Trojan.Encoder.11916

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{AB56BDC0-B508-B508-C269-C0BA562D5F4C}' = 'notepad.exe "%HOMEPATH%\HOW TO RECOVER ENCRYPTED FILES.TXT"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '{AB56BDC0-B508-B508-C269-C0BA562D5F4C}' = '%APPDATA%\svchost.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk

Заражает следующие исполняемые файлы:

C:\Far2\Plugins\ExtSearch\esearch.dll
C:\Far2\Plugins\EMenu\EMenu.dll
C:\Far2\Plugins\FileCase\FileCase.dll
C:\Far2\Plugins\FarCmds\FARCmds.dll
C:\Far2\Plugins\Compare\Compare.dll
C:\Far2\Plugins\Colorer\bin\colorer.dll
C:\Far2\Plugins\EditCase\EditCase.dll
C:\Far2\Plugins\DrawLine\DrawLine.dll
C:\Far2\Plugins\TmpPanel\TmpPanel.dll
C:\Far2\Plugins\ProcList\Proclist.dll
<STUBS_DIR>\test.exe
C:\Far2\Plugins\WinSCP\WinSCP.dll
C:\Far2\Plugins\HlfViewer\HlfViewer.dll
C:\Far2\Plugins\FTP\FarFtp.dll
C:\Far2\Plugins\Network\Network.dll
C:\Far2\Plugins\MacroView\MacroView.dll
C:\Far2\Plugins\Brackets\Brackets.dll
C:\Far2\Plugins\7-Zip\7-ZipFar64.dll
C:\Far2\Plugins\7-Zip\7-ZipFar.dll
C:\Far2\Plugins\Align\Align.dll
C:\Far2\Plugins\7-Zip\7z.dll
C:\Far2\FExcept\demangle32.dll
C:\Far2\Far.exe
C:\Far2\FExcept\FExcept.dll
C:\Far2\FExcept\ExcDump.dll
C:\Far2\Plugins\arclite\7zSD.sfx
C:\Far2\Plugins\arclite\7zS2con.sfx
C:\Far2\Plugins\AutoWrap\AutoWrap.dll
C:\Far2\Plugins\arclite\arclite.dll
C:\Far2\Plugins\arclite\7z.sfx
C:\Far2\Plugins\arclite\7z.dll
C:\Far2\Plugins\arclite\7zS2.sfx
C:\Far2\Plugins\arclite\7zCon.sfx

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

удаляет теневые копии разделов.

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c bcdedit /set {default} recoveryenabled No
'<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /All /Quiet
'<SYSTEM32>\cmd.exe' /c wmic SHADOWCOPY DELETE
'<SYSTEM32>\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\notepad.exe' "%HOMEPATH%\HOW TO RECOVER ENCRYPTED FILES.TXT"
'<SYSTEM32>\cmd.exe' /c %TEMP%\{35B431BC-7488-32F6-9A3C-604758EBCB1D}.bat
'<SYSTEM32>\cmd.exe' /c start /max notepad.exe "%HOMEPATH%\HOW TO RECOVER ENCRYPTED FILES.TXT"
'<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /for=C: /All
'<SYSTEM32>\cmd.exe' /c %TEMP%\{C3C724C0-CD16-B1FA-9024-3E6F865E0043}.bat
'%APPDATA%\svchost.exe'
'<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /for=D: /All
'<SYSTEM32>\cmd.exe' /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0
'<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /for=F: /All
'<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /for=E: /All

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\cscript.exe

Изменения в файловой системе:

Создает следующие файлы:

<STUBS_DIR>\l2\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\kb_cli\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\lin\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\lotroclient\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\loadmain\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\javaw\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\intpro\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\InphaseNXD\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\iscc\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\java\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\ISClient\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\msnmsgr\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\msn6\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\NAVAPW32\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\nod\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\netxray\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\mpftray\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\maplestory\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\magent\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\MCAGENT\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\miranda32\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\Mir3Game\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\inbank-start-ff\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\el_cli\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\elementclient\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\firefox\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\fsav32\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\fsav\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\elbank\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\Drwebwcl\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\Drwebupw\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\ecmd\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\ekrn\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\egni\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\gw\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\GVOnline\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\httplook\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\iexplore\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\ICQ\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\GUARD\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\fsavgui\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\fsavaui\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\gc\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\googletalk\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\ge\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\YahooMessenger\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\wsm\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\ybclient\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\zlclient\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\zapro\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\wow\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\wclnt\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\UniStream\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\webmoney\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\woool\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\winbaram\HOW TO RECOVER ENCRYPTED FILES.TXT
<SYSTEM32>\wbem\AutoRecover\C8463ECBE33BC240263A0B094E46D510.mof
%TEMP%\{35B431BC-7488-32F6-9A3C-604758EBCB1D}.bat
%TEMP%\tmp3.tmp
<SYSTEM32>\wbem\Logs\WMIC.LOG
<SYSTEM32>\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
%HOMEPATH%\Desktop\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\ZZ__cd75efb816b2cc__\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\ZONEALARM\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\__cd75efb816b2cc__\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\{AB56BDC0-B508-B508-C269-C0BA562D5F4C}.bmp
<STUBS_DIR>\TwelveSky2\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\qip\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\putty\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\Ragexe\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\rclient\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\RagFree\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\pidgin\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\ntvdm\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\nod32\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\oncbcli\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\outpost\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\opera\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\startclient7\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\sro_client\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\tiny\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\trillian\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\translink\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\spidernt\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\sgbclient\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\safari\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\skype\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\so3d\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\smc\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\drweb386\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Colorer\hrd\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Colorer\hrc\auto\types\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Compare\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\EditCase\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\DrawLine\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Colorer\hrc\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\AutoWrap\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\arclite\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Brackets\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Colorer\bin\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Colorer\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\FTP\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\FileCase\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\FTP\lib\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\MacroView\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\HlfViewer\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\FarCmds\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\ExtSearch\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\EMenu\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\ExtSearch\doc\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\ExtSearch\sources\RegExp\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\ExtSearch\sources\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Align\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Start Menu\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\My Documents\My Pictures\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Start Menu\Programs\HOW TO RECOVER ENCRYPTED FILES.TXT
%TEMP%\tmp1.tmp
%HOMEPATH%\Start Menu\Programs\Accessories\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\My Documents\My Music\HOW TO RECOVER ENCRYPTED FILES.TXT
%TEMP%\{C3C724C0-CD16-B1FA-9024-3E6F865E0043}.bat
%APPDATA%\svchost.exe
<Текущая директория>\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Favorites\Links\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Favorites\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Documentation\rus\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Documentation\eng\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Encyclopedia\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\7-Zip\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\FExcept\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Addons\Shell\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\HOW TO RECOVER ENCRYPTED FILES.TXT
%TEMP%\tmp2.tmp
C:\Far2\Addons\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\cbank\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\cabalmain\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\cbmain\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\ccapp\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\cbsmain\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\bk\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\bc_loader\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\bclient\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\bdagent\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\bdsubmit\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\bdss\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\dekaron\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\contactNG\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\dnf\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\Drweb32w\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\drweb\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\clntw32\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\ClamWin\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\chrome\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\clbank\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\clmain\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\client7\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\BBClient\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\360tray\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\ageofconan\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\ash\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\aion\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\PluginSDK\Headers.pas\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\ProcList\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Network\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\TmpPanel\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\PluginSDK\Headers.c\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\WinSCP\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\AVPCC\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\AVP32\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\AVPM\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\bankcl\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\AVSYNMGR\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\AVP\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\ashAvSrv\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\ashAvast\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\avgcc\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\AVGCTRL\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\AVGCC32\HOW TO RECOVER ENCRYPTED FILES.TXT

Удаляет следующие файлы:

%TEMP%\tmp2.tmp
%TEMP%\tmp3.tmp
%APPDATA%\svchost.exe
%TEMP%\tmp1.tmp

Самоудаляется.

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней