Trojan.Encoder.33301

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Crypter' = '<Full path to file>'

Creates the following files on removable media

<Drive name for removable media>:\delete.avi.locked
<Drive name for removable media>:\000814251_video_01.avi.locked
<Drive name for removable media>:\split.avi.locked
<Drive name for removable media>:\join.avi.locked
<Drive name for removable media>:\archer.avi.locked

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)

Modifies file system

Creates the following files

%TEMP%\_mei30682\crypto\cipher\_arc4.cp36-win32.pyd
%TEMP%\_mei30682\wx\_core.cp36-win32.pyd
%TEMP%\_mei30682\win32file.pyd
%TEMP%\_mei30682\win32event.pyd
%TEMP%\_mei30682\win32api.pyd
%TEMP%\_mei30682\unicodedata.pyd
%TEMP%\_mei30682\select.pyd
%TEMP%\_mei30682\pywintypes36.dll
%TEMP%\_mei30682\pyexpat.pyd
%TEMP%\_mei30682\wx\_xrc.cp36-win32.pyd
%TEMP%\_mei30682\_ssl.pyd
%TEMP%\_mei30682\_socket.pyd
%TEMP%\_mei30682\_lzma.pyd
%TEMP%\_mei30682\_hashlib.pyd
%TEMP%\_mei30682\_elementtree.pyd
%TEMP%\_mei30682\_ctypes.pyd
%TEMP%\_mei30682\python36.dll
%TEMP%\_mei30682\crypto\hash\_ghash_clmul.cp36-win32.pyd
%TEMP%\_mei30682\wx\siplib.cp36-win32.pyd
%APPDATA%\enc_test.txt.locked
%APPDATA%\enc_test.txt
<Current directory>\reponse.txt
<Current directory>\key.txt
%TEMP%\_mei30682\runtime.cfg
%TEMP%\_mei30682\lock.ico
%TEMP%\_mei30682\lock.bmp
%TEMP%\_mei30682\_bz2.pyd
%TEMP%\_mei30682\wx\_xml.cp36-win32.pyd
%TEMP%\_mei30682\base_library.zip
%TEMP%\_mei30682\wxmsw30u_xrc_vc140.dll
%TEMP%\_mei30682\wxmsw30u_html_vc140.dll
%TEMP%\_mei30682\wxmsw30u_core_vc140.dll
%TEMP%\_mei30682\wxmsw30u_adv_vc140.dll
%TEMP%\_mei30682\wxbase30u_xml_vc140.dll
%TEMP%\_mei30682\wxbase30u_vc140.dll
%TEMP%\_mei30682\bitcoin.bmp
%TEMP%\_mei30682\wxbase30u_net_vc140.dll
%TEMP%\_mei30682\vcruntime140.dll
%TEMP%\_mei30682\main.exe.manifest
%TEMP%\_mei30682\msvcp140.dll
%TEMP%\_mei30682\crypto\cipher\_raw_cbc.cp36-win32.pyd
%TEMP%\_mei30682\crypto\cipher\_raw_ocb.cp36-win32.pyd
%TEMP%\_mei30682\crypto\cipher\_raw_eksblowfish.cp36-win32.pyd
%TEMP%\_mei30682\crypto\cipher\_raw_ecb.cp36-win32.pyd
%TEMP%\_mei30682\crypto\cipher\_raw_des3.cp36-win32.pyd
%TEMP%\_mei30682\crypto\cipher\_raw_des.cp36-win32.pyd
%TEMP%\_mei30682\crypto\cipher\_raw_ctr.cp36-win32.pyd
D:\install.log.locked
%TEMP%\_mei30682\crypto\hash\_blake2b.cp36-win32.pyd
%TEMP%\_mei30682\crypto\cipher\_raw_cast.cp36-win32.pyd
%TEMP%\_mei30682\crypto\cipher\_raw_blowfish.cp36-win32.pyd
%TEMP%\_mei30682\crypto\cipher\_raw_arc2.cp36-win32.pyd
%TEMP%\_mei30682\crypto\cipher\_raw_aesni.cp36-win32.pyd
%TEMP%\_mei30682\crypto\cipher\_raw_aes.cp36-win32.pyd
%TEMP%\_mei30682\crypto\cipher\_chacha20.cp36-win32.pyd
%TEMP%\_mei30682\crypto\cipher\_salsa20.cp36-win32.pyd
%TEMP%\_mei30682\crypto\cipher\_raw_cfb.cp36-win32.pyd
%TEMP%\_mei30682\certifi\cacert.pem
%TEMP%\_mei30682\crypto\hash\_blake2s.cp36-win32.pyd
%TEMP%\_mei30682\crypto\hash\_md5.cp36-win32.pyd
%TEMP%\_mei30682\crypto\hash\_md2.cp36-win32.pyd
%TEMP%\_mei30682\crypto\util\_strxor.cp36-win32.pyd
%TEMP%\_mei30682\crypto\util\_cpuid_c.cp36-win32.pyd
%TEMP%\_mei30682\crypto\publickey\_ec_ws.cp36-win32.pyd
%TEMP%\_mei30682\crypto\protocol\_scrypt.cp36-win32.pyd
%TEMP%\_mei30682\crypto\math\_modexp.cp36-win32.pyd
%TEMP%\_mei30682\crypto\hash\_poly1305.cp36-win32.pyd
%TEMP%\_mei30682\crypto\hash\_md4.cp36-win32.pyd
%TEMP%\_mei30682\crypto\hash\_keccak.cp36-win32.pyd
%TEMP%\_mei30682\crypto\cipher\_raw_ofb.cp36-win32.pyd
%TEMP%\_mei30682\crypto\hash\_sha512.cp36-win32.pyd
%TEMP%\_mei30682\crypto\hash\_sha384.cp36-win32.pyd
%TEMP%\_mei30682\crypto\hash\_sha256.cp36-win32.pyd
%TEMP%\_mei30682\crypto\hash\_sha224.cp36-win32.pyd
%TEMP%\_mei30682\crypto\hash\_sha1.cp36-win32.pyd
%TEMP%\_mei30682\crypto\hash\_ripemd160.cp36-win32.pyd
%TEMP%\_mei30682\crypto\hash\_ghash_portable.cp36-win32.pyd
D:\$recycle.bin\s-1-5-21-3150914307-1777937420-491476919-1000\desktop.ini.locked