Trojan.Encoder.35485

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\.f1b384d8] 'ImagePath' = '"<Full path to file>" '

Creates the following services

'.f1b384d8' "<Full path to file>"

Creates the following files on removable media

<Drive name for removable media>:\readme.f1b384d8.txt
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\sdksampleprivdeveloper.cer

Malicious functions

Terminates or attempts to terminate

the following user processes:

firefox.exe

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\f1b384d8.ico
C:\far2\plugins\autowrap\readme.f1b384d8.txt
C:\far2\plugins\arclite\readme.f1b384d8.txt
C:\far2\plugins\align\readme.f1b384d8.txt
C:\far2\plugins\readme.f1b384d8.txt
C:\far2\fexcept\readme.f1b384d8.txt
C:\far2\encyclopedia\tap\readme.f1b384d8.txt
C:\far2\encyclopedia\readme.f1b384d8.txt
C:\far2\documentation\rus\readme.f1b384d8.txt
C:\far2\documentation\eng\readme.f1b384d8.txt
C:\far2\documentation\readme.f1b384d8.txt
C:\far2\addons\xlat\russian\readme.f1b384d8.txt
C:\far2\addons\xlat\readme.f1b384d8.txt
C:\far2\addons\shell\readme.f1b384d8.txt
C:\far2\addons\setup\readme.f1b384d8.txt
C:\far2\addons\macros\readme.f1b384d8.txt
D:\readme.f1b384d8.txt
C:\far2\addons\colors\default_highlighting\readme.f1b384d8.txt
C:\far2\addons\colors\custom_highlighting\readme.f1b384d8.txt
C:\far2\addons\colors\readme.f1b384d8.txt
C:\far2\addons\readme.f1b384d8.txt
C:\far2\readme.f1b384d8.txt
C:\readme.f1b384d8.txt
<Current directory>\readme.f1b384d8.txt
C:\far2\plugins\brackets\readme.f1b384d8.txt
C:\far2\plugins\compare\readme.f1b384d8.txt

Modifies the following files

C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg.f1b384d8
C:\far2\addons\colors\default_highlighting\rodion_doroshkevich.reg.f1b384d8
C:\far2\addons\colors\default_highlighting\nc5pal2.reg.f1b384d8
C:\far2\addons\colors\default_highlighting\hell.reg.f1b384d8
C:\far2\addons\colors\default_highlighting\greenmile.reg.f1b384d8
C:\far2\addons\colors\default_highlighting\farcolors242.reg.f1b384d8
C:\far2\addons\colors\default_highlighting\dn_like.reg.f1b384d8
C:\far2\addons\colors\default_highlighting\descript.ion.f1b384d8
C:\far2\addons\colors\default_highlighting\colors_from_sadovoj.reg.f1b384d8
C:\far2\addons\colors\default_highlighting\colors_from_gernichenko.reg.f1b384d8
D:\install.log.f1b384d8
C:\far2\addons\colors\default_highlighting\colors_from_admin_essp_ru.reg.f1b384d8
C:\far2\addons\colors\default_highlighting\black_from_myodov.reg.f1b384d8
C:\far2\addons\colors\default_highlighting\black_from_july.reg.f1b384d8
C:\far2\addons\colors\default_highlighting\black_from_fonarev.reg.f1b384d8
C:\far2\addons\colors\custom_highlighting\vaxcolors.reg.f1b384d8
C:\far2\addons\colors\custom_highlighting\rodion_doroshkevich.reg.f1b384d8
C:\far2\addons\colors\custom_highlighting\nc5pal2.reg.f1b384d8
C:\far2\addons\colors\custom_highlighting\hell.reg.f1b384d8
C:\far2\addons\colors\custom_highlighting\greenmile.reg.f1b384d8
C:\far2\addons\colors\custom_highlighting\farcolors242.reg.f1b384d8
C:\far2\addons\colors\custom_highlighting\dn_like.reg.f1b384d8
C:\far2\addons\colors\custom_highlighting\descript.ion.f1b384d8
C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg.f1b384d8
C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg.f1b384d8
C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg.f1b384d8
C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg.f1b384d8
C:\far2\addons\colors\custom_highlighting\black_from_july.reg.f1b384d8
C:\far2\addons\colors\default_highlighting\vaxcolors.reg.f1b384d8
C:\far2\addons\colors\descript.ion.f1b384d8