Trojan.Encoder.42501

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\1189.jpeg.busy
<Drive name for removable media>:\000814251_video_01.avi.busy
<Drive name for removable media>:\1189.jpeg
<Drive name for removable media>:\13.jpeg.busy
<Drive name for removable media>:\13.jpeg
<Drive name for removable media>:\1sm_price.zip.busy
<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\20140114.rdf.busy
<Drive name for removable media>:\20140114.rdf
<Drive name for removable media>:\1sm_price.zip
<Drive name for removable media>:\210252809.jpg
<Drive name for removable media>:\3.jpeg
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\51.mp4
<Drive name for removable media>:\64bit_notes.htm
<Drive name for removable media>:\babyboymaintoscenesbackground_pal.wmv
<Drive name for removable media>:\cleanlyrics.png
<Drive name for removable media>:\clip_480_5sec_6mbps_h264.mp4
<Drive name for removable media>:\dissolveanother.png
<Drive name for removable media>:\irgeek.pem
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
<Drive name for removable media>:\military_callsigns_0311.rtf
<Drive name for removable media>:\ppswamp.ppt
<Drive name for removable media>:\passport_pal.wmv
<Drive name for removable media>:\roozenedowebinar.pptx
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\static_electricity_easy_and_quick_activities.rtf
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\tunpersonalca1.pem
<Drive name for removable media>:\waterlandhealthkano.rtf
<Drive name for removable media>:\accountsreceivable.ppt
<Drive name for removable media>:\advice_process.htm
<Drive name for removable media>:\adadsi.html
<Drive name for removable media>:\al.xlsx
<Drive name for removable media>:\alert.htm
<Drive name for removable media>:\alert.html
<Drive name for removable media>:\aoc_saq_d_v3_merchant.docx
<Drive name for removable media>:\api-hashmap.html
<Drive name for removable media>:\applicant.xlsx
<Drive name for removable media>:\archer.avi
<Drive name for removable media>:\bc01.pdf
<Drive name for removable media>:\calculatorworksheet.xls
<Drive name for removable media>:\cbz.png
<Drive name for removable media>:\contractualdeadlines.zip
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\dag2_panel1_320_ref.mov
<Drive name for removable media>:\dashborder_120.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\digest.rdf
<Drive name for removable media>:\dualectls.pdf
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\fiche_inscription_2015.xls
<Drive name for removable media>:\fiche_inscription_2015.zip
<Drive name for removable media>:\fil_20060629111052.pdf
<Drive name for removable media>:\file_p_00000000_1371597592.docx
<Drive name for removable media>:\firefly1.mov
<Drive name for removable media>:\flower_trans_matte.wmv
<Drive name for removable media>:\foaf.rdf
<Drive name for removable media>:\glidescope_review_rev_010.docx
<Drive name for removable media>:\guide_reorganization_mapping.xls
<Drive name for removable media>:\hadac_newsletter_july_2010_final.docx
<Drive name for removable media>:\holycrosschurchinstructions.docx
<Drive name for removable media>:\iisstart.htm
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\iisstart.html
<Drive name for removable media>:\issi2013_template_for_posters.docx
<Drive name for removable media>:\middaugh_keynote.pptx
<Drive name for removable media>:\national_autism_preparation_programs.xlsx
<Drive name for removable media>:\nwfieldnotes1966.docx
<Drive name for removable media>:\ovp25012015.doc
<Drive name for removable media>:\pandp.rtf
<Drive name for removable media>:\parnas_01.jpg
<Drive name for removable media>:\phytoremediation.rtf
<Drive name for removable media>:\price.zip
<Drive name for removable media>:\price030215.xls
<Drive name for removable media>:\price030215.zip
<Drive name for removable media>:\productos.xls
<Drive name for removable media>:\pushkin.jpeg
<Drive name for removable media>:\region-north-karelia.jpg
<Drive name for removable media>:\router_manual.rtf
<Drive name for removable media>:\sacs_presentation_sacs_qep_improving_rt_education_final.ppt
<Drive name for removable media>:\sdszfo.docx
<Drive name for removable media>:\suspendedcompanies.xlsx
<Drive name for removable media>:\testwmv.wmv
<Drive name for removable media>:\how_return_your_data.txt
<Drive name for removable media>:\trtf_matrix2012_oct.xlsx
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\weeklysheet1215.doc

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\1189.jpeg
%HOMEPATH%\desktop\168.jpg
%HOMEPATH%\desktop\3.jpg
%HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
%HOMEPATH%\desktop\64bit_notes.htm
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\adadsi.html
%HOMEPATH%\desktop\alert.html
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\pushkin.jpg
%HOMEPATH%\desktop\region-north-karelia.jpeg
%HOMEPATH%\desktop\region-north-karelia.jpg
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\weeklysheet1215.doc

Modifies file system

Creates the following files

D:\how_return_your_data.txt
C:\users\default\desktop\how_return_your_data.txt
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\winre.wim.busy
C:\users\default\documents\how_return_your_data.txt
C:\users\public\desktop\how_return_your_data.txt
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\boot.sdi.busy
C:\users\public\documents\how_return_your_data.txt
C:\users\public\music\sample music\kalimba.mp3.busy
C:\users\public\music\sample music\maid with the flaxen hair.mp3.busy
C:\users\public\music\sample music\sleep away.mp3.busy
C:\users\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv.busy
%HOMEPATH%\desktop\how_return_your_data.txt
%HOMEPATH%\contacts\user.contact.busy
%HOMEPATH%\documents\how_return_your_data.txt
C:\how_return_your_data.txt

Deletes the following files

<Drive name for removable media>:\1189.jpeg.busy
<Drive name for removable media>:\13.jpeg.busy
<Drive name for removable media>:\000814251_video_01.avi.busy
<Drive name for removable media>:\20140114.rdf.busy
<Drive name for removable media>:\1sm_price.zip.busy
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\boot.sdi.busy
<Drive name for removable media>:\210252809.jpg.busy
<Drive name for removable media>:\3.jpeg.busy
C:\users\public\music\sample music\kalimba.mp3.busy
<Drive name for removable media>:\508softwareandos.doc.busy
C:\users\public\music\sample music\maid with the flaxen hair.mp3.busy
<Drive name for removable media>:\51.mp4.busy
C:\users\public\music\sample music\sleep away.mp3.busy
<Drive name for removable media>:\64bit_notes.htm.busy
C:\users\public\pictures\sample pictures\chrysanthemum.jpg.busy
<Drive name for removable media>:\babyboymaintoscenesbackground_pal.wmv.busy
C:\users\public\pictures\sample pictures\desert.jpg.busy
<Drive name for removable media>:\cleanlyrics.png.busy
C:\users\public\pictures\sample pictures\hydrangeas.jpg.busy
<Drive name for removable media>:\clip_480_5sec_6mbps_h264.mp4.busy
C:\users\public\pictures\sample pictures\jellyfish.jpg.busy
<Drive name for removable media>:\dissolveanother.png.busy
C:\users\public\pictures\sample pictures\koala.jpg.busy
<Drive name for removable media>:\irgeek.pem.busy
C:\users\public\pictures\sample pictures\lighthouse.jpg.busy
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx.busy
C:\users\public\pictures\sample pictures\penguins.jpg.busy
<Drive name for removable media>:\military_callsigns_0311.rtf.busy
C:\users\public\pictures\sample pictures\tulips.jpg.busy
<Drive name for removable media>:\ppswamp.ppt.busy
C:\users\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv.busy
<Drive name for removable media>:\passport_pal.wmv.busy
C:\users\public\videos\sample videos\wildlife.wmv.busy
<Drive name for removable media>:\roozenedowebinar.pptx.busy
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\winre.wim.busy
%HOMEPATH%\contacts\user.contact.busy
<Drive name for removable media>:\sdkfailsafeemulator.cer.busy
%HOMEPATH%\desktop\1189.jpeg.busy
<Drive name for removable media>:\static_electricity_easy_and_quick_activities.rtf.busy
%HOMEPATH%\desktop\168.jpg.busy
<Drive name for removable media>:\testcertificate.cer.busy
<Drive name for removable media>:\tunpersonalca1.pem.busy
%HOMEPATH%\desktop\3.jpg.busy
%HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.busy
<Drive name for removable media>:\waterlandhealthkano.rtf.busy
%HOMEPATH%\desktop\64bit_notes.htm.busy
%HOMEPATH%\desktop\testcertificate.cer.busy
<Drive name for removable media>:\accountsreceivable.ppt.busy
<Drive name for removable media>:\advice_process.htm.busy
<Drive name for removable media>:\adadsi.html.busy
%HOMEPATH%\desktop\about.html.busy
%HOMEPATH%\desktop\adadsi.html.busy
<Drive name for removable media>:\al.xlsx.busy
<Drive name for removable media>:\alert.htm.busy
%HOMEPATH%\desktop\alert.html.busy
<Drive name for removable media>:\alert.html.busy
%HOMEPATH%\desktop\api-hashmap.html.busy
%HOMEPATH%\desktop\archer.avi.busy
<Drive name for removable media>:\aoc_saq_d_v3_merchant.docx.busy
<Drive name for removable media>:\api-hashmap.html.busy
%HOMEPATH%\desktop\cveuropeo.doc.busy
<Drive name for removable media>:\applicant.xlsx.busy
%HOMEPATH%\desktop\dashborder_120.bmp.busy
%HOMEPATH%\desktop\dashborder_144.bmp.busy
<Drive name for removable media>:\archer.avi.busy
<Drive name for removable media>:\bc01.pdf.busy
%HOMEPATH%\desktop\delete.avi.busy
<Drive name for removable media>:\calculatorworksheet.xls.busy
%HOMEPATH%\desktop\dial.bmp.busy
<Drive name for removable media>:\cbz.png.busy
<Drive name for removable media>:\contractualdeadlines.zip.busy
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx.busy
<Drive name for removable media>:\correct.avi.busy
%HOMEPATH%\desktop\holycrosschurchinstructions.docx.busy
%HOMEPATH%\desktop\issi2013_template_for_posters.docx.busy
<Drive name for removable media>:\dag2_panel1_320_ref.mov.busy
%HOMEPATH%\desktop\lisp_success.doc.busy
<Drive name for removable media>:\dashborder_120.bmp.busy
<Drive name for removable media>:\dashborder_144.bmp.busy
%HOMEPATH%\desktop\nwfieldnotes1966.docx.busy
%HOMEPATH%\desktop\pushkin.jpg.busy
<Drive name for removable media>:\dashborder_96.bmp.busy
%HOMEPATH%\desktop\region-north-karelia.jpeg.busy
<Drive name for removable media>:\digest.rdf.busy
%HOMEPATH%\desktop\region-north-karelia.jpg.busy
<Drive name for removable media>:\dualectls.pdf.busy
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx.busy
<Drive name for removable media>:\fi51.doc.busy
%HOMEPATH%\desktop\weeklysheet1215.doc.busy
<Drive name for removable media>:\fiche_inscription_2015.xls.busy
<Drive name for removable media>:\fiche_inscription_2015.zip.busy
<Drive name for removable media>:\fil_20060629111052.pdf.busy
<Drive name for removable media>:\file_p_00000000_1371597592.docx.busy
<Drive name for removable media>:\firefly1.mov.busy
<Drive name for removable media>:\flower_trans_matte.wmv.busy
<Drive name for removable media>:\foaf.rdf.busy
<Drive name for removable media>:\glidescope_review_rev_010.docx.busy
<Drive name for removable media>:\guide_reorganization_mapping.xls.busy
<Drive name for removable media>:\hadac_newsletter_july_2010_final.docx.busy
<Drive name for removable media>:\holycrosschurchinstructions.docx.busy
<Drive name for removable media>:\iisstart.htm.busy
<Drive name for removable media>:\hypothyroidism_slides.pptx.busy
<Drive name for removable media>:\iisstart.html.busy
<Drive name for removable media>:\issi2013_template_for_posters.docx.busy
<Drive name for removable media>:\middaugh_keynote.pptx.busy
<Drive name for removable media>:\national_autism_preparation_programs.xlsx.busy
<Drive name for removable media>:\nwfieldnotes1966.docx.busy
<Drive name for removable media>:\ovp25012015.doc.busy
<Drive name for removable media>:\pandp.rtf.busy
<Drive name for removable media>:\parnas_01.jpg.busy
<Drive name for removable media>:\phytoremediation.rtf.busy
<Drive name for removable media>:\price.zip.busy
<Drive name for removable media>:\price030215.xls.busy
<Drive name for removable media>:\price030215.zip.busy
<Drive name for removable media>:\productos.xls.busy
<Drive name for removable media>:\pushkin.jpeg.busy
<Drive name for removable media>:\region-north-karelia.jpg.busy
<Drive name for removable media>:\router_manual.rtf.busy
<Drive name for removable media>:\sacs_presentation_sacs_qep_improving_rt_education_final.ppt.busy
<Drive name for removable media>:\sdszfo.docx.busy
<Drive name for removable media>:\suspendedcompanies.xlsx.busy
<Drive name for removable media>:\testwmv.wmv.busy
<Drive name for removable media>:\trtf_matrix2012_oct.xlsx.busy
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc.busy
<Drive name for removable media>:\weeklysheet1215.doc.busy

Modifies the following files

<Drive name for removable media>:\1189.jpeg
<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\13.jpeg
<Drive name for removable media>:\20140114.rdf
<Drive name for removable media>:\1sm_price.zip
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\winre.wim
C:\recovery\4d53d3aa-5835-11ef-baad-8f07b80b2fb5\boot.sdi
C:\users\public\music\sample music\kalimba.mp3
C:\users\public\music\sample music\maid with the flaxen hair.mp3
C:\users\public\music\sample music\sleep away.mp3
C:\users\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv
%HOMEPATH%\contacts\user.contact

Deletes itself.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Executes the following

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$f='<Full path to file>';while(Test-Path -Path $f){$o=new-object byte[] 10485760;(new-object Random).NextBytes($o);[IO.File]::WriteAllBytes($f,$o);Remove-Item -Path $f;Sleep 1;}"

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial