Trojan.Encoder.11479

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '{B59357F0-D759-E20B-FCAD-0750B93516BE}' = '%APPDATA%\aavalo32.exe'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk

Infects the following executable files:

C:\Far2\Plugins\arclite\7zS2con.sfx
C:\Far2\Plugins\arclite\7zSD.sfx
C:\Far2\Plugins\arclite\7zS2.sfx
C:\Far2\Plugins\arclite\7z.sfx
C:\Far2\Plugins\arclite\7zCon.sfx

Malicious functions:

Executes the following:

'<SYSTEM32>\cmd.exe' /c %TEMP%\{C7077E53-437C-02FB-F55F-C45E0A676808}.bat
'%APPDATA%\aavalo32.exe'

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cscript.exe

Modifies file system:

Creates the following files:

C:\Far2\Plugins\FileCase\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\FarCmds\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\ExtSearch\sources\RegExp\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\HlfViewer\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\FTP\lib\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\FTP\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\ExtSearch\sources\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\EditCase\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\DrawLine\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Compare\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\ExtSearch\doc\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\ExtSearch\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\EMenu\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\GVOnline\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\el_cli\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\cbmain\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\lin\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\l2\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\kb_cli\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\ProcList\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Network\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\MacroView\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\PluginSDK\Headers.pas\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\PluginSDK\Headers.c\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\TmpPanel\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Colorer\hrd\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Start Menu\Programs\Accessories\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Start Menu\Programs\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Addons\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Start Menu\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Favorites\HOW TO RECOVER ENCRYPTED FILES.TXT
%TEMP%\{C7077E53-437C-02FB-F55F-C45E0A676808}.bat
%APPDATA%\aavalo32.exe
%HOMEPATH%\My Documents\My Pictures\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\My Documents\My Music\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Favorites\Links\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Colorer\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Brackets\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\AutoWrap\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Colorer\hrc\auto\types\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Colorer\hrc\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Colorer\bin\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\arclite\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Documentation\rus\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Documentation\eng\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Addons\Shell\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Align\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\7-Zip\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Encyclopedia\HOW TO RECOVER ENCRYPTED FILES.TXT