Trojan.Encoder.37725

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\gruenspecht_02172016.pptx
<Drive name for removable media>:\middaugh_keynote.pptx
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\applicantform_en.doc
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\ovp25012015.doc
<Drive name for removable media>:\cveuropeo.doc
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\archer.avi
<Drive name for removable media>:\indogerman2010.pptx
<Drive name for removable media>:\samieee_obiee_presentation.pptx

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\advice_process.htm
%HOMEPATH%\desktop\alert.html
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\howto-index.html
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\toolbar.bmp
%HOMEPATH%\desktop\tree_view.htm
%HOMEPATH%\desktop\testcertificate.cer

Modifies file system

Creates the following files

%HOMEPATH%\appdata\key.txt
%HOMEPATH%\desktop\kanti.html
%TEMP%\etilqs_m8uygkjxtugxtaf
%TEMP%\etilqs_svhh2llzcv6ekd8
%TEMP%\etilqs_tdkbwusqmtrtuws
%TEMP%\etilqs_hs1gwypybelnlsv
%TEMP%\etilqs_s17lq3bou5bykg4
%TEMP%\etilqs_acmlt9p3uatolye
%TEMP%\etilqs_zighdpcepmheq4k
%TEMP%\etilqs_uhu7g8ejyalib1q
%TEMP%\etilqs_69j9abq8c4ddcfq
%TEMP%\etilqs_rs4otogy9vcijcl
%TEMP%\etilqs_g42nd9svcwdia9l

Modifies the following files

<Drive name for removable media>:\000814251_video_01.avi
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\pss10r.chm
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\microsoft.vc90.crt.manifest
C:\kms\kms_vl_all_aio_debug.log
D:\install.log
<Drive name for removable media>:\samieee_obiee_presentation.pptx
<Drive name for removable media>:\indogerman2010.pptx
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\gruenspecht_02172016.pptx
<Drive name for removable media>:\middaugh_keynote.pptx
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\applicantform_en.doc
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\ovp25012015.doc
<Drive name for removable media>:\cveuropeo.doc
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\archer.avi
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\setup.chm
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms

Modifies multiple files.

Deletes itself.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'au######te.geo.opera.com':80
'au######te.geo.opera.com':443
'google.com':80
'se####.yahoo.com':80
'du###uckgo.com':443
'am##on.com':80
'bing.com':80
'en.###ipedia.org':80
'am##on.com':443
'se####.yahoo.com':443
'en.###ipedia.org':443
'si#####ck2.opera.com':80
're###.opera.com':80
'fa###ook.com':80
'sd#####es.operacdn.com':443

TCP

HTTP GET requests

http://au######te.geo.opera.com/geolocation/
http://re###.opera.com/speeddials/partner/product
http://re###.opera.com/speeddials/partner/booking_com_us
http://re###.opera.com/speeddials/partner/twitter_us
http://re###.opera.com/speeddials/partner/yahoo
http://re###.opera.com/speeddials/partner/ebay_us
http://re###.opera.com/speeddials/partner/amazon_us
http://re###.opera.com/favicon.ico
http://re###.opera.com/speeddials/partner/youtube
http://www.fa###ook.com/campaign/landing.php?ca#########################
http://re###.opera.com/www.opera.com/firstrun/
http://si#####ck2.opera.com/?ho###################################################
http://en.###ipedia.org/favicon.ico
http://www.bing.com/s/a/bing_p.ico
http://se####.yahoo.com/favicon.ico
http://www.am##on.com/favicon.ico
http://www.google.com/favicon.ico
http://re###.opera.com/speeddials/partner/facebook
http://re###.opera.com/speeddials/partner/wikipedia_org_us

Other

'au######te.geo.opera.com':443
'du###uckgo.com':443
'am##on.com':443
'se####.yahoo.com':443
'en.###ipedia.org':443
'sd#####es.operacdn.com':443

UDP

DNS ASK google.com
DNS ASK au######te.geo.opera.com
DNS ASK se####.yahoo.com
DNS ASK du###uckgo.com
DNS ASK am##on.com
DNS ASK bing.com
DNS ASK bi##.#ikimedia.org
DNS ASK en.###ipedia.org
DNS ASK si#####ck2.opera.com
DNS ASK re###.opera.com
DNS ASK fa###ook.com
DNS ASK sd#####es.operacdn.com

Miscellaneous

Searches for the following windows

ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'

Executes the following

'<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 3 && del <Full path to file>&& %HOMEPATH%\Desktop\Kanti.html && exit
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2980.19.1300167837\365323960" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2980.18.2011934204\413281558" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2980.15.631439817\1682053394" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2980.14.662611264\1983429676" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2980.13.2010118716\1190650697" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2980.12.1058680409\721789608" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2980.11.728379117\1724285030" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2980.10.715579458\1142581471" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2980.9.912699515\570266930" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2980.8.1075330416\1268692723" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2980.20.2053508800\485841801" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2980.7.1672708905\1096299194" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2980.6.2065641684\1931379872" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2980.4.583041630\218242163" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2980.5.1685322392\148346242" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="2980.0.245030988\1289894803" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\Kanti.html" /crash-reporter-parent-id=2980
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- "%HOMEPATH%\Desktop\Kanti.html"
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "%HOMEPATH%\Desktop\Kanti.html"
'<SYSTEM32>\ping.exe' 127.0.0.1 -n 3
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="2980.4.583041630\218242163" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=968
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2980.21.539979222\1273861565" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial