SHA1:
- bdd2ecf290406b8a09eb01016c7658a283c407c3
An encryption Trojan for Windows written in C++. Contains several encrypted sources. Trojan.Encoder.11526 uses code that was detected by Doctor Web security researchers in Trojan.Encoder.10848. The Trojan controls relaunching using the event object with the name Global\88e0ddf0-7b4d-40ef-b3a4-681a36f56107. Checks availability of file with the name 88e0ddf0-7b4d-40ef-b3a4-681a36f56107 in the following folders:
- %APPDATA%
- %TEMP%
- %TMP%
- %PUBLIC%
If the indicated file is detected, the Trojan shuts down, if else—it tries to create it. It checks the running anti-virus programs by process names, and if it detects running applications with names avp.exe or avpui.exe, it shuts down. Then encoder chooses a name from the following list:
- mssql
- mscomrpc
- mscom
- msdcom
- mssec
- mssecsvc
- msdns
- msaddc
It adds the .exe extension to the chosen name and tries to create a file in the directories listed above. If the attempt is successful, it decrypts and saves to this file an encoder from its own sources. This encoder is designed specifically for decryption of files. Then the Trojan runs it.
There is a control of relaunching using the check of the event object called Global\{bb198875-b049-4c53-a7a8-fc2b400cc06d}. Once launched, the Trojan deletes the file auth.txt from its directory. The encrypted files are appended the extension *.~xdata~.
The Trojan generates the RSA-2048 key pair, saves to the folder %COMMON_APPDATA% or %APPDATA% the KEY file with the private key from this pair and encrypts file. The files are encrypted with the AES algorithm. The key is unique for every file. A session key is encrypted with the generated RSA key, and in case with the KEY file—the encryption is performed with the master key stored in the Trojan’s body. The encrypted files get a 0x108 byte adscript—the A12AF21F97FFDE97 marker and 0x100 bytes of the encrypted key.
In the end of May 2017, private part of the Trojan’s master key was made public, so decryption of corrupted files is now possible.
