Trojan.Encoder.33555

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'services.exe' = '"%APPDATA%\Microsoft\Windows\services.exe" -start'

Creates the following files on removable media

<Drive name for removable media>:\split.avi
<Drive name for removable media>:\middaugh_keynote.pptx
<Drive name for removable media>:\samieee_obiee_presentation.pptx
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
<Drive name for removable media>:\wrar520.exe
<Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe
<Drive name for removable media>:\calc.exe
<Drive name for removable media>:\notepad.exe
<Drive name for removable media>:\winmine.exe
<Drive name for removable media>:\skypesetup.exe
<Drive name for removable media>:\tcm851ax32.exe
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\!!! all your files are encrypted !!!.txt
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\asaprojectcompetition.pptx

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Injects code into

the following system processes:

%WINDIR%\syswow64\notepad.exe

Modifies file system

Creates the following files

%TEMP%\cf7e82e4.zeppelin
%APPDATA%\microsoft\windows\services.exe
%TEMP%\edb7477f.zeppelin
%TEMP%\~temp001.bat
D:\$recycle.bin\.zeppelin
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.zeppelin

Deletes the following files

%TEMP%\cf7e82e4.zeppelin
%TEMP%\edb7477f.zeppelin

Moves the following files

from %ProgramFiles%\360tray\360tray.exe to %ProgramFiles%\360tray\360tray.exe.2d1-fc8-77b
from %ProgramFiles%\avgrssvc\avgrssvc.exe to %ProgramFiles%\avgrssvc\avgrssvc.exe.2d1-fc8-77b
from %ProgramFiles%\avgnpsvc\avgnpsvc.exe to %ProgramFiles%\avgnpsvc\avgnpsvc.exe.2d1-fc8-77b
from %ProgramFiles%\avgnpdln\avgnpdln.exe to %ProgramFiles%\avgnpdln\avgnpdln.exe.2d1-fc8-77b
from %ProgramFiles%\avginet\avginet.exe to %ProgramFiles%\avginet\avginet.exe.2d1-fc8-77b
from %ProgramFiles%\avgfwsrv\avgfwsrv.exe to %ProgramFiles%\avgfwsrv\avgfwsrv.exe.2d1-fc8-77b
from %ProgramFiles%\avgemc\avgemc.exe to %ProgramFiles%\avgemc\avgemc.exe.2d1-fc8-77b
from %ProgramFiles%\avgdiag\avgdiag.exe to %ProgramFiles%\avgdiag\avgdiag.exe.2d1-fc8-77b
from %ProgramFiles%\avgcc\avgcc.exe to %ProgramFiles%\avgcc\avgcc.exe.2d1-fc8-77b
from %ProgramFiles%\avgamsvr\avgamsvr.exe to %ProgramFiles%\avgamsvr\avgamsvr.exe.2d1-fc8-77b
from %ProgramFiles%\avconsol\avconsol.exe to %ProgramFiles%\avconsol\avconsol.exe.2d1-fc8-77b
from %ProgramFiles%\avconfig\avconfig.exe to %ProgramFiles%\avconfig\avconfig.exe.2d1-fc8-77b
from %ProgramFiles%\avcmd\avcmd.exe to %ProgramFiles%\avcmd\avcmd.exe.2d1-fc8-77b
from %ProgramFiles%\avciman\avciman.exe to %ProgramFiles%\avciman\avciman.exe.2d1-fc8-77b
from %ProgramFiles%\avcenter\avcenter.exe to %ProgramFiles%\avcenter\avcenter.exe.2d1-fc8-77b
from %ProgramFiles%\avadmin\avadmin.exe to %ProgramFiles%\avadmin\avadmin.exe.2d1-fc8-77b
from %ProgramFiles%\autotrace\autotrace.exe to %ProgramFiles%\autotrace\autotrace.exe.2d1-fc8-77b
from %ProgramFiles%\autostartexplorer\autostartexplorer.exe to %ProgramFiles%\autostartexplorer\autostartexplorer.exe.2d1-fc8-77b
from %ProgramFiles%\autodown\autodown.exe to %ProgramFiles%\autodown\autodown.exe.2d1-fc8-77b
from %ProgramFiles%\aswupdsv\aswupdsv.exe to %ProgramFiles%\aswupdsv\aswupdsv.exe.2d1-fc8-77b
from %ProgramFiles%\avgscan\avgscan.exe to %ProgramFiles%\avgscan\avgscan.exe.2d1-fc8-77b
from %ProgramFiles%\avgupden\avgupden.exe to %ProgramFiles%\avgupden\avgupden.exe.2d1-fc8-77b
from %ProgramFiles%\avgupsvc\avgupsvc.exe to %ProgramFiles%\avgupsvc\avgupsvc.exe.2d1-fc8-77b
from %ProgramFiles%\avgvv\avgvv.exe to %ProgramFiles%\avgvv\avgvv.exe.2d1-fc8-77b
from %ProgramFiles%\bdsubmitwiz\bdsubmitwiz.exe to %ProgramFiles%\bdsubmitwiz\bdsubmitwiz.exe.2d1-fc8-77b
from %ProgramFiles%\bdsubmit\bdsubmit.exe to %ProgramFiles%\bdsubmit\bdsubmit.exe.2d1-fc8-77b
from %ProgramFiles%\bdss\bdss.exe to %ProgramFiles%\bdss\bdss.exe.2d1-fc8-77b
from %ProgramFiles%\bdoesrv\bdoesrv.exe to %ProgramFiles%\bdoesrv\bdoesrv.exe.2d1-fc8-77b
from %ProgramFiles%\bdnews\bdnews.exe to %ProgramFiles%\bdnews\bdnews.exe.2d1-fc8-77b
from %ProgramFiles%\bdmcon\bdmcon.exe to %ProgramFiles%\bdmcon\bdmcon.exe.2d1-fc8-77b
from %ProgramFiles%\bdagent\bdagent.exe to %ProgramFiles%\bdagent\bdagent.exe.2d1-fc8-77b
from %ProgramFiles%\backweb-4476822\backweb-4476822.exe to %ProgramFiles%\backweb-4476822\backweb-4476822.exe.2d1-fc8-77b
from %ProgramFiles%\b2\b2.exe to %ProgramFiles%\b2\b2.exe.2d1-fc8-77b
from %ProgramFiles%\avscan\avscan.exe to %ProgramFiles%\avscan\avscan.exe.2d1-fc8-77b
from %ProgramFiles%\avsynmgr\avsynmgr.exe to %ProgramFiles%\avsynmgr\avsynmgr.exe.2d1-fc8-77b
from %ProgramFiles%\avpm\avpm.exe to %ProgramFiles%\avpm\avpm.exe.2d1-fc8-77b
from %ProgramFiles%\avpcc\avpcc.exe to %ProgramFiles%\avpcc\avpcc.exe.2d1-fc8-77b
from %ProgramFiles%\avnotify\avnotify.exe to %ProgramFiles%\avnotify\avnotify.exe.2d1-fc8-77b
from %ProgramFiles%\avkwctl\avkwctl.exe to %ProgramFiles%\avkwctl\avkwctl.exe.2d1-fc8-77b
from %ProgramFiles%\avkservice\avkservice.exe to %ProgramFiles%\avkservice\avkservice.exe.2d1-fc8-77b
from %ProgramFiles%\avkserv\avkserv.exe to %ProgramFiles%\avkserv\avkserv.exe.2d1-fc8-77b
from %ProgramFiles%\avinitnt\avinitnt.exe to %ProgramFiles%\avinitnt\avinitnt.exe.2d1-fc8-77b
from %ProgramFiles%\avgwizfw\avgwizfw.exe to %ProgramFiles%\avgwizfw\avgwizfw.exe.2d1-fc8-77b
from %ProgramFiles%\avgw\avgw.exe to %ProgramFiles%\avgw\avgw.exe.2d1-fc8-77b
from %ProgramFiles%\bdsurvey\bdsurvey.exe to %ProgramFiles%\bdsurvey\bdsurvey.exe.2d1-fc8-77b
from %ProgramFiles%\aswregsvr\aswregsvr.exe to %ProgramFiles%\aswregsvr\aswregsvr.exe.2d1-fc8-77b
from %ProgramFiles%\ash_updatemediator\ash_updatemediator.exe to %ProgramFiles%\ash_updatemediator\ash_updatemediator.exe.2d1-fc8-77b
from %ProgramFiles%\ashwebsv\ashwebsv.exe to %ProgramFiles%\ashwebsv\ashwebsv.exe.2d1-fc8-77b
from %ProgramFiles%\almon\almon.exe to %ProgramFiles%\almon\almon.exe.2d1-fc8-77b
from %ProgramFiles%\airdefense\airdefense.exe to %ProgramFiles%\airdefense\airdefense.exe.2d1-fc8-77b
from %ProgramFiles%\aimpro\aimpro.exe to %ProgramFiles%\aimpro\aimpro.exe.2d1-fc8-77b
from %ProgramFiles%\aim6\aim6.exe to %ProgramFiles%\aim6\aim6.exe.2d1-fc8-77b
from %ProgramFiles%\ahnsd\ahnsd.exe to %ProgramFiles%\ahnsd\ahnsd.exe.2d1-fc8-77b
from %ProgramFiles%\ageofconan\ageofconan.exe to %ProgramFiles%\ageofconan\ageofconan.exe.2d1-fc8-77b
from %ProgramFiles%\agb5\agb5.exe to %ProgramFiles%\agb5\agb5.exe.2d1-fc8-77b
from %ProgramFiles%\admunch\admunch.exe to %ProgramFiles%\admunch\admunch.exe.2d1-fc8-77b
from %ProgramFiles%\ackwin32\ackwin32.exe to %ProgramFiles%\ackwin32\ackwin32.exe.2d1-fc8-77b
from %ProgramFiles%\about\about.exe to %ProgramFiles%\about\about.exe.2d1-fc8-77b
from %ProgramFiles%\aavshield\aavshield.exe to %ProgramFiles%\aavshield\aavshield.exe.2d1-fc8-77b
from %ProgramFiles%\a2wizard\a2wizard.exe to %ProgramFiles%\a2wizard\a2wizard.exe.2d1-fc8-77b
from %ProgramFiles%\a2upd\a2upd.exe to %ProgramFiles%\a2upd\a2upd.exe.2d1-fc8-77b
from %ProgramFiles%\a2start\a2start.exe to %ProgramFiles%\a2start\a2start.exe.2d1-fc8-77b
from %ProgramFiles%\a2service\a2service.exe to %ProgramFiles%\a2service\a2service.exe.2d1-fc8-77b
from %ProgramFiles%\a2scan\a2scan.exe to %ProgramFiles%\a2scan\a2scan.exe.2d1-fc8-77b
from %ProgramFiles%\a2hijackfree\a2hijackfree.exe to %ProgramFiles%\a2hijackfree\a2hijackfree.exe.2d1-fc8-77b
from %ProgramFiles%\a2guard\a2guard.exe to %ProgramFiles%\a2guard\a2guard.exe.2d1-fc8-77b
from %ProgramFiles%\a2cmd\a2cmd.exe to %ProgramFiles%\a2cmd\a2cmd.exe.2d1-fc8-77b
from %ProgramFiles%\alsvc\alsvc.exe to %ProgramFiles%\alsvc\alsvc.exe.2d1-fc8-77b
from %ProgramFiles%\amon\amon.exe to %ProgramFiles%\amon\amon.exe.2d1-fc8-77b
from %ProgramFiles%\amsn\amsn.exe to %ProgramFiles%\amsn\amsn.exe.2d1-fc8-77b
from %ProgramFiles%\anti-trojan\anti-trojan.exe to %ProgramFiles%\anti-trojan\anti-trojan.exe.2d1-fc8-77b
from %ProgramFiles%\ashskpck\ashskpck.exe to %ProgramFiles%\ashskpck\ashskpck.exe.2d1-fc8-77b
from %ProgramFiles%\ashskpcc\ashskpcc.exe to %ProgramFiles%\ashskpcc\ashskpcc.exe.2d1-fc8-77b
from %ProgramFiles%\ashsimpl\ashsimpl.exe to %ProgramFiles%\ashsimpl\ashsimpl.exe.2d1-fc8-77b
from %ProgramFiles%\ashsimp2\ashsimp2.exe to %ProgramFiles%\ashsimp2\ashsimp2.exe.2d1-fc8-77b
from %ProgramFiles%\ashserv\ashserv.exe to %ProgramFiles%\ashserv\ashserv.exe.2d1-fc8-77b
from %ProgramFiles%\ashquick\ashquick.exe to %ProgramFiles%\ashquick\ashquick.exe.2d1-fc8-77b
from %ProgramFiles%\ashpopwz\ashpopwz.exe to %ProgramFiles%\ashpopwz\ashpopwz.exe.2d1-fc8-77b
from %ProgramFiles%\ashmaisv\ashmaisv.exe to %ProgramFiles%\ashmaisv\ashmaisv.exe.2d1-fc8-77b
from %ProgramFiles%\ashlogv\ashlogv.exe to %ProgramFiles%\ashlogv\ashlogv.exe.2d1-fc8-77b
from %ProgramFiles%\ashdug\ashdug.exe to %ProgramFiles%\ashdug\ashdug.exe.2d1-fc8-77b
from %ProgramFiles%\ashenhcd\ashenhcd.exe to %ProgramFiles%\ashenhcd\ashenhcd.exe.2d1-fc8-77b
from %ProgramFiles%\ashdisp\ashdisp.exe to %ProgramFiles%\ashdisp\ashdisp.exe.2d1-fc8-77b
from %ProgramFiles%\ashchest\ashchest.exe to %ProgramFiles%\ashchest\ashchest.exe.2d1-fc8-77b
from %ProgramFiles%\ashavsrv\ashavsrv.exe to %ProgramFiles%\ashavsrv\ashavsrv.exe.2d1-fc8-77b
from %ProgramFiles%\ashavast\ashavast.exe to %ProgramFiles%\ashavast\ashavast.exe.2d1-fc8-77b
from %ProgramFiles%\ash\ash.exe to %ProgramFiles%\ash\ash.exe.2d1-fc8-77b
from %ProgramFiles%\armorsurf\armorsurf.exe to %ProgramFiles%\armorsurf\armorsurf.exe.2d1-fc8-77b
from %ProgramFiles%\armor2net\armor2net.exe to %ProgramFiles%\armor2net\armor2net.exe.2d1-fc8-77b
from %ProgramFiles%\aoltbserver\aoltbserver.exe to %ProgramFiles%\aoltbserver\aoltbserver.exe.2d1-fc8-77b
from %ProgramFiles%\antivirus\antivirus.exe to %ProgramFiles%\antivirus\antivirus.exe.2d1-fc8-77b
from %ProgramFiles%\ashupd\ashupd.exe to %ProgramFiles%\ashupd\ashupd.exe.2d1-fc8-77b
from %ProgramFiles%\bdswitch\bdswitch.exe to %ProgramFiles%\bdswitch\bdswitch.exe.2d1-fc8-77b

Modifies the following files

<Drive name for removable media>:\split.avi
<Drive name for removable media>:\middaugh_keynote.pptx
<Drive name for removable media>:\samieee_obiee_presentation.pptx
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\asaprojectcompetition.pptx

Deletes itself.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'ge###tool.com':80
'ge###tool.com':443
'microsoft.com':80
'ip###ger.org':80
'ip###ger.org':443
'oc##.#ectigo.com':80

TCP

'ge###tool.com':443
'ip###ger.org':443

UDP

DNS ASK ge###tool.com
DNS ASK ge###tatool.com
DNS ASK microsoft.com
DNS ASK ip###ger.org
DNS ASK oc##.#ectigo.com

Miscellaneous

Creates and executes the following

'%APPDATA%\microsoft\windows\services.exe' -start
'%APPDATA%\microsoft\windows\services.exe' -agent 0
'%APPDATA%\microsoft\windows\services.exe' -agent 1
'%APPDATA%\microsoft\windows\services.exe' -agent 2
'%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C %TEMP%\~temp001.bat' (with hidden window)

Executes the following

'%WINDIR%\syswow64\notepad.exe'
'%WINDIR%\syswow64\cmd.exe' /C wmic shadowcopy delete
'%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} recoveryenabled no
'%WINDIR%\syswow64\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
'%WINDIR%\syswow64\cmd.exe' /C wbadmin delete catalog -quiet
'%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet
'%WINDIR%\syswow64\cmd.exe' /C %TEMP%\~temp001.bat

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial