Trojan.Encoder.32521

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\2013_finalsummaryforweb.xlsx
<Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\1189.jpeg
<Drive name for removable media>:\168.jpg
<Drive name for removable media>:\7790_preview.pdf
<Drive name for removable media>:\weeklysheet1215.doc
<Drive name for removable media>:\adhd_and_obesity.docx
<Drive name for removable media>:\productos.xls
<Drive name for removable media>:\price.zip
<Drive name for removable media>:\2.jpg
<Drive name for removable media>:\dualectls.pdf
<Drive name for removable media>:\ovp25012015.doc
<Drive name for removable media>:\thlps_keeper_mayer_1965.docx
<Drive name for removable media>:\al.xlsx
<Drive name for removable media>:\schema.rdf
<Drive name for removable media>:\ppswamp.ppt
<Drive name for removable media>:\asm.png
<Drive name for removable media>:\spanner.mov
<Drive name for removable media>:\64bit_notes.htm
<Drive name for removable media>:\wrar520.exe
<Drive name for removable media>:\210252809.jpeg
<Drive name for removable media>:\1189.jpg
<Drive name for removable media>:\spib_pima.pdf
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\contractualdeadlines.xls
<Drive name for removable media>:\iisstart.htm
<Drive name for removable media>:\subjectclassification.zip

Modifies file system

Creates the following files

<Current directory>\nw5lli1b.exe
C:\far2\plugins\ftp\lib\ab89_info.rtf
C:\far2\plugins\hlfviewer\ab89_info.rtf
C:\far2\plugins\network\ab89_info.rtf
C:\far2\plugins\proclist\ab89_info.rtf
C:\far2\plugins\tmppanel\ab89_info.rtf
C:\far2\pluginsdk\headers.c\ab89_info.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ab89_info.rtf
C:\far2\plugins\farcmds\ab89_info.rtf
C:\far2\plugins\ftp\ab89_info.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\ab89_info.rtf
<Current directory>\bad_1478741562f2e636.txt
%ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\ab89_info.rtf
%ProgramFiles(x86)%\microsoft.net\sdk\v1.1\tool developers guide\docs\ab89_info.rtf
%ProgramFiles(x86)%\steam\tenfoot\resource\images\ab89_info.rtf
%ProgramFiles(x86)%\steam\tenfoot\resource\images\music\ab89_info.rtf
%ProgramFiles(x86)%\steam\tenfoot\resource\images\systemmenu\ab89_info.rtf
%ProgramFiles(x86)%\steam\tenfoot\resource\images\welcomeupdates\ab89_info.rtf
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\ab89_info.rtf
%ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\ab89_info.rtf
C:\far2\plugins\emenu\ab89_info.rtf
C:\far2\plugins\editcase\ab89_info.rtf
C:\far2\plugins\drawline\ab89_info.rtf
<Current directory>\log.txt
%APPDATA%\4dgrzo0v.bmp
%APPDATA%\jyxe5v69.bat
%APPDATA%\ijxc20rt.vbs
<Current directory>\yfjomnoj.exe
<Current directory>\spldrvdi.bat
C:\far2\ab89_info.rtf
C:\far2\addons\colors\custom_highlighting\ab89_info.rtf
<Current directory>\all_dmpfl.fldp
C:\far2\addons\colors\default_highlighting\ab89_info.rtf
C:\far2\addons\shell\ab89_info.rtf
C:\far2\addons\xlat\russian\ab89_info.rtf
C:\far2\documentation\eng\ab89_info.rtf
C:\far2\encyclopedia\ab89_info.rtf
C:\far2\fexcept\ab89_info.rtf
C:\far2\plugins\arclite\ab89_info.rtf
C:\far2\plugins\brackets\ab89_info.rtf
C:\far2\plugins\compare\ab89_info.rtf
C:\far2\addons\macros\ab89_info.rtf
%ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\ab89_info.rtf
%ProgramFiles(x86)%\winamp\skins\bento\window\ab89_info.rtf

Moves the following files

from %APPDATA%\opera software\opera stable\thumbnails.db to %APPDATA%\opera software\opera stable\[adambrown89@criptext.com].fuojqmyd-aqy9zmks.ab89
from %ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\heart.jpg to %ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\[adambrown89@criptext.com].ava4xlyc-mq7txgmw.ab89
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\tool developers guide\docs\hosting interfaces.doc to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\tool developers guide\docs\[adambrown89@criptext.com].bk46qajq-kfuaefou.ab89
from %ProgramFiles%\f-sched\f-sched.exe to %ProgramFiles%\f-sched\[adambrown89@criptext.com].qnbfnlee-zffcy9nz.ab89
from %ProgramFiles%\ehsniffer\ehsniffer.exe to %ProgramFiles%\ehsniffer\[adambrown89@criptext.com].fbxansda-jupqoj21.ab89
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\welcomeupdates\controller_update_mouseregions.jpg to %ProgramFiles(x86)%\steam\tenfoot\resource\images\welcomeupdates\[adambrown89@criptext.com].3fgplvwy-5vnibdh4.ab89
from %ProgramFiles%\drweb32w\drweb32w.exe to %ProgramFiles%\drweb32w\[adambrown89@criptext.com].drnrxhne-tlhggu8w.ab89
from %ProgramFiles%\dislite\dislite.exe to %ProgramFiles%\dislite\[adambrown89@criptext.com].hdefhhtr-ha43mgcw.ab89
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\systemmenu\capsule_03.jpg to %ProgramFiles(x86)%\steam\tenfoot\resource\images\systemmenu\[adambrown89@criptext.com].js6udprc-cjouda8z.ab89
from %ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\ruin.jpg to %ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\[adambrown89@criptext.com].imrdootf-tpnpufje.ab89
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\usercontrol.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\[adambrown89@criptext.com].6jcmw1ve-jiak7trz.ab89
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\form.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\[adambrown89@criptext.com].gqwg2jgr-seveisrr.ab89
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\music\placeholder_album7.jpg to %ProgramFiles(x86)%\steam\tenfoot\resource\images\music\[adambrown89@criptext.com].ujjselln-dly3tbok.ab89
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\xmlfile.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\[adambrown89@criptext.com].kw9lu9ke-0wa6k3ol.ab89
from %ProgramFiles%\courier\courier.exe to %ProgramFiles%\courier\[adambrown89@criptext.com].oczg3ldp-gecpmkxy.ab89
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\mdiparent.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\[adambrown89@criptext.com].dsynyawk-djtgqnet.ab89
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\cog_transparent.jpg to %ProgramFiles(x86)%\steam\tenfoot\resource\images\[adambrown89@criptext.com].wvloxmwm-giyoa36j.ab89
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\assemblyinfo.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\[adambrown89@criptext.com].hy3q5yzv-m62kwbrw.ab89
from %ProgramFiles%\claw95cf\claw95cf.exe to %ProgramFiles%\claw95cf\[adambrown89@criptext.com].mz5xbfav-93iykeeq.ab89
from %ProgramFiles%\dbtool\dbtool.exe to %ProgramFiles%\dbtool\[adambrown89@criptext.com].wggkowxi-uph5gpqk.ab89
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\tool developers guide\docs\profiling.doc to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\tool developers guide\docs\[adambrown89@criptext.com].evedlfqp-fnvonsfm.ab89
from %ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\wrenches.jpg to %ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\[adambrown89@criptext.com].tbgeze0u-gtqkaxyk.ab89
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\dynamic.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annotations\stamps\enu\[adambrown89@criptext.com].pzpq1pnw-opopcxts.ab89
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\assemblyinfointernal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\[adambrown89@criptext.com].eeudjsx1-zd6oauky.ab89
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\healthreport.sqlite to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\[adambrown89@criptext.com].yqnfcl5q-begnzjwo.ab89
from %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\databases\databases.db to %APPDATA%\opera software\opera stable\storage\ext\sync-login\def\databases\[adambrown89@criptext.com].zqao0unb-igyodp5b.ab89
from %APPDATA%\mra\base\mra.dbs to %APPDATA%\mra\base\[adambrown89@criptext.com].e3iljmsa-8h46dttm.ab89
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\blist.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\[adambrown89@criptext.com].8uml90l0-h6v9zwjj.ab89
from %APPDATA%\icq-profile\base\mra.dbs to %APPDATA%\icq-profile\base\[adambrown89@criptext.com].i6vxmkq8-z7wuqpca.ab89
from %APPDATA%\opera software\opera stable\session.db to %APPDATA%\opera software\opera stable\[adambrown89@criptext.com].gierfp5m-hzdd5e8p.ab89
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\secmod.db to %APPDATA%\thunderbird\profiles\wjj9aet2.default\[adambrown89@criptext.com].oqigpf7g-qdpx3or7.ab89
from %APPDATA%\opera software\opera stable\databases\databases.db to %APPDATA%\opera software\opera stable\databases\[adambrown89@criptext.com].ynszxwoy-pxnqh49p.ab89
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\secmod.db to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\[adambrown89@criptext.com].uy4gcfzg-hjwdd3xq.ab89
from %ProgramFiles(x86)%\winamp\skins\bento\window\aol_radio_alb_art.jpg to %ProgramFiles(x86)%\winamp\skins\bento\window\[adambrown89@criptext.com].7aesmae2-qg3vwbct.ab89
from %ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\seaweed.jpg to %ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\[adambrown89@criptext.com].dce5aglr-lmf46g7r.ab89
from %ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\image415.jpg to %ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\[adambrown89@criptext.com].en3nztvf-msu5nvlv.ab89
from %APPDATA%\mail.ru\agent\mra\html\kz\error\exclamation.jpg to %APPDATA%\mail.ru\agent\mra\html\kz\error\[adambrown89@criptext.com].4xdascfl-lgz9spvm.ab89
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\welcomeupdates\controller_update_moystick.jpg to %ProgramFiles(x86)%\steam\tenfoot\resource\images\welcomeupdates\[adambrown89@criptext.com].4phipqcw-afa4934f.ab89
from %APPDATA%\icqm\icq\html\ru\error\exclamation.jpg to %APPDATA%\icqm\icq\html\ru\error\[adambrown89@criptext.com].uohzbxrg-pwhd0pnh.ab89
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\systemmenu\capsule_04.jpg to %ProgramFiles(x86)%\steam\tenfoot\resource\images\systemmenu\[adambrown89@criptext.com].v9myzbsd-rk1qjjk8.ab89
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\music\placeholder_album8.jpg to %ProgramFiles(x86)%\steam\tenfoot\resource\images\music\[adambrown89@criptext.com].zigmlmp4-avlerlik.ab89
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\generic.jpg to %ProgramFiles(x86)%\steam\tenfoot\resource\images\[adambrown89@criptext.com].m5bqtutj-a7bloefs.ab89
from %ProgramFiles%\ccproxy\ccproxy.exe to %ProgramFiles%\ccproxy\[adambrown89@criptext.com].8j0zewyq-pescvm8m.ab89
from %APPDATA%\mra\base\opt.dbs to %APPDATA%\mra\base\[adambrown89@criptext.com].8kyspzow-xbrcgavg.ab89
from %ProgramFiles%\cavsub\cavsub.exe to %ProgramFiles%\cavsub\[adambrown89@criptext.com].2xi2iiy4-4ofidqa1.ab89
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pdfsigqformalrep.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\[adambrown89@criptext.com].lagjkbow-zrdcwb8a.ab89
from %APPDATA%\icqm\icq\html\pt\error\exclamation.jpg to %APPDATA%\icqm\icq\html\pt\error\[adambrown89@criptext.com].hvtz9i3a-iec41vwq.ab89
from %ProgramFiles(x86)%\winamp\skins\winamp modern\notifier\sc_alb_art.jpg to %ProgramFiles(x86)%\winamp\skins\winamp modern\notifier\[adambrown89@criptext.com].oco4vs9e-48rwqhcq.ab89
from %ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\sunrise.jpg to %ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\[adambrown89@criptext.com].rjzjawlq-qf2cczrc.ab89
from %ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\prayerwheel.jpg to %ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\[adambrown89@criptext.com].huty1uch-7gsrsdvh.ab89
from %ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\facade01.jpg to %ProgramFiles(x86)%\winamp\plugins\milkdrop2\textures\[adambrown89@criptext.com].fchlu7b1-xdfqx2hj.ab89
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\welcomeupdates\controller_update_hometheater.jpg to %ProgramFiles(x86)%\steam\tenfoot\resource\images\welcomeupdates\[adambrown89@criptext.com].jgsr180n-yz1q1fh0.ab89
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\systemmenu\capsule_02.jpg to %ProgramFiles(x86)%\steam\tenfoot\resource\images\systemmenu\[adambrown89@criptext.com].ckww0sry-70tb0tqu.ab89
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\music\placeholder_album6.jpg to %ProgramFiles(x86)%\steam\tenfoot\resource\images\music\[adambrown89@criptext.com].5wfcp2jo-sh0ndaqc.ab89
from %APPDATA%\mail.ru\agent\mra\html\en\error\exclamation.jpg to %APPDATA%\mail.ru\agent\mra\html\en\error\[adambrown89@criptext.com].usdri6dg-5jshyuuk.ab89
from %ProgramFiles(x86)%\steam\tenfoot\resource\images\bootstrapper.jpg to %ProgramFiles(x86)%\steam\tenfoot\resource\images\[adambrown89@criptext.com].93biy5lu-ittpramm.ab89
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\tool developers guide\docs\partition iv library.doc to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\tool developers guide\docs\[adambrown89@criptext.com].ofrvhkuz-h8yuvn2h.ab89
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\tool developers guide\docs\debugref.doc to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\tool developers guide\docs\[adambrown89@criptext.com].sx41avpn-20ckxjgt.ab89
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\splashscreen.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\[adambrown89@criptext.com].jv8qspxg-ccebyq5c.ab89
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\emptydatabase.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\[adambrown89@criptext.com].cj2ljzid-dwcbbrxz.ab89
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\usercontrol.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\[adambrown89@criptext.com].vfjuo13a-6jb7xsl9.ab89
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\form.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\[adambrown89@criptext.com].ogyqutd9-7zpuuk6o.ab89
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\appconfig.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\[adambrown89@criptext.com].6sldbjvk-cmgi4rl6.ab89
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\webappsstore.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\[adambrown89@criptext.com].5joitiur-12snhh9m.ab89
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\defaultid.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\idtemplates\enu\[adambrown89@criptext.com].gl8bsznb-0j0qkzcf.ab89
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\cert8.db to %APPDATA%\thunderbird\profiles\wjj9aet2.default\[adambrown89@criptext.com].5jkarzdj-f4b8vlwp.ab89
from %ProgramFiles%\a2cmd\a2cmd.exe to %ProgramFiles%\a2cmd\[adambrown89@criptext.com].t41wk4cl-zngp8pdi.ab89
from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\storage\permanent\moz-safe-about+home\idb\[adambrown89@criptext.com].i2mbnyo7-u8qt4qck.ab89
from %ProgramFiles%\cavemsrv\cavemsrv.exe to %ProgramFiles%\cavemsrv\[adambrown89@criptext.com].h8smzykt-vxqdzsco.ab89
from %ProgramFiles%\blindman\blindman.exe to %ProgramFiles%\blindman\[adambrown89@criptext.com].4v0nv8xq-dycpug5i.ab89
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\tool developers guide\docs\partition v annexes.doc to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\tool developers guide\docs\[adambrown89@criptext.com].omomhnxp-beljwf7o.ab89
from %ProgramFiles%\bdss\bdss.exe to %ProgramFiles%\bdss\[adambrown89@criptext.com].r2u9irsf-ce7fpggv.ab89
from %ProgramFiles%\avscan\avscan.exe to %ProgramFiles%\avscan\[adambrown89@criptext.com].1yyybt1j-abpqqcmu.ab89
from %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\tool developers guide\docs\declarativesecuritysupport.doc to %ProgramFiles(x86)%\microsoft.net\sdk\v1.1\tool developers guide\docs\[adambrown89@criptext.com].mrrzgv5j-qty9jh5r.ab89
from %ProgramFiles%\avconsol\avconsol.exe to %ProgramFiles%\avconsol\[adambrown89@criptext.com].r5ravmxs-wrsseyug.ab89
from %ProgramFiles%\autodown\autodown.exe to %ProgramFiles%\autodown\[adambrown89@criptext.com].vylaqcbe-cecvcyzq.ab89
from %ProgramFiles%\ashsimpl\ashsimpl.exe to %ProgramFiles%\ashsimpl\[adambrown89@criptext.com].6wkeu5t8-kinmr09f.ab89
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\text.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\[adambrown89@criptext.com].8iqolupk-sp83pzej.ab89
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\explorer.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\[adambrown89@criptext.com].vom5n3ep-fgnnbenh.ab89
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\visualizer.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\[adambrown89@criptext.com].vgnh14mp-4k2fmykb.ab89
from %ProgramFiles%\ashdug\ashdug.exe to %ProgramFiles%\ashdug\[adambrown89@criptext.com].qbowhpta-59xbljir.ab89
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\interface.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\[adambrown89@criptext.com].dtsjbrje-xcwjthga.ab89
from %ProgramFiles%\aoltbserver\aoltbserver.exe to %ProgramFiles%\aoltbserver\[adambrown89@criptext.com].aq5ghrly-zoqn008x.ab89
from %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\appconfiginternal.zip to %ProgramFiles(x86)%\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\[adambrown89@criptext.com].oydtyxvn-rhhgvixx.ab89
from %APPDATA%\opera software\opera stable\bookmarks.bak to %APPDATA%\opera software\opera stable\[adambrown89@criptext.com].ljlo6jgm-d4eyrpbn.ab89
from %ProgramFiles%\aimpro\aimpro.exe to %ProgramFiles%\aimpro\[adambrown89@criptext.com].ohtityrd-g0swz9dc.ab89
from %ProgramFiles%\aavshield\aavshield.exe to %ProgramFiles%\aavshield\[adambrown89@criptext.com].dqmhawwk-3jz0q8yw.ab89
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\key3.db to %APPDATA%\thunderbird\profiles\wjj9aet2.default\[adambrown89@criptext.com].8vd1ggz5-penpzz0z.ab89
from %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite to %APPDATA%\thunderbird\profiles\wjj9aet2.default\[adambrown89@criptext.com].nmr4gvry-tllliwne.ab89

Modifies user data files (Trojan.Encoder).

Network activity

Connects to

'<LOCALNET>.46.23':445
'<LOCALNET>.46.22':445
'<LOCALNET>.46.21':445
'<LOCALNET>.46.23':139
'<LOCALNET>.46.21':139
'<LOCALNET>.46.35':445
'<LOCALNET>.46.20':445
'<LOCALNET>.46.20':139
'<LOCALNET>.46.34':445
'<LOCALNET>.46.22':139
'<LOCALNET>.46.33':445
'<LOCALNET>.46.32':445
'<LOCALNET>.46.35':139
'<LOCALNET>.46.34':139
'<LOCALNET>.46.36':445

TCP

HTTP GET requests

http://se#.#imerz.org/addrecord.php?ap###########################################################################
http://se#.#imerz.org/addrecord.php?ap###########################################################################################
http://se#.#imerz.org/addrecord.php?ap################################################################################################

UDP

DNS ASK se#.#imerz.org

Miscellaneous

Creates and executes the following

'<Current directory>\nw5lli1b.exe' -n
'%WINDIR%\syswow64\cmd.exe' /C copy /V /Y "<Full path to file>" "<Current directory>\NW5Lli1b.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "%APPDATA%\4dgrzO0V.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Contro...' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C wscript //B //Nologo "%APPDATA%\iJXc20rt.vbs"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\splDrVDI.bat" "%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\places.sqlite""' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\splDrVDI.bat" "%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\cert8.db""' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\splDrVDI.bat" "%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\key3.db""' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C copy /V /Y "<Full path to file>" "<Current directory>\NW5Lli1b.exe"
'%WINDIR%\syswow64\cmd.exe' /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "%APPDATA%\4dgrzO0V.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Contro...
'%WINDIR%\syswow64\cmd.exe' /C wscript //B //Nologo "%APPDATA%\iJXc20rt.vbs"
'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\splDrVDI.bat" "%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\places.sqlite""
'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\splDrVDI.bat" "%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\cert8.db""
'%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\splDrVDI.bat" "%APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\key3.db""

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial