Trojan.Encoder.25429

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\ShinoLockerEncryptedFile\shell\open\command] '' = '%TEMP%\NjDyJizg.exe "%l" '

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Modifies file system

Creates the following files

%TEMP%\njdyjizg.exe
%TEMP%\hsohzhf0.exe
%TEMP%\v9oqqv.txt
%TEMP%\fzw4eb.lst
%TEMP%\v9oqqv.txt.shino
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\$iiilc68.txt

Deletes the following files

%TEMP%\v9oqqv.txt

Network activity

UDP

DNS ASK da##net.com

Miscellaneous

Creates and executes the following

'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%TEMP%\V9OQQV.txt"
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\file_p_00000000_1371597592.docx"
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\cveuropeo.doc"
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\weeklysheet1215.doc"
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\adhd_and_obesity.docx"
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\issi2013_template_for_posters.docx"
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\split.avi"
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\000814251_video_01.avi"
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\hadac_newsletter_july_2010_final.docx"
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\hanni_umami_chapter.doc"
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\lisp_success.doc"
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\2.jpeg"
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\nwfieldnotes1966.docx"
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\toolbar.bmp"
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\tileimage.bmp"
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\thlps_keeper_mayer_1965.docx"
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\default.bmp"
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\3.jpeg"
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\hadac_newsletter_july_2010_final.docx"' (with hidden window)
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\issi2013_template_for_posters.docx"' (with hidden window)
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\nwfieldnotes1966.docx"' (with hidden window)
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\hanni_umami_chapter.doc"' (with hidden window)
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\thlps_keeper_mayer_1965.docx"' (with hidden window)
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\adhd_and_obesity.docx"' (with hidden window)
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\file_p_00000000_1371597592.docx"' (with hidden window)
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\lisp_success.doc"' (with hidden window)
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\2.jpeg"' (with hidden window)
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\000814251_video_01.avi"' (with hidden window)
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\3.jpeg"' (with hidden window)
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\toolbar.bmp"' (with hidden window)
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\tileimage.bmp"' (with hidden window)
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\default.bmp"' (with hidden window)
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%TEMP%\V9OQQV.txt"' (with hidden window)
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\cveuropeo.doc"' (with hidden window)
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\split.avi"' (with hidden window)
'%TEMP%\hsohzhf0.exe' E Wez03hsEhpTFfcIBCH1CnQ== D91JCmhNvM0wuImxRf7PuQ== "%HOMEPATH%\Desktop\weeklysheet1215.doc"' (with hidden window)