Trojan.Encoder.37735

Technical Information

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\testee.cer
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\sdkfailsafeemulator.cer
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\ituneshelpunavailable.htm
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\tree_view.htm
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc

Modifies file system

Creates the following files

C:\kms\your_files_are_encrypted.txt
C:\users\default\pictures\your_files_are_encrypted.txt
C:\users\default\saved games\your_files_are_encrypted.txt
C:\users\default\videos\your_files_are_encrypted.txt
C:\users\public\accountpictures\your_files_are_encrypted.txt
C:\users\public\desktop\your_files_are_encrypted.txt
C:\users\public\documents\your_files_are_encrypted.txt
C:\users\public\downloads\your_files_are_encrypted.txt
C:\users\public\libraries\your_files_are_encrypted.txt
C:\users\public\music\your_files_are_encrypted.txt
C:\users\public\pictures\your_files_are_encrypted.txt
C:\users\public\videos\your_files_are_encrypted.txt
%HOMEPATH%\.oracle_jre_usage\your_files_are_encrypted.txt
%HOMEPATH%\3d objects\your_files_are_encrypted.txt
%HOMEPATH%\contacts\your_files_are_encrypted.txt
%HOMEPATH%\desktop\your_files_are_encrypted.txt
%HOMEPATH%\documents\your_files_are_encrypted.txt
%HOMEPATH%\downloads\your_files_are_encrypted.txt
%HOMEPATH%\favorites\your_files_are_encrypted.txt
%HOMEPATH%\links\your_files_are_encrypted.txt
%HOMEPATH%\music\your_files_are_encrypted.txt
%HOMEPATH%\onedrive\your_files_are_encrypted.txt
%HOMEPATH%\pictures\your_files_are_encrypted.txt
%HOMEPATH%\saved games\your_files_are_encrypted.txt
%HOMEPATH%\searches\your_files_are_encrypted.txt
%HOMEPATH%\videos\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\your_files_are_encrypted.txt
C:\users\default\music\your_files_are_encrypted.txt
%HOMEPATH%\favorites\links\your_files_are_encrypted.txt
C:\users\default\links\your_files_are_encrypted.txt
C:\users\default\downloads\your_files_are_encrypted.txt
C:\msocache\your_files_are_encrypted.txt
C:\perflogs\your_files_are_encrypted.txt
C:\recovery\your_files_are_encrypted.txt
<Current directory>\your_files_are_encrypted.txt
C:\users\your_files_are_encrypted.txt
C:\msocache\all users\your_files_are_encrypted.txt
C:\recovery\windowsre\your_files_are_encrypted.txt
C:\users\default\your_files_are_encrypted.txt
C:\users\public\your_files_are_encrypted.txt
%HOMEPATH%\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\your_files_are_encrypted.txt
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\your_files_are_encrypted.txt
C:\users\default\desktop\your_files_are_encrypted.txt
C:\users\default\documents\your_files_are_encrypted.txt
C:\users\default\favorites\your_files_are_encrypted.txt
%HOMEPATH%\pictures\camera roll\your_files_are_encrypted.txt

Modifies the following files

C:\kms\kms_vl_all_aio_debug.log
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlookmui.msi
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publishermui.msi
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\publishermui.xml
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.xml
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\powerpointmui.msi
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.xml
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\excelmui.msi
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\setup.xml
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.xml
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\outlookmui.xml
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\proplusww.msi
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.xml
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\office64ww.msi
C:\users\default\ntuser.dat{fd9a35db-49fe-11e9-aa2c-248a07783950}.tmcontainer00000000000000000002.regtrans-ms
C:\users\default\ntuser.dat.log1
C:\users\default\ntuser.dat{2d8c3f0b-3f9b-11ed-9ead-0800278e6e63}.tmcontainer00000000000000000002.regtrans-ms
C:\users\default\ntuser.dat{fd9a35db-49fe-11e9-aa2c-248a07783950}.tmcontainer00000000000000000001.regtrans-ms
C:\users\default\ntuser.dat{fd9a35db-49fe-11e9-aa2c-248a07783950}.tm.blf
C:\recovery\windowsre\winre.wim
C:\users\default\ntuser.dat{2d8c3f0b-3f9b-11ed-9ead-0800278e6e63}.tmcontainer00000000000000000001.regtrans-ms
C:\users\default\ntuser.dat{2d8c3f0b-3f9b-11ed-9ead-0800278e6e63}.tm.blf
C:\recovery\windowsre\reagent.xml
C:\recovery\windowsre\boot.sdi
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\setup.xml

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Executes the following

'<SYSTEM32>\searchprotocolhost.exe' Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "%...
'<SYSTEM32>\searchfilterhost.exe' 0 768 772 780 8192 776

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial