Trojan.Encoder.31550

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'unlock' = '"c:\Decoding help.hta"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'searchfiles' = '%WINDIR%\searchfiles.exe'
[<HKLM>\Software\Classes\.[ID]gLG5jxDED63TFGq2[ID]\shell\open\command] '' = '%WINDIR%\SysWow64\mshta.exe "c:\Decoding help.hta"'

Creates the following files on removable media

<Drive name for removable media>:\decoding help.hta
<Drive name for removable media>:\delete.avi
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\default.bmp

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

Modifies file system

Creates the following files

%WINDIR%\searchfiles.exe
%CommonProgramFiles(x86)%\system\decoding help.hta
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\office10\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\help\decoding help.hta
%ProgramFiles(x86)%\k-lite codec pack\decoding help.hta
%ProgramFiles(x86)%\pidgin\decoding help.hta
C:\totalcmd\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\information retrieval\decoding help.hta
%ProgramFiles(x86)%\qip 2012\decoding help.hta
%ProgramFiles(x86)%\windows media player\decoding help.hta
%ProgramFiles(x86)%\opera\decoding help.hta
%ProgramFiles%\aimpro\decoding help.hta
%ProgramFiles%\almon\decoding help.hta
%ProgramFiles%\alsvc\decoding help.hta
%ProgramFiles(x86)%\windows media player\en-us\decoding help.hta
%ProgramFiles(x86)%\mirc\defaults\decoding help.hta
%ProgramFiles(x86)%\winamp\decoding help.hta
%ProgramFiles(x86)%\mirc\decoding help.hta
%ProgramFiles(x86)%\internet explorer\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\dao\decoding help.hta
%CommonProgramFiles(x86)%\microsoft shared\ink\decoding help.hta
%PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\cache\decoding help.hta
%WINDIR%\ncler.txt
D:\decoding help.hta
C:\decoding help.hta
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\decoding help.hta
<Current directory>\decoding help.hta
%ProgramFiles(x86)%\decoding help.hta
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\decoding help.hta
%PROGRAMDATA%\microsoft\officesoftwareprotectionplatform\decoding help.hta
%CommonProgramFiles(x86)%\steam\decoding help.hta
%ProgramFiles%\ahnsd\decoding help.hta
%PROGRAMDATA%\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\esl\decoding help.hta
%CommonProgramFiles%\services\decoding help.hta
%ProgramFiles%\aim6\decoding help.hta
%ProgramFiles%\decoding help.hta
%ProgramFiles(x86)%\adobe\acrobat reader dc\resource\decoding help.hta
%CommonProgramFiles(x86)%\services\decoding help.hta
%ProgramFiles(x86)%\mozilla firefox\decoding help.hta

Moves the following files

from %ProgramFiles(x86)%\desktop.ini to %ProgramFiles(x86)%\desktop.ini.[id]glg5jxded63tfgq2[id]
from %ProgramFiles(x86)%\pidgin\libnspr4.dll to %ProgramFiles(x86)%\pidgin\libnspr4.dll.[id]glg5jxded63tfgq2[id]
from %ProgramFiles(x86)%\pidgin\libmeanwhile-1.dll to %ProgramFiles(x86)%\pidgin\libmeanwhile-1.dll.[id]glg5jxded63tfgq2[id]
from %ProgramFiles(x86)%\pidgin\libjabber.dll to %ProgramFiles(x86)%\pidgin\libjabber.dll.[id]glg5jxded63tfgq2[id]
from %ProgramFiles(x86)%\pidgin\freebl3.dll to %ProgramFiles(x86)%\pidgin\freebl3.dll.[id]glg5jxded63tfgq2[id]
from %ProgramFiles(x86)%\k-lite codec pack\unins000.exe to %ProgramFiles(x86)%\k-lite codec pack\unins000.exe.[id]glg5jxded63tfgq2[id]
from %ProgramFiles(x86)%\pidgin\exchndl.dll to %ProgramFiles(x86)%\pidgin\exchndl.dll.[id]glg5jxded63tfgq2[id]
from %ProgramFiles(x86)%\pidgin\liboscar.dll to %ProgramFiles(x86)%\pidgin\liboscar.dll.[id]glg5jxded63tfgq2[id]
from %ProgramFiles(x86)%\k-lite codec pack\unins000.dat to %ProgramFiles(x86)%\k-lite codec pack\unins000.dat.[id]glg5jxded63tfgq2[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.[id]glg5jxded63tfgq2[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\enutxt.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\resource\enutxt.pdf.[id]glg5jxded63tfgq2[id]
from %ProgramFiles%\desktop.ini to %ProgramFiles%\desktop.ini.[id]glg5jxded63tfgq2[id]
from %ProgramFiles%\aim6\aim6.exe to %ProgramFiles%\aim6\aim6.exe.[id]glg5jxded63tfgq2[id]
from %ProgramFiles%\ahnsd\ahnsd.exe to %ProgramFiles%\ahnsd\ahnsd.exe.[id]glg5jxded63tfgq2[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm.[id]glg5jxded63tfgq2[id]
from %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll.[id]glg5jxded63tfgq2[id]
from %ProgramFiles%\aimpro\aimpro.exe to %ProgramFiles%\aimpro\aimpro.exe.[id]glg5jxded63tfgq2[id]