Trojan.Encoder.12740

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{68411E5D-72F4-7055-8DA6-8A07019DCA44}' = 'notepad.exe "%HOMEPATH%\!#_RESTORE_FILES_#!.TXT"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '{68411E5D-72F4-7055-8DA6-8A07019DCA44}' = '%APPDATA%\guide.exe'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\!#_RESTORE_FILES_#!.TXT
%HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk

Infects the following executable files:

C:\Far2\Plugins\ExtSearch\esearch.dll
C:\Far2\Plugins\EMenu\EMenu.dll
C:\Far2\Plugins\FileCase\FileCase.dll
C:\Far2\Plugins\FarCmds\FARCmds.dll
C:\Far2\Plugins\Compare\Compare.dll
C:\Far2\Plugins\Colorer\bin\colorer.dll
C:\Far2\Plugins\EditCase\EditCase.dll
C:\Far2\Plugins\DrawLine\DrawLine.dll
C:\Far2\Plugins\TmpPanel\TmpPanel.dll
C:\Far2\Plugins\ProcList\Proclist.dll
<STUBS_DIR>\test.exe
C:\Far2\Plugins\WinSCP\WinSCP.dll
C:\Far2\Plugins\HlfViewer\HlfViewer.dll
C:\Far2\Plugins\FTP\FarFtp.dll
C:\Far2\Plugins\Network\Network.dll
C:\Far2\Plugins\MacroView\MacroView.dll
C:\Far2\Plugins\Brackets\Brackets.dll
C:\Far2\Plugins\7-Zip\7-ZipFar64.dll
C:\Far2\Plugins\7-Zip\7-ZipFar.dll
C:\Far2\Plugins\Align\Align.dll
C:\Far2\Plugins\7-Zip\7z.dll
C:\Far2\FExcept\demangle32.dll
C:\Far2\Far.exe
C:\Far2\FExcept\FExcept.dll
C:\Far2\FExcept\ExcDump.dll
C:\Far2\Plugins\arclite\7zSD.sfx
C:\Far2\Plugins\arclite\7zS2con.sfx
C:\Far2\Plugins\AutoWrap\AutoWrap.dll
C:\Far2\Plugins\arclite\arclite.dll
C:\Far2\Plugins\arclite\7z.sfx
C:\Far2\Plugins\arclite\7z.dll
C:\Far2\Plugins\arclite\7zS2.sfx
C:\Far2\Plugins\arclite\7zCon.sfx

Malicious functions:

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Executes the following:

'<SYSTEM32>\cmd.exe' /c bcdedit /set {default} recoveryenabled No
'<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /All /Quiet
'<SYSTEM32>\cmd.exe' /c wmic SHADOWCOPY DELETE
'<SYSTEM32>\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\notepad.exe' "%HOMEPATH%\!#_RESTORE_FILES_#!.TXT"
'<SYSTEM32>\cmd.exe' /c %TEMP%\{9D12B1CE-20CB-27EE-5073-21F6ABDDAB98}.bat
'<SYSTEM32>\cmd.exe' /c start /max notepad.exe "%HOMEPATH%\!#_RESTORE_FILES_#!.TXT"
'<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /for=C: /All
'<SYSTEM32>\cmd.exe' /c %TEMP%\{541CCF09-5F23-7BC7-ED68-09E07CBE01CA}.bat
'%APPDATA%\guide.exe'
'<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /for=D: /All
'<SYSTEM32>\cmd.exe' /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0
'<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /for=F: /All
'<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /for=E: /All

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cscript.exe

Modifies file system:

Creates the following files:

<STUBS_DIR>\l2\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\kb_cli\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\lin\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\lotroclient\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\loadmain\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\javaw\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\intpro\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\InphaseNXD\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\iscc\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\java\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\ISClient\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\msnmsgr\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\msn6\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\NAVAPW32\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\nod\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\netxray\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\mpftray\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\maplestory\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\magent\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\MCAGENT\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\miranda32\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\Mir3Game\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\inbank-start-ff\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\el_cli\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\elementclient\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\firefox\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\fsav32\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\fsav\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\elbank\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\Drwebwcl\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\Drwebupw\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\ecmd\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\ekrn\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\egni\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\gw\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\GVOnline\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\httplook\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\iexplore\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\ICQ\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\GUARD\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\fsavgui\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\fsavaui\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\gc\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\googletalk\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\ge\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\YahooMessenger\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\wsm\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\ybclient\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\zlclient\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\zapro\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\wow\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\wclnt\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\UniStream\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\webmoney\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\woool\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\winbaram\!#_RESTORE_FILES_#!.TXT
%HOMEPATH%\{68411E5D-72F4-7055-8DA6-8A07019DCA44}.bmp
<SYSTEM32>\wbem\Logs\WMIC.LOG
%HOMEPATH%\!#_RESTORE_FILES_#!.TXT
%TEMP%\{9D12B1CE-20CB-27EE-5073-21F6ABDDAB98}.bat
%HOMEPATH%\Desktop\!#_RESTORE_FILES_#!.TXT
<SYSTEM32>\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
<STUBS_DIR>\ZZ__cd75efb816b2cc__\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\ZONEALARM\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\__cd75efb816b2cc__\!#_RESTORE_FILES_#!.TXT
%TEMP%\tmp3.tmp
<SYSTEM32>\wbem\AutoRecover\C8463ECBE33BC240263A0B094E46D510.mof
<STUBS_DIR>\TwelveSky2\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\qip\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\putty\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\Ragexe\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\rclient\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\RagFree\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\pidgin\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\ntvdm\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\nod32\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\oncbcli\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\outpost\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\opera\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\startclient7\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\sro_client\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\tiny\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\trillian\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\translink\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\spidernt\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\sgbclient\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\safari\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\skype\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\so3d\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\smc\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\Compare\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\Colorer\hrd\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\DrawLine\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\EMenu\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\EditCase\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\Colorer\hrc\auto\types\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\Brackets\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\AutoWrap\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\Colorer\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\Colorer\hrc\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\Colorer\bin\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\FTP\lib\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\FTP\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\HlfViewer\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\Network\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\MacroView\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\FileCase\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\ExtSearch\doc\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\ExtSearch\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\ExtSearch\sources\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\FarCmds\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\ExtSearch\sources\RegExp\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\arclite\!#_RESTORE_FILES_#!.TXT
%HOMEPATH%\Start Menu\!#_RESTORE_FILES_#!.TXT
%HOMEPATH%\My Documents\My Pictures\!#_RESTORE_FILES_#!.TXT
%HOMEPATH%\Start Menu\Programs\!#_RESTORE_FILES_#!.TXT
%TEMP%\tmp2.tmp
%HOMEPATH%\Start Menu\Programs\Accessories\!#_RESTORE_FILES_#!.TXT
%HOMEPATH%\My Documents\My Music\!#_RESTORE_FILES_#!.TXT
%TEMP%\{541CCF09-5F23-7BC7-ED68-09E07CBE01CA}.bat
%APPDATA%\guide.exe
%HOMEPATH%\Favorites\!#_RESTORE_FILES_#!.TXT
%TEMP%\tmp1.tmp
%HOMEPATH%\Favorites\Links\!#_RESTORE_FILES_#!.TXT
C:\Far2\Encyclopedia\!#_RESTORE_FILES_#!.TXT
C:\Far2\Documentation\rus\!#_RESTORE_FILES_#!.TXT
C:\Far2\FExcept\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\Align\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\7-Zip\!#_RESTORE_FILES_#!.TXT
C:\Far2\Documentation\eng\!#_RESTORE_FILES_#!.TXT
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\!#_RESTORE_FILES_#!.TXT
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\!#_RESTORE_FILES_#!.TXT
C:\Far2\!#_RESTORE_FILES_#!.TXT
C:\Far2\Addons\Shell\!#_RESTORE_FILES_#!.TXT
C:\Far2\Addons\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\cbmain\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\cbank\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\cbsmain\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\chrome\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\ccapp\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\cabalmain\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\bdagent\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\bc_loader\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\bdss\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\bk\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\bdsubmit\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\dnf\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\dekaron\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\drweb\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\drweb386\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\Drweb32w\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\contactNG\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\clbank\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\ClamWin\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\client7\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\clntw32\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\clmain\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\bclient\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\ageofconan\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\360tray\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\aion\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\ashAvast\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\ash\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\TmpPanel\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\ProcList\!#_RESTORE_FILES_#!.TXT
C:\Far2\Plugins\WinSCP\!#_RESTORE_FILES_#!.TXT
C:\Far2\PluginSDK\Headers.pas\!#_RESTORE_FILES_#!.TXT
C:\Far2\PluginSDK\Headers.c\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\AVPM\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\AVPCC\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\AVSYNMGR\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\BBClient\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\bankcl\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\AVP32\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\avgcc\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\ashAvSrv\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\AVGCC32\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\AVP\!#_RESTORE_FILES_#!.TXT
<STUBS_DIR>\AVGCTRL\!#_RESTORE_FILES_#!.TXT

Deletes the following files:

%TEMP%\tmp2.tmp
%TEMP%\tmp3.tmp
%APPDATA%\guide.exe
%TEMP%\tmp1.tmp

Deletes itself.

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial