Trojan.Encoder.15135

Technical Information

Malicious functions:

Executes the following:

'<SYSTEM32>\net.exe' view
'<SYSTEM32>\cmd.exe' /C net view

Modifies file system:

Creates the following files:

%HOMEPATH%\My Documents\ssda.far
%HOMEPATH%\My Documents\HOW--TO--RETURN--YOUR--FILES.jpg
%HOMEPATH%\Desktop\ssda.far
%HOMEPATH%\Desktop\HOW--TO--RETURN--YOUR--FILES.jpg

Moves the following system files:

from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.WinFx.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.WinFx.targets.x18tnit21f
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Xaml.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Xaml.targets.x18tnit21f
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualBasic.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualBasic.targets.x18tnit21f
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Data.Entity.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Data.Entity.targets.x18tnit21f
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.NETFramework.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.NETFramework.targets.x18tnit21f
from <SYSTEM32>\ias\dnary.mdb to <SYSTEM32>\ias\dnary.mdb.x18tnit21f
from <SYSTEM32>\ias\ias.mdb to <SYSTEM32>\ias\ias.mdb.x18tnit21f
from <SYSTEM32>\wpa.dbl to <SYSTEM32>\wpa.dbl.x18tnit21f
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Workflow.Targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Workflow.Targets.x18tnit21f
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Workflow.VisualBasic.Targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Workflow.VisualBasic.Targets.x18tnit21f
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.CSharp.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.CSharp.targets.x18tnit21f
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.WinFX.targets to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.WinFX.targets.x18tnit21f
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.Common.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.Common.targets.x18tnit21f
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.targets to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.targets.x18tnit21f
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.Common.targets to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.Common.targets.x18tnit21f
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.CSharp.targets to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.CSharp.targets.x18tnit21f
from %WINDIR%\Microsoft.NET\Framework\v3.5\SqlServer.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\SqlServer.targets.x18tnit21f
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Common.targets to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Common.targets.x18tnit21f
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.WinFx.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.WinFx.targets.x18tnit21f
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.CSharp.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.CSharp.targets.x18tnit21f
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.VisualBasic.targets to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft.VisualBasic.targets.x18tnit21f

Moves the following files:

from %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets to %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets.x18tnit21f
from %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets to %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets.x18tnit21f
from %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets to %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets.x18tnit21f
from %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets to %ProgramFiles%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets.x18tnit21f
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.x18tnit21f
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.x18tnit21f
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.x18tnit21f

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).