Trojan.Encoder.37994

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Reads files which store third party applications passwords

%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico.bit
%TEMP%\dd_vcredistui7a3c.txt.bit
%TEMP%\dd_wcf_ca_smci_20230531_225943_157.txt.bit
%TEMP%\dd_wcf_ca_smci_20230531_225945_094.txt.bit
%TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_core_x64.msi.txt.bit
%TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_extended_x64.msi.txt.bit
%TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_164850616-msi_vc_red.msi.txt.bit
%TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_165235616-msi_vc_red.msi.txt.bit
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_165304913-msi_vc_red.msi.txt.bit
%LOCALAPPDATA%low\microsoft\internet explorer\services\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico.bit
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\alternateservices.txt.bit
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\securitypreloadstate.txt.bit
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\securitypreloadstate.txt.bit
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\sitesecurityservicestate.txt.bit
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\trrblacklist.txt.bit
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\alternateservices.txt.bit
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\pkcs11.txt.bit
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\securitypreloadstate.txt.bit
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\sitesecurityservicestate.txt.bit
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\trrblacklist.txt.bit
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\license.txt.bit
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\alternateservices.txt.bit
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\pkcs11.txt.bit
%TEMP%\dd_vcredistmsi7a3c.txt.bit
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\pkcs11.txt.bit
%TEMP%\dd_setuputility.txt.bit
C:\users\public\pictures\sample pictures\chrysanthemum.jpg.bit
%ALLUSERSPROFILE%\microsoft\office\documentrepository.ico.bit
%ALLUSERSPROFILE%\microsoft\office\mysharepoints.ico.bit
%ALLUSERSPROFILE%\microsoft\office\mysite.ico.bit
%ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.ico.bit
%ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.ico.bit
%ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmp.bit
%ALLUSERSPROFILE%\microsoft\user account pictures\user.bmp.bit
C:\users\public\music\sample music\kalimba.mp3.bit
C:\users\public\music\sample music\maid with the flaxen hair.mp3.bit
C:\users\public\music\sample music\sleep away.mp3.bit
C:\users\public\pictures\sample pictures\desert.jpg.bit
%TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.bit
C:\users\public\pictures\sample pictures\hydrangeas.jpg.bit
C:\users\public\pictures\sample pictures\jellyfish.jpg.bit
C:\users\public\pictures\sample pictures\koala.jpg.bit
C:\users\public\pictures\sample pictures\lighthouse.jpg.bit
C:\users\public\pictures\sample pictures\penguins.jpg.bit
C:\users\public\pictures\sample pictures\tulips.jpg.bit
C:\users\public\videos\sample videos\wildlife.wmv.bit
%LOCALAPPDATA%\iconcache.db.bit
%LOCALAPPDATA%\google\chrome\user data\default\google profile.ico.bit
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.bit
%TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.bit
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\sitesecurityservicestate.txt.bit

Modifies the following files

%ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico
%TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt
%TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt
%LOCALAPPDATA%\google\chrome\user data\default\google profile.ico
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\splash-620x300.png
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\smalllogo.png
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\logo.png
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\secondarytile.png
C:\users\public\videos\sample videos\wildlife.wmv
C:\users\public\pictures\sample pictures\tulips.jpg
C:\users\public\pictures\sample pictures\penguins.jpg
C:\users\public\pictures\sample pictures\lighthouse.jpg
C:\users\public\pictures\sample pictures\koala.jpg
C:\users\public\pictures\sample pictures\jellyfish.jpg
C:\users\public\pictures\sample pictures\hydrangeas.jpg
C:\users\public\pictures\sample pictures\desert.jpg
C:\users\public\pictures\sample pictures\chrysanthemum.jpg
C:\users\public\music\sample music\sleep away.mp3
C:\users\public\music\sample music\maid with the flaxen hair.mp3
C:\users\public\music\sample music\kalimba.mp3
%ALLUSERSPROFILE%\microsoft\user account pictures\user.bmp
%ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmp
%ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.ico
%ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.ico
%ALLUSERSPROFILE%\microsoft\office\mysite.ico
%ALLUSERSPROFILE%\microsoft\office\mysharepoints.ico
%ALLUSERSPROFILE%\microsoft\office\documentrepository.ico
%TEMP%\dd_setuputility.txt
%TEMP%\dd_vcredistmsi7a3c.txt