Trojan.Encoder.37307

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\readme.txt

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\sdkfailsafeemulator.cer
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\weeklysheet1215.doc

Modifies file system

Creates the following files

C:\readme.txt
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\readme.txt
%ALLUSERSPROFILE%\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\readme.txt
%ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\readme.txt
%ALLUSERSPROFILE%\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\readme.txt
%ALLUSERSPROFILE%\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\readme.txt
%ALLUSERSPROFILE%\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\readme.txt
%ALLUSERSPROFILE%\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\readme.txt
%ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\readme.txt
%ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\readme.txt
%ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\readme.txt
%ALLUSERSPROFILE%\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\readme.txt
%ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\readme.txt
%ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\readme.txt
%ALLUSERSPROFILE%\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\readme.txt
%ALLUSERSPROFILE%\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\readme.txt
%ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeadditional_amd64\readme.txt
%ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\readme.txt
C:\users\default\application data\readme.txt
C:\users\default\readme.txt
%ALLUSERSPROFILE%\templates\readme.txt
%ALLUSERSPROFILE%\sun\java\java update\readme.txt
%ALLUSERSPROFILE%\sun\java\readme.txt
%ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\readme.txt
%ALLUSERSPROFILE%\sun\readme.txt
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\readme.txt
%ALLUSERSPROFILE%\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\readme.txt
%ALLUSERSPROFILE%\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\readme.txt
%ALLUSERSPROFILE%\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\readme.txt
%ALLUSERSPROFILE%\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\readme.txt
%ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\readme.txt
%ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\readme.txt
%ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\vcruntimeminimum_amd64\readme.txt
%ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\readme.txt
C:\users\default\desktop\readme.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\readme.txt
%ALLUSERSPROFILE%\microsoft\rac\readme.txt
%ALLUSERSPROFILE%\microsoft\rac\outbound\readme.txt
%ALLUSERSPROFILE%\microsoft\rac\publisheddata\readme.txt
%ALLUSERSPROFILE%\microsoft\rac\statedata\readme.txt
%ALLUSERSPROFILE%\microsoft\rac\temp\readme.txt
%ALLUSERSPROFILE%\microsoft\search\readme.txt
%ALLUSERSPROFILE%\microsoft\search\data\readme.txt
%ALLUSERSPROFILE%\microsoft\search\data\applications\readme.txt
%ALLUSERSPROFILE%\microsoft\search\data\temp\readme.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\readme.txt
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\readme.txt
%ALLUSERSPROFILE%\microsoft\vault\readme.txt
%ALLUSERSPROFILE%\microsoft\wpd\readme.txt
%ALLUSERSPROFILE%\microsoft\wwansvc\readme.txt
%ALLUSERSPROFILE%\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\readme.txt
%ALLUSERSPROFILE%\oracle\java\installcache_x64\readme.txt
%ALLUSERSPROFILE%\oracle\java\javapath\readme.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\readme.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\readme.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\readme.txt
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\readme.txt
%ALLUSERSPROFILE%\package cache\readme.txt
%ALLUSERSPROFILE%\start menu\readme.txt
C:\users\default\cookies\readme.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\3082\readme.txt
%ALLUSERSPROFILE%\oracle\readme.txt
%ALLUSERSPROFILE%\mozilla\logs\readme.txt
%ALLUSERSPROFILE%\mozilla\readme.txt
%ALLUSERSPROFILE%\microsoft toolkit\readme.txt
%ALLUSERSPROFILE%\microsoft help\readme.txt
%ALLUSERSPROFILE%\oracle\java\readme.txt
%ALLUSERSPROFILE%\microsoft\dbgclr\readme.txt
C:\users\default\documents\readme.txt
%HOMEPATH%\readme.txt
%HOMEPATH%\application data\readme.txt
%HOMEPATH%\contacts\readme.txt
%HOMEPATH%\cookies\readme.txt
%HOMEPATH%\desktop\readme.txt
%HOMEPATH%\documents\readme.txt
%HOMEPATH%\documents\my music\readme.txt
%HOMEPATH%\documents\my pictures\readme.txt
%HOMEPATH%\documents\my videos\readme.txt
%HOMEPATH%\downloads\readme.txt
%HOMEPATH%\favorites\readme.txt
%HOMEPATH%\favorites\links\readme.txt
%HOMEPATH%\favorites\links for united states\readme.txt
%HOMEPATH%\favorites\microsoft websites\readme.txt
%HOMEPATH%\favorites\msn websites\readme.txt
%HOMEPATH%\links\readme.txt
%HOMEPATH%\local settings\readme.txt
D:\readme.txt
%HOMEPATH%\voip\readme.txt
%HOMEPATH%\videos\readme.txt
%HOMEPATH%\templates\readme.txt
%HOMEPATH%\start menu\readme.txt
%HOMEPATH%\sendto\readme.txt
C:\users\public\videos\sample videos\readme.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\1036\readme.txt
%HOMEPATH%\recent\readme.txt
%HOMEPATH%\printhood\readme.txt
%HOMEPATH%\pictures\readme.txt
%HOMEPATH%\nethood\readme.txt
%HOMEPATH%\my documents\readme.txt
%HOMEPATH%\music\readme.txt
%HOMEPATH%\saved games\readme.txt
C:\users\public\videos\readme.txt
%ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\readme.txt
C:\users\public\recorded tv\readme.txt
C:\users\public\downloads\readme.txt
C:\users\default\documents\my videos\readme.txt
C:\users\default\downloads\readme.txt
C:\users\default\favorites\readme.txt
C:\users\default\links\readme.txt
C:\users\default\local settings\readme.txt
C:\users\default\music\readme.txt
C:\users\default\my documents\readme.txt
C:\users\default\nethood\readme.txt
C:\users\default\pictures\readme.txt
C:\users\default\printhood\readme.txt
C:\users\default\recent\readme.txt
C:\users\default\saved games\readme.txt
C:\users\default\sendto\readme.txt
C:\users\default\start menu\readme.txt
C:\users\default\templates\readme.txt
C:\users\default\videos\readme.txt
C:\users\public\pictures\sample pictures\readme.txt
C:\users\public\pictures\readme.txt
C:\users\public\music\sample music\readme.txt
C:\users\public\music\readme.txt
C:\users\public\libraries\readme.txt
C:\users\public\favorites\readme.txt
C:\users\public\recorded tv\sample media\readme.txt
C:\users\default\documents\my music\readme.txt
C:\users\public\documents\my pictures\readme.txt
C:\users\public\documents\my music\readme.txt
C:\users\public\documents\readme.txt
C:\users\public\desktop\readme.txt
C:\users\public\readme.txt
C:\users\default user\readme.txt
C:\users\public\documents\my videos\readme.txt
C:\users\default\documents\my pictures\readme.txt
%ALLUSERSPROFILE%\microsoft\office\uicaptions\readme.txt
%ALLUSERSPROFILE%\microsoft\office\readme.txt
%ALLUSERSPROFILE%\microsoft\network\downloader\readme.txt
C:\far2\pluginsdk\headers.c\readme.txt
C:\far2\pluginsdk\headers.pas\readme.txt
<Current directory>\readme.txt
C:\msocache\readme.txt
C:\msocache\all users\readme.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\readme.txt
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\readme.txt
C:\totalcmd\language\readme.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\readme.txt
C:\totalcmd\readme.txt
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\readme.txt
C:\recovery\readme.txt
C:\perflogs\admin\readme.txt
C:\perflogs\readme.txt
C:\far2\pluginsdk\readme.txt
C:\far2\plugins\proclist\readme.txt
C:\far2\plugins\compare\readme.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\readme.txt
D:\$recycle.bin\readme.txt
C:\users\readme.txt
C:\far2\plugins\hlfviewer\readme.txt
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\readme.txt
C:\documents and settings\readme.txt
C:\far2\readme.txt
C:\far2\addons\colors\readme.txt
C:\far2\addons\colors\custom_highlighting\readme.txt
C:\far2\addons\colors\default_highlighting\readme.txt
C:\far2\addons\macros\readme.txt
C:\far2\addons\setup\readme.txt
C:\far2\addons\shell\readme.txt
C:\far2\addons\xlat\readme.txt
C:\far2\addons\xlat\russian\readme.txt
C:\far2\documentation\readme.txt
C:\far2\documentation\eng\readme.txt
C:\far2\documentation\rus\readme.txt
C:\$recycle.bin\readme.txt
C:\far2\encyclopedia\readme.txt
C:\far2\plugins\ftp\lib\readme.txt
C:\far2\encyclopedia\tap\readme.txt
C:\far2\fexcept\readme.txt
C:\far2\plugins\readme.txt
C:\far2\plugins\align\readme.txt
C:\far2\plugins\arclite\readme.txt
C:\far2\plugins\autowrap\readme.txt
C:\far2\plugins\network\readme.txt
C:\far2\plugins\brackets\readme.txt
C:\far2\plugins\macroview\readme.txt
C:\far2\plugins\editcase\readme.txt
C:\far2\plugins\emenu\readme.txt
C:\far2\plugins\farcmds\readme.txt
C:\far2\plugins\filecase\readme.txt
C:\far2\plugins\ftp\readme.txt
C:\far2\plugins\drawline\readme.txt
%HOMEPATH%\searches\readme.txt
%ALLUSERSPROFILE%\readme.txt
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\readme.txt
%ALLUSERSPROFILE%\microsoft\drm\readme.txt
%ALLUSERSPROFILE%\microsoft\drm\server\readme.txt
%ALLUSERSPROFILE%\microsoft\ehome\readme.txt
%ALLUSERSPROFILE%\microsoft\ehome\logs\readme.txt
%ALLUSERSPROFILE%\microsoft\event viewer\readme.txt
%ALLUSERSPROFILE%\microsoft\event viewer\views\readme.txt
%ALLUSERSPROFILE%\microsoft\event viewer\views\applicationviewsrootnode\readme.txt
%ALLUSERSPROFILE%\microsoft\identitycrl\readme.txt
%ALLUSERSPROFILE%\microsoft\ilscache\readme.txt
%ALLUSERSPROFILE%\microsoft\media player\readme.txt
%ALLUSERSPROFILE%\microsoft\mf\readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1028\readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1031\readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1033\readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1036\readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\readme.txt
%ALLUSERSPROFILE%\microsoft\network\connections\readme.txt
%ALLUSERSPROFILE%\microsoft\network\readme.txt
%ALLUSERSPROFILE%\microsoft\netframework\breadcrumbstore\readme.txt
%ALLUSERSPROFILE%\microsoft\netframework\readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\8.0\readme.txt
%ALLUSERSPROFILE%\microsoft\devicesync\readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\3082\readme.txt
%ALLUSERSPROFILE%\adobe\readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1049\readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1046\readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1042\readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1041\readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1040\readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\2052\readme.txt
%ALLUSERSPROFILE%\adobe\arm\readme.txt
%ALLUSERSPROFILE%\microsoft\msdn\7.0\1050\readme.txt
C:\far2\plugins\tmppanel\readme.txt
%ALLUSERSPROFILE%\adobe\arm\reader_15.008.20082\readme.txt
%ALLUSERSPROFILE%\adobe\arm\s\readme.txt
%ALLUSERSPROFILE%\adobe\arm\s\10428\readme.txt
%ALLUSERSPROFILE%\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\readme.txt
%ALLUSERSPROFILE%\adobe\setup\readme.txt
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\readme.txt
%ALLUSERSPROFILE%\application data\readme.txt
%ALLUSERSPROFILE%\desktop\readme.txt
%ALLUSERSPROFILE%\documents\readme.txt
%ALLUSERSPROFILE%\favorites\readme.txt
%ALLUSERSPROFILE%\microsoft\readme.txt
%ALLUSERSPROFILE%\microsoft\assistance\readme.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\readme.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\readme.txt
%ALLUSERSPROFILE%\microsoft\assistance\client\1.0\en-us\readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\device\readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\readme.txt
%ALLUSERSPROFILE%\microsoft\dbgclr\7.1\1033\readme.txt
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\rsa\readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\keys\readme.txt
%ALLUSERSPROFILE%\microsoft\crypto\dss\machinekeys\readme.txt
%ALLUSERSPROFILE%\microsoft\dbgclr\7.1\readme.txt
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\readme.txt

Modifies the following files

C:\far2\addons\readme.txt
C:\far2\addons\colors\default_highlighting\import_colors.bat
C:\far2\addons\colors\default_highlighting\hell.reg
C:\far2\addons\colors\default_highlighting\greenmile.reg
C:\far2\addons\colors\default_highlighting\farcolors242.reg
C:\far2\addons\colors\default_highlighting\descript.ion
C:\far2\addons\colors\default_highlighting\colors_from_sadovoj.reg
C:\far2\addons\colors\default_highlighting\colors_from_gernichenko.reg
C:\far2\addons\colors\default_highlighting\dn_like.reg
C:\far2\addons\colors\default_highlighting\colors_from_admin_essp_ru.reg
C:\far2\addons\colors\default_highlighting\black_from_july.reg
C:\far2\addons\colors\default_highlighting\black_from_fonarev.reg
C:\far2\addons\colors\default_highlighting\black_from_myodov.reg
C:\far2\addons\colors\custom_highlighting\nc5pal2.reg
C:\far2\addons\colors\custom_highlighting\vaxcolors.reg
C:\far2\addons\colors\custom_highlighting\rodion_doroshkevich.reg
C:\far2\addons\colors\custom_highlighting\import_colors.bat
C:\far2\addons\colors\custom_highlighting\hell.reg
C:\far2\addons\colors\custom_highlighting\farcolors242.reg
C:\far2\addons\colors\custom_highlighting\dn_like.reg
C:\far2\addons\colors\custom_highlighting\greenmile.reg
C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg
C:\far2\addons\colors\custom_highlighting\descript.ion
C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg
C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg
C:\far2\addons\colors\custom_highlighting\black_from_july.reg
C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg
C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg
C:\far2\addons\colors\default_highlighting\nc5pal2.reg
C:\far2\addons\colors\default_highlighting\rodion_doroshkevich.reg

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial