Trojan.Encoder.32573

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'XO1XADpO01' = '"<Полный путь к файлу>"'

Создает следующие файлы на съемном носителе

<Имя диска съемного носителя>:\restore-my-files.txt
<Имя диска съемного носителя>:\correct.avi
<Имя диска съемного носителя>:\split.avi
<Имя диска съемного носителя>:\dialmap.bmp
<Имя диска съемного носителя>:\dashborder_192.bmp
<Имя диска съемного носителя>:\join.avi
<Имя диска съемного носителя>:\default.bmp
<Имя диска съемного носителя>:\dashborder_120.bmp
<Имя диска съемного носителя>:\tileimage.bmp
<Имя диска съемного носителя>:\pmd.cer
<Имя диска съемного носителя>:\contosoroot.cer
<Имя диска съемного носителя>:\sdkfailsafeemulator.cer
<Имя диска съемного носителя>:\sdksampleprivdeveloper.cer
<Имя диска съемного носителя>:\contoso.cer
<Имя диска съемного носителя>:\february_catalogue__2015.doc
<Имя диска съемного носителя>:\hanni_umami_chapter.doc

Вредоносные функции

Завершает или пытается завершить

следующие пользовательские процессы:

firefox.exe

Изменения в файловой системе

Создает следующие файлы

C:\far2\addons\colors\custom_highlighting\restore-my-files.txt
C:\far2\plugins\editcase\restore-my-files.txt
C:\far2\plugins\emenu\restore-my-files.txt
C:\far2\plugins\farcmds\restore-my-files.txt
C:\far2\plugins\filecase\restore-my-files.txt
C:\far2\plugins\ftp\restore-my-files.txt
C:\far2\plugins\ftp\lib\restore-my-files.txt
C:\far2\plugins\hlfviewer\restore-my-files.txt
C:\far2\plugins\network\restore-my-files.txt
%ProgramFiles%\dvd maker\shared\restore-my-files.txt
C:\far2\plugins\proclist\restore-my-files.txt
C:\far2\plugins\tmppanel\restore-my-files.txt
C:\far2\pluginsdk\headers.c\restore-my-files.txt
C:\far2\pluginsdk\headers.pas\restore-my-files.txt
D:\restore-my-files.txt
%ProgramFiles%\dvd maker\restore-my-files.txt
%ProgramFiles%\dvd maker\en-us\restore-my-files.txt
C:\far2\plugins\drawline\restore-my-files.txt
C:\far2\plugins\macroview\restore-my-files.txt
C:\far2\plugins\compare\restore-my-files.txt
C:\far2\addons\xlat\russian\restore-my-files.txt
C:\far2\addons\colors\default_highlighting\restore-my-files.txt
C:\far2\addons\colors\restore-my-files.txt
C:\far2\addons\restore-my-files.txt
C:\far2\addons\macros\restore-my-files.txt
C:\far2\addons\setup\restore-my-files.txt
C:\far2\addons\shell\restore-my-files.txt
C:\far2\addons\xlat\restore-my-files.txt
C:\far2\restore-my-files.txt
C:\far2\plugins\autowrap\restore-my-files.txt
C:\far2\documentation\eng\restore-my-files.txt
C:\far2\documentation\rus\restore-my-files.txt
C:\far2\encyclopedia\restore-my-files.txt
C:\far2\encyclopedia\tap\restore-my-files.txt
C:\far2\fexcept\restore-my-files.txt
C:\far2\plugins\align\restore-my-files.txt
C:\far2\plugins\arclite\restore-my-files.txt
C:\far2\plugins\brackets\restore-my-files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\restore-my-files.txt

Перемещает следующие файлы

%ProgramFiles%\dvd maker\audiodepthconverter.ax в %ProgramFiles%\dvd maker\audiodepthconverter.ax.lockbit
%ProgramFiles%\dvd maker\bod_r.ttf в %ProgramFiles%\dvd maker\bod_r.ttf.lockbit
%ProgramFiles%\dvd maker\directshowtap.ax в %ProgramFiles%\dvd maker\directshowtap.ax.lockbit
%ProgramFiles%\dvd maker\en-us\dvdmaker.exe.mui в %ProgramFiles%\dvd maker\en-us\dvdmaker.exe.mui.lockbit
%ProgramFiles%\dvd maker\en-us\omdproject.dll.mui в %ProgramFiles%\dvd maker\en-us\omdproject.dll.mui.lockbit
%ProgramFiles%\dvd maker\en-us\wmm2clip.dll.mui в %ProgramFiles%\dvd maker\en-us\wmm2clip.dll.mui.lockbit
%ProgramFiles%\dvd maker\eurosti.ttf в %ProgramFiles%\dvd maker\eurosti.ttf.lockbit
%ProgramFiles%\dvd maker\fieldswitch.ax в %ProgramFiles%\dvd maker\fieldswitch.ax.lockbit
%ProgramFiles%\dvd maker\offset.ax в %ProgramFiles%\dvd maker\offset.ax.lockbit
%ProgramFiles%\dvd maker\rtstreamsink.ax в %ProgramFiles%\dvd maker\rtstreamsink.ax.lockbit
%ProgramFiles%\dvd maker\rtstreamsource.ax в %ProgramFiles%\dvd maker\rtstreamsource.ax.lockbit
%ProgramFiles%\dvd maker\secretst.ttf в %ProgramFiles%\dvd maker\secretst.ttf.lockbit
%ProgramFiles%\dvd maker\shared\common.fxh в %ProgramFiles%\dvd maker\shared\common.fxh.lockbit

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Сетевая активность

Подключается к

'<LOCALNET>.55.254':445
'<LOCALNET>.55.103':445
'<LOCALNET>.55.98':445
'<LOCALNET>.55.148':135
'<LOCALNET>.55.149':135
'<LOCALNET>.55.150':135
'<LOCALNET>.55.151':135
'<LOCALNET>.55.152':135
'<LOCALNET>.55.147':135
'<LOCALNET>.55.153':135
'<LOCALNET>.55.155':135
'<LOCALNET>.55.156':135
'<LOCALNET>.55.157':135
'<LOCALNET>.55.158':135
'<LOCALNET>.55.159':135
'<LOCALNET>.55.99':445
'<LOCALNET>.55.100':445
'<LOCALNET>.55.154':135
'<LOCALNET>.55.101':445
'<LOCALNET>.55.145':135
'<LOCALNET>.55.144':135
'<LOCALNET>.55.84':445
'<LOCALNET>.55.85':445
'<LOCALNET>.55.86':445
'<LOCALNET>.55.87':445
'<LOCALNET>.55.88':445
'<LOCALNET>.55.89':445
'<LOCALNET>.55.90':445
'<LOCALNET>.55.93':445
'<LOCALNET>.55.91':445
'<LOCALNET>.55.92':445
'<LOCALNET>.55.94':445
'<LOCALNET>.55.95':445
'<LOCALNET>.55.96':445
'<LOCALNET>.55.97':445
'<LOCALNET>.55.142':135
'<LOCALNET>.55.143':135
'<LOCALNET>.55.146':135
'<LOCALNET>.55.102':445
'<LOCALNET>.55.104':445
'<LOCALNET>.55.105':445
'<LOCALNET>.55.127':445
'<LOCALNET>.55.122':445
'<LOCALNET>.55.123':445
'<LOCALNET>.55.124':445
'<LOCALNET>.55.125':445
'<LOCALNET>.55.185':135
'<LOCALNET>.55.126':445
'<LOCALNET>.55.121':445
'<LOCALNET>.55.120':445
'<LOCALNET>.55.119':445
'<LOCALNET>.55.176':135
'<LOCALNET>.55.177':135
'<LOCALNET>.55.178':135
'<LOCALNET>.55.129':445
'<LOCALNET>.55.130':445
'<LOCALNET>.55.131':445
'<LOCALNET>.55.175':135
'<LOCALNET>.55.118':445
'<LOCALNET>.55.107':445
'<LOCALNET>.55.183':135
'<LOCALNET>.55.106':445
'<LOCALNET>.55.114':445
'<LOCALNET>.55.108':445
'<LOCALNET>.55.109':445
'<LOCALNET>.55.110':445
'<LOCALNET>.55.252':135
'<LOCALNET>.55.111':445
'<LOCALNET>.55.112':445
'<LOCALNET>.55.113':445
'<LOCALNET>.55.115':445
'<LOCALNET>.55.184':135
'<LOCALNET>.55.116':445
'<LOCALNET>.55.117':445
'<LOCALNET>.55.179':135
'<LOCALNET>.55.180':135
'<LOCALNET>.55.181':135
'<LOCALNET>.55.182':135
'<LOCALNET>.55.132':445
'<LOCALNET>.55.128':445
'<LOCALNET>.55.83':445
'<LOCALNET>.55.170':135
'<LOCALNET>.55.67':445
'<LOCALNET>.55.126':135
'<LOCALNET>.55.127':135
'<LOCALNET>.55.128':135
'<LOCALNET>.55.68':445
'<LOCALNET>.55.69':445
'<LOCALNET>.55.70':445
'<LOCALNET>.55.110':135
'<LOCALNET>.55.71':445
'<LOCALNET>.55.130':135
'<LOCALNET>.55.131':135
'<LOCALNET>.55.132':135
'<LOCALNET>.55.105':135
'<LOCALNET>.55.106':135
'<LOCALNET>.55.107':135
'<LOCALNET>.55.108':135
'<LOCALNET>.55.129':135
'<LOCALNET>.55.109':135
'<LOCALNET>.55.125':135
'<LOCALNET>.55.136':135
'<LOCALNET>.55.246':445
'<LOCALNET>.55.247':445
'<LOCALNET>.55.248':445
'<LOCALNET>.55.66':445
'<LOCALNET>.55.249':445
'<LOCALNET>.55.133':135
'<LOCALNET>.55.134':135
'<LOCALNET>.55.123':135
'<LOCALNET>.55.124':135
'<LOCALNET>.55.137':135
'<LOCALNET>.55.138':135
'<LOCALNET>.55.251':135
'<LOCALNET>.55.119':135
'<LOCALNET>.55.120':135
'<LOCALNET>.55.121':135
'<LOCALNET>.55.122':135
'<LOCALNET>.55.135':135
'<LOCALNET>.55.72':445
'<LOCALNET>.55.112':135
'<LOCALNET>.55.198':135
'<LOCALNET>.55.169':135
'<LOCALNET>.55.141':135
'<LOCALNET>.55.81':445
'<LOCALNET>.55.165':135
'<LOCALNET>.55.166':135
'<LOCALNET>.55.167':135
'<LOCALNET>.55.168':135
'<LOCALNET>.55.80':445
'<LOCALNET>.55.139':135
'<LOCALNET>.55.160':135
'<LOCALNET>.55.172':135
'<LOCALNET>.55.173':135
'<LOCALNET>.55.174':135
'<LOCALNET>.55.161':135
'<LOCALNET>.55.162':135
'<LOCALNET>.55.163':135
'<LOCALNET>.55.171':135
'<LOCALNET>.55.79':445
'<LOCALNET>.55.113':135
'<LOCALNET>.55.82':445
'<LOCALNET>.55.140':135
'<LOCALNET>.55.114':135
'<LOCALNET>.55.115':135
'<LOCALNET>.55.116':135
'<LOCALNET>.55.117':135
'<LOCALNET>.55.73':445
'<LOCALNET>.55.74':445
'<LOCALNET>.55.75':445
'<LOCALNET>.55.76':445
'<LOCALNET>.55.77':445
'<LOCALNET>.55.78':445
'<LOCALNET>.55.118':135
'<LOCALNET>.55.101':135
'<LOCALNET>.55.102':135
'<LOCALNET>.55.103':135
'<LOCALNET>.55.104':135
'<LOCALNET>.55.250':445
'<LOCALNET>.55.164':135
'<LOCALNET>.55.133':445
'<LOCALNET>.55.134':445
'<LOCALNET>.55.135':445
'<LOCALNET>.55.232':135
'<LOCALNET>.55.201':445
'<LOCALNET>.55.202':445
'<LOCALNET>.55.203':445
'<LOCALNET>.55.229':135
'<LOCALNET>.55.230':135
'<LOCALNET>.55.231':135
'<LOCALNET>.55.198':445
'<LOCALNET>.55.199':445
'<LOCALNET>.55.224':135
'<LOCALNET>.55.235':135
'<LOCALNET>.55.236':135
'<LOCALNET>.55.237':135
'<LOCALNET>.55.221':135
'<LOCALNET>.55.222':135
'<LOCALNET>.55.223':135
'<LOCALNET>.55.234':135
'<LOCALNET>.55.233':135
'<LOCALNET>.55.196':445
'<LOCALNET>.55.225':135
'<LOCALNET>.55.210':135
'<LOCALNET>.55.211':135
'<LOCALNET>.55.212':135
'<LOCALNET>.55.213':135
'<LOCALNET>.55.252':445
'<LOCALNET>.55.186':445
'<LOCALNET>.55.197':445
'<LOCALNET>.55.209':135
'<LOCALNET>.55.187':445
'<LOCALNET>.55.190':445
'<LOCALNET>.55.191':445
'<LOCALNET>.55.192':445
'<LOCALNET>.55.193':445
'<LOCALNET>.55.194':445
'<LOCALNET>.55.195':445
'<LOCALNET>.55.188':445
'<LOCALNET>.55.189':445
'<LOCALNET>.55.226':135
'<LOCALNET>.55.227':135
'<LOCALNET>.55.222':445
'<LOCALNET>.55.224':445
'<LOCALNET>.55.225':445
'<LOCALNET>.55.226':445
'<LOCALNET>.55.227':445
'<LOCALNET>.55.228':445
'<LOCALNET>.55.221':445
'<LOCALNET>.55.229':445
'<LOCALNET>.55.231':445
'<LOCALNET>.55.232':445
'<LOCALNET>.55.233':445
'<LOCALNET>.55.234':445
'<LOCALNET>.55.235':445
'<LOCALNET>.55.236':445
'<LOCALNET>.55.237':445
'<LOCALNET>.55.230':445
'<LOCALNET>.55.220':445
'<LOCALNET>.55.219':445
'<LOCALNET>.55.223':445
'<LOCALNET>.55.218':445
'<LOCALNET>.55.204':445
'<LOCALNET>.55.212':445
'<LOCALNET>.55.205':445
'<LOCALNET>.55.206':445
'<LOCALNET>.55.207':445
'<LOCALNET>.55.208':445
'<LOCALNET>.55.209':445
'<LOCALNET>.55.210':445
'<LOCALNET>.55.211':445
'<LOCALNET>.55.213':445
'<LOCALNET>.55.228':135
'<LOCALNET>.55.254':135
'<LOCALNET>.55.253':445
'<LOCALNET>.55.214':445
'<LOCALNET>.55.215':445
'<LOCALNET>.55.216':445
'<LOCALNET>.55.217':445
'<LOCALNET>.55.208':135
'<LOCALNET>.55.207':135
'<LOCALNET>.55.200':445
'<LOCALNET>.55.206':135
'<LOCALNET>.55.155':445
'<LOCALNET>.55.162':445
'<LOCALNET>.55.156':445
'<LOCALNET>.55.157':445
'<LOCALNET>.55.158':445
'<LOCALNET>.55.159':445
'<LOCALNET>.55.160':445
'<LOCALNET>.55.161':445
'<LOCALNET>.55.152':445
'<LOCALNET>.55.154':445
'<LOCALNET>.55.153':445
'<LOCALNET>.55.190':135
'<LOCALNET>.55.191':135
'<LOCALNET>.55.192':135
'<LOCALNET>.55.193':135
'<LOCALNET>.55.194':135
'<LOCALNET>.55.195':135
'<LOCALNET>.55.164':445
'<LOCALNET>.55.151':445
'<LOCALNET>.55.136':445
'<LOCALNET>.55.196':135
'<LOCALNET>.55.205':135
'<LOCALNET>.55.137':445
'<LOCALNET>.55.138':445
'<LOCALNET>.55.251':445
'<LOCALNET>.55.139':445
'<LOCALNET>.55.140':445
'<LOCALNET>.55.141':445
'<LOCALNET>.55.142':445
'<LOCALNET>.55.143':445
'<LOCALNET>.55.144':445
'<LOCALNET>.55.145':445
'<LOCALNET>.55.146':445
'<LOCALNET>.55.147':445
'<LOCALNET>.55.203':135
'<LOCALNET>.55.148':445
'<LOCALNET>.55.149':445
'<LOCALNET>.55.150':445
'<LOCALNET>.55.163':445
'<LOCALNET>.55.111':135
'<LOCALNET>.55.245':445
'<LOCALNET>.55.199':135
'<LOCALNET>.55.180':445
'<LOCALNET>.55.181':445
'<LOCALNET>.55.182':445
'<LOCALNET>.55.183':445
'<LOCALNET>.55.184':445
'<LOCALNET>.55.218':135
'<LOCALNET>.55.178':445
'<LOCALNET>.55.219':135
'<LOCALNET>.55.253':135
'<LOCALNET>.55.214':135
'<LOCALNET>.55.215':135
'<LOCALNET>.55.216':135
'<LOCALNET>.55.217':135
'<LOCALNET>.55.185':445
'<LOCALNET>.55.204':135
'<LOCALNET>.55.220':135
'<LOCALNET>.55.177':445
'<LOCALNET>.55.179':445
'<LOCALNET>.55.176':445
'<LOCALNET>.55.200':135
'<LOCALNET>.55.166':445
'<LOCALNET>.55.201':135
'<LOCALNET>.55.202':135
'<LOCALNET>.55.186':135
'<LOCALNET>.55.187':135
'<LOCALNET>.55.188':135
'<LOCALNET>.55.189':135
'<LOCALNET>.55.165':445
'<LOCALNET>.55.167':445
'<LOCALNET>.55.175':445
'<LOCALNET>.55.168':445
'<LOCALNET>.55.169':445
'<LOCALNET>.55.170':445
'<LOCALNET>.55.171':445
'<LOCALNET>.55.172':445
'<LOCALNET>.55.173':445
'<LOCALNET>.55.174':445
'<LOCALNET>.55.197':135
'<LOCALNET>.55.244':445

Другое

Создает и запускает на исполнение

'<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней