Trojan.Encoder.37839

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\how to restore your files.txt
<Drive name for removable media>:\middaugh_keynote.pptx
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\dashborder_120.bmp
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\delete.avi
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\indogerman2010.pptx

Malicious functions

Injects code into

the following system processes:

%WINDIR%\syswow64\cmd.exe

the following user processes:

mfc140u.exe

Terminates or attempts to terminate

the following user processes:

firefox.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\testee.cer
%HOMEPATH%\desktop\sdkfailsafeemulator.cer
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\contoso_1.cer
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\tree_view.htm
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx

Modifies file system

Creates the following files

%APPDATA%\srlazyzpebrujiumwlh\szifjqxnbaplglrnpd
%HOMEPATH%\videos\how to restore your files.txt
%HOMEPATH%\searches\how to restore your files.txt
%HOMEPATH%\saved games\how to restore your files.txt
%HOMEPATH%\pictures\how to restore your files.txt
%HOMEPATH%\onedrive\how to restore your files.txt
%HOMEPATH%\music\how to restore your files.txt
%HOMEPATH%\links\how to restore your files.txt
%HOMEPATH%\favorites\how to restore your files.txt
%HOMEPATH%\downloads\how to restore your files.txt
%HOMEPATH%\documents\how to restore your files.txt
%HOMEPATH%\desktop\how to restore your files.txt
%HOMEPATH%\favorites\links\how to restore your files.txt
%HOMEPATH%\contacts\how to restore your files.txt
%HOMEPATH%\.oracle_jre_usage\how to restore your files.txt
%HOMEPATH%\how to restore your files.txt
C:\users\how to restore your files.txt
C:\recovery\how to restore your files.txt
<Current directory>\how to restore your files.txt
C:\kms\how to restore your files.txt
C:\how to restore your files.txt
D:\how to restore your files.txt
%TEMP%\paublpsavm
%TEMP%\mfc140u.exe
%TEMP%\79d2a065
%HOMEPATH%\3d objects\how to restore your files.txt
%HOMEPATH%\pictures\camera roll\how to restore your files.txt

Modifies the following files

D:\install.log
%HOMEPATH%\3d objects\desktop.ini
%HOMEPATH%\.oracle_jre_usage\90737d32e3aba6b.timestamp
<Drive name for removable media>:\indogerman2010.pptx
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\middaugh_keynote.pptx
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\contoso_1.cer
%HOMEPATH%\contacts\desktop.ini
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\dashborder_120.bmp
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\delete.avi
C:\kms\kms_vl_all_aio_debug.log
C:\users\desktop.ini
<Drive name for removable media>:\dashborder_192.bmp
%HOMEPATH%\desktop\desktop.ini

Modifies multiple files.

Substitutes the following files

%ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows\edb.jtx
%ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows\edbtmp.jtx

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'do#.org':443
'<LOCALNET>.117.160':445
'<LOCALNET>.117.161':445
'<LOCALNET>.117.162':445
'<LOCALNET>.117.163':445
'<LOCALNET>.117.164':445
'<LOCALNET>.117.165':445
'<LOCALNET>.117.166':445
'<LOCALNET>.117.167':445
'<LOCALNET>.117.168':445
'<LOCALNET>.117.169':445
'<LOCALNET>.117.170':445
'<LOCALNET>.117.171':445
'<LOCALNET>.117.172':445
'<LOCALNET>.117.174':445
'<LOCALNET>.117.188':445
'<LOCALNET>.117.175':445
'<LOCALNET>.117.176':445
'<LOCALNET>.117.177':445
'<LOCALNET>.117.178':445
'<LOCALNET>.117.179':445
'<LOCALNET>.117.180':445
'<LOCALNET>.117.181':445
'<LOCALNET>.117.182':445
'<LOCALNET>.117.183':445
'<LOCALNET>.117.184':445
'<LOCALNET>.117.185':445
'<LOCALNET>.117.186':445
'<LOCALNET>.117.187':445
'<LOCALNET>.117.159':445
'<LOCALNET>.117.173':445
'<LOCALNET>.117.158':445
'<LOCALNET>.117.141':445
'<LOCALNET>.117.128':445
'<LOCALNET>.117.129':445
'<LOCALNET>.117.130':445
'<LOCALNET>.117.131':445
'<LOCALNET>.117.132':445
'<LOCALNET>.117.133':445
'<LOCALNET>.117.134':445
'<LOCALNET>.117.135':445
'<LOCALNET>.117.136':445
'<LOCALNET>.117.137':445
'<LOCALNET>.117.138':445
'<LOCALNET>.117.139':445
'<LOCALNET>.117.140':445
'<LOCALNET>.117.142':445
'<LOCALNET>.117.156':445
'<LOCALNET>.117.143':445
'<LOCALNET>.117.144':445
'<LOCALNET>.117.145':445
'<LOCALNET>.117.146':445
'<LOCALNET>.117.147':445
'<LOCALNET>.117.148':445
'<LOCALNET>.117.149':445
'<LOCALNET>.117.150':445
'<LOCALNET>.117.151':445
'<LOCALNET>.117.152':445
'<LOCALNET>.117.153':445
'<LOCALNET>.117.154':445
'<LOCALNET>.117.155':445
'<LOCALNET>.117.157':445
'<LOCALNET>.117.189':445
'<LOCALNET>.117.190':445
'<LOCALNET>.117.191':445
'<LOCALNET>.117.226':445
'<LOCALNET>.117.227':445
'<LOCALNET>.117.228':445
'<LOCALNET>.117.229':445
'<LOCALNET>.117.230':445
'<LOCALNET>.117.231':445
'<LOCALNET>.117.232':445
'<LOCALNET>.117.233':445
'<LOCALNET>.117.234':445
'<LOCALNET>.117.235':445
'<LOCALNET>.117.236':445
'<LOCALNET>.117.237':445
'<LOCALNET>.117.224':445
'<LOCALNET>.117.225':445
'<LOCALNET>.117.238':445
'<LOCALNET>.117.241':445
'<LOCALNET>.117.242':445
'<LOCALNET>.117.243':445
'<LOCALNET>.117.244':445
'<LOCALNET>.117.245':445
'<LOCALNET>.117.246':445
'<LOCALNET>.117.247':445
'<LOCALNET>.117.248':445
'<LOCALNET>.117.249':445
'<LOCALNET>.117.250':445
'<LOCALNET>.117.251':445
'<LOCALNET>.117.252':445
'<LOCALNET>.117.239':445
'<LOCALNET>.117.240':445
'<LOCALNET>.117.223':445
'<LOCALNET>.117.222':445
'<LOCALNET>.117.221':445
'<LOCALNET>.117.193':445
'<LOCALNET>.117.194':445
'<LOCALNET>.117.195':445
'<LOCALNET>.117.196':445
'<LOCALNET>.117.197':445
'<LOCALNET>.117.198':445
'<LOCALNET>.117.199':445
'<LOCALNET>.117.200':445
'<LOCALNET>.117.201':445
'<LOCALNET>.117.202':445
'<LOCALNET>.117.203':445
'<LOCALNET>.117.204':445
'<LOCALNET>.117.205':445
'<LOCALNET>.117.192':445
'<LOCALNET>.117.206':445
'<LOCALNET>.117.208':445
'<LOCALNET>.117.209':445
'<LOCALNET>.117.210':445
'<LOCALNET>.117.211':445
'<LOCALNET>.117.212':445
'<LOCALNET>.117.213':445
'<LOCALNET>.117.214':445
'<LOCALNET>.117.215':445
'<LOCALNET>.117.216':445
'<LOCALNET>.117.217':445
'<LOCALNET>.117.218':445
'<LOCALNET>.117.219':445
'<LOCALNET>.117.220':445
'<LOCALNET>.117.207':445
'<LOCALNET>.117.127':445
'<LOCALNET>.117.253':445
'<LOCALNET>.117.126':445
'<LOCALNET>.117.124':445
'<LOCALNET>.117.31':445
'<LOCALNET>.117.32':445
'<LOCALNET>.117.33':445
'<LOCALNET>.117.34':445
'<LOCALNET>.117.35':445
'<LOCALNET>.117.36':445
'<LOCALNET>.117.37':445
'<LOCALNET>.117.38':445
'<LOCALNET>.117.39':445
'<LOCALNET>.117.40':445
'<LOCALNET>.117.41':445
'<LOCALNET>.117.42':445
'<LOCALNET>.117.43':445
'<LOCALNET>.117.45':445
'<LOCALNET>.117.59':445
'<LOCALNET>.117.46':445
'<LOCALNET>.117.47':445
'<LOCALNET>.117.48':445
'<LOCALNET>.117.49':445
'<LOCALNET>.117.50':445
'<LOCALNET>.117.51':445
'<LOCALNET>.117.52':445
'<LOCALNET>.117.53':445
'<LOCALNET>.117.54':445
'<LOCALNET>.117.55':445
'<LOCALNET>.117.56':445
'<LOCALNET>.117.57':445
'<LOCALNET>.117.58':445
'<LOCALNET>.117.30':445
'<LOCALNET>.117.44':445
'<LOCALNET>.117.29':445
'<LOCALNET>.117.12':445
'i.##b.co':443
'<LOCALNET>.117.0':445
'<LOCALNET>.117.1':445
'<LOCALNET>.117.2':445
'<LOCALNET>.117.3':445
'<LOCALNET>.117.4':445
'<LOCALNET>.117.5':445
'<LOCALNET>.117.6':445
'<LOCALNET>.117.7':445
'<LOCALNET>.117.8':445
'<LOCALNET>.117.9':445
'<LOCALNET>.117.10':445
'<LOCALNET>.117.11':445
'<LOCALNET>.117.13':445
'<LOCALNET>.117.27':445
'<LOCALNET>.117.14':445
'<LOCALNET>.117.15':445
'<LOCALNET>.117.16':445
'<LOCALNET>.117.17':445
'<LOCALNET>.117.18':445
'<LOCALNET>.117.19':445
'<LOCALNET>.117.20':445
'<LOCALNET>.117.21':445
'<LOCALNET>.117.22':445
'<LOCALNET>.117.23':445
'<LOCALNET>.117.24':445
'<LOCALNET>.117.25':445
'<LOCALNET>.117.26':445
'<LOCALNET>.117.28':445
'<LOCALNET>.117.60':445
'<LOCALNET>.117.61':445
'<LOCALNET>.117.62':445
'<LOCALNET>.117.97':445
'<LOCALNET>.117.98':445
'<LOCALNET>.117.99':445
'<LOCALNET>.117.100':445
'<LOCALNET>.117.101':445
'<LOCALNET>.117.102':445
'<LOCALNET>.117.103':445
'<LOCALNET>.117.104':445
'<LOCALNET>.117.105':445
'<LOCALNET>.117.106':445
'<LOCALNET>.117.107':445
'<LOCALNET>.117.108':445
'<LOCALNET>.117.95':445
'<LOCALNET>.117.96':445
'<LOCALNET>.117.109':445
'<LOCALNET>.117.112':445
'<LOCALNET>.117.113':445
'<LOCALNET>.117.114':445
'<LOCALNET>.117.115':445
'<LOCALNET>.117.116':445
'<LOCALNET>.117.117':445
'<LOCALNET>.117.118':445
'<LOCALNET>.117.119':445
'<LOCALNET>.117.120':445
'<LOCALNET>.117.121':445
'<LOCALNET>.117.122':445
'<LOCALNET>.117.123':445
'<LOCALNET>.117.110':445
'<LOCALNET>.117.111':445
'<LOCALNET>.117.94':445
'<LOCALNET>.117.93':445
'<LOCALNET>.117.92':445
'<LOCALNET>.117.64':445
'<LOCALNET>.117.65':445
'<LOCALNET>.117.66':445
'<LOCALNET>.117.67':445
'<LOCALNET>.117.68':445
'<LOCALNET>.117.69':445
'<LOCALNET>.117.70':445
'<LOCALNET>.117.71':445
'<LOCALNET>.117.72':445
'<LOCALNET>.117.73':445
'<LOCALNET>.117.74':445
'<LOCALNET>.117.75':445
'<LOCALNET>.117.76':445
'<LOCALNET>.117.63':445
'<LOCALNET>.117.77':445
'<LOCALNET>.117.79':445
'<LOCALNET>.117.80':445
'<LOCALNET>.117.81':445
'<LOCALNET>.117.82':445
'<LOCALNET>.117.83':445
'<LOCALNET>.117.84':445
'<LOCALNET>.117.85':445
'<LOCALNET>.117.86':445
'<LOCALNET>.117.87':445
'<LOCALNET>.117.88':445
'<LOCALNET>.117.89':445
'<LOCALNET>.117.90':445
'<LOCALNET>.117.91':445
'<LOCALNET>.117.78':445
'<LOCALNET>.117.125':445
'<LOCALNET>.117.254':445

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB039D4329A5E8.crt?bb##############

Other

'do#.org':443
'i.##b.co':443

UDP

DNS ASK do#.org
DNS ASK i.##b.co

Miscellaneous

Creates and executes the following

'%TEMP%\mfc140u.exe'

Executes the following

'%WINDIR%\syswow64\cmd.exe'
'<SYSTEM32>\searchprotocolhost.exe' Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "%...
'<SYSTEM32>\searchfilterhost.exe' 0 764 772 780 8192 776
'<SYSTEM32>\svchost.exe' -k wsappx -p

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial