies user data files (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' ' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe'
'%WINDIR%\syswow64\cmd.exe' n2844
'<SYSTEM32>\cmd.exe'

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial