Trojan.Encoder.41284

Technical Information

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\13.jpeg
%HOMEPATH%\desktop\pushkin.jpeg
%HOMEPATH%\desktop\parnas_01.jpeg
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\browse.html
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\alert.html
%HOMEPATH%\desktop\adadsi.html
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\3.jpeg
%HOMEPATH%\desktop\168.jpeg
%HOMEPATH%\desktop\tree_view.html
%HOMEPATH%\desktop\trivial-merge.html

Modifies file system

Creates the following files

C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile31.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile32.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile33.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile34.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile35.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile36.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile38.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile21.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile39.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile40.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile41.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile42.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile43.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile44.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile30.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile29.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile28.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile27.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile26.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile25.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile24.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile23.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile22.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile37.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile20.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile19.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile18.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile17.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile16.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile15.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile14.bmp.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmp.uz
C:\users\public\pictures\sample pictures\hydrangeas.jpg.uz
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt.uz
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\welcomefax.tif.uz
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.uz
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bg0n0zou\favicon[1].ico.uz
%LOCALAPPDATA%\microsoft\windows mail\stationery\cave_drawings.gif.uz
%LOCALAPPDATA%\microsoft\windows mail\stationery\connectivity.gif.uz
%LOCALAPPDATA%\microsoft\windows mail\stationery\stucco.gif.uz
%LOCALAPPDATA%\microsoft\windows mail\stationery\tiki.gif.uz
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\startupcache\scriptcache-child-current.bin.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\user.bmp.uz
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\startupcache\scriptcache-child.bin.uz
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\startupcache\scriptcache-current.bin.uz
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\startupcache\urlcache-current.bin.uz
%LOCALAPPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\startupcache\urlcache.bin.uz
%LOCALAPPDATA%low\microsoft\internet explorer\services\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico.uz
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt.uz
%LOCALAPPDATA%\google\chrome\user data\default\google profile.ico.uz
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\snapshot_blob.bin.uz
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\natives_blob.bin.uz
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\chrome.7z.uz
C:\users\public\pictures\sample pictures\tulips.jpg.uz
C:\users\public\pictures\sample pictures\penguins.jpg.uz
C:\users\public\pictures\sample pictures\lighthouse.jpg.uz
C:\users\public\pictures\sample pictures\koala.jpg.uz
C:\users\public\pictures\sample pictures\jellyfish.jpg.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile13.bmp.uz
C:\users\public\pictures\sample pictures\desert.jpg.uz
C:\users\public\pictures\sample pictures\chrysanthemum.jpg.uz
C:\users\public\music\sample music\sleep away.mp3.uz
C:\users\public\music\sample music\maid with the flaxen hair.mp3.uz
C:\users\public\music\sample music\kalimba.mp3.uz
%ALLUSERSPROFILE%\sun\java\java update\jaureglist.xml.uz
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\welcomescan.jpg.uz
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_x64_528c94ccf5464e2e06249b41105333fcda5052_cab_05e13dfe\dmi3ddf.tmp.log.xml.uz
%LOCALAPPDATA%\microsoft\windows mail\stationery\wrinkled_paper.gif.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile12.bmp.uz
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_settings.ico.uz
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml.uz
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\setup.xml.uz
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.xml.uz
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\setup.xml.uz
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.xml.uz
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\setup.xml.uz
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\setup.xml.uz
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml.uz
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\branding.xml.uz
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemui.xml.uz
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemuiset.xml.uz
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\setup.xml.uz
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\accessmui.xml.uz
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\branding.xml.uz
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml.uz
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml.uz
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml.uz
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml.uz
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml.uz
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml.uz
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml.uz
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml.uz
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml.uz
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\groovemui.xml.uz
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml.uz
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml.uz
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml.uz
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml.uz
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml.uz
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml.uz
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml.uz
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\accessmuiset.xml.uz
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile10.bmp.uz
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml.uz
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico.uz
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_pref.ico.uz
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_property.ico.uz
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_queue.ico.uz
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_.ico.uz
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_property.ico.uz
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml.uz
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\setup.xml.uz
%ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico.uz
%ALLUSERSPROFILE%\microsoft\office\documentrepository.ico.uz
%ALLUSERSPROFILE%\microsoft\office\mysharepoints.ico.uz
%ALLUSERSPROFILE%\microsoft\office\mysite.ico.uz
%ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.ico.uz
%ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.ico.uz
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\resource.xml.uz
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico.uz
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml.uz
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\sync.ico.uz
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico.uz
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico.uz
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml.uz
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\pictures.ico.uz
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico.uz
%ALLUSERSPROFILE%\microsoft\user account pictures\default pictures\usertile11.bmp.uz
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\resource.xml.uz
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.uz
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml.uz
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.uz
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.uz
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.uz
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.uz
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.uz
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt.uz

Changes user data files extensions (Trojan.Encoder).

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial