Trojan.Encoder.13133

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'falrqtcr472' = '"%TEMP%\IXP000.TMP\tasksche.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\@WanaDecryptor@.exe.lnk
%HOMEPATH%\Start Menu\Programs\Startup\x.vbs.WNCRYT
%HOMEPATH%\Start Menu\Programs\Startup\x.vbs
%HOMEPATH%\Start Menu\Programs\Startup\@Please_Read_Me@.txt

Malicious functions:

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Creates and executes the following:

'%TEMP%\IXP000.TMP\taskse.exe' %TEMP%\IXP000.TMP\@WanaDecryptor@.exe
'%TEMP%\IXP000.TMP\@WanaDecryptor@.exe'
'%TEMP%\IXP000.TMP\taskdl.exe'
'%TEMP%\IXP000.TMP\@WanaDecryptor@.exe' co

Executes the following:

'<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "falrqtcr472" /t REG_SZ /d "\"%TEMP%\IXP000.TMP\tasksche.exe\"" /f
'<SYSTEM32>\taskkill.exe' /f /im Microsoft.Exchange.*
'<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...
'<SYSTEM32>\cmd.exe' /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "falrqtcr472" /t REG_SZ /d "\"%TEMP%\IXP000.TMP\tasksche.exe\"" /f
'<SYSTEM32>\taskkill.exe' /f /im sqlwriter.exe
'<SYSTEM32>\taskkill.exe' /f /im mysqld.exe
'<SYSTEM32>\taskkill.exe' /f /im MSExchange*
'<SYSTEM32>\taskkill.exe' /f /im sqlserver.exe
'%TEMP%\IXP000.TMP\TaskData\Tor\taskhsvc.exe'
'%ProgramFiles%\Internet Explorer\IEXPLORE.EXE'
'<SYSTEM32>\attrib.exe' +h .
'%TEMP%\IXP000.TMP\1.xyz'
'<SYSTEM32>\cmd.exe' /c echo on error resume next:CreateObject("WScript.Shell").Run "%TEMP%\IXP000.TMP\1.xyz",1: >"%HOMEPATH%\Start Menu\Programs\Startup\x.vbs"
'<SYSTEM32>\cmd.exe' /c start /b @WanaDecryptor@.exe vs
'%TEMP%\IXP000.TMP\@WanaDecryptor@.exe' vs
'<SYSTEM32>\cmd.exe' /c 40291500909941.bat
'<SYSTEM32>\cscript.exe' //nologo m.vbs

Injects code into

the following user processes:

1.xyz

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe

a large number of user processes.

Modifies file system:

Creates the following files:

C:\Documents and Settings\Default User\Templates\quattro.wb2.WNCRYT
C:\startup_local.bat.WNCRYT
<STUBS_DIR>\@WanaDecryptor@.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.WNCRYT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.WNCRYT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.WNCRYT
C:\Far2\PluginSDK\Headers.pas\@Please_Read_Me@.txt
C:\Far2\Plugins\FTP\@WanaDecryptor@.exe
C:\Far2\Plugins\FTP\@Please_Read_Me@.txt
<STUBS_DIR>\@Please_Read_Me@.txt
<STUBS_DIR>\list_full.txt.WNCRYT
C:\Far2\PluginSDK\Headers.pas\@WanaDecryptor@.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp.WNCRYT
C:\Far2\Addons\Colors\import_colors.bat.WNCRYT
%HOMEPATH%\Templates\quattro.wb2.WNCRYT
<LS_APPDATA>\IconCache.db.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp.WNCRYT
C:\Far2\Plugins\Colorer\hrc\auto\types\auto.jar.WNCRYT
C:\Far2\Plugins\Colorer\hrc\common.jar.WNCRYT
C:\Far2\Plugins\Colorer\hrc\@WanaDecryptor@.exe.lnk
C:\Far2\Plugins\Colorer\hrc\@Please_Read_Me@.txt
C:\Far2\Plugins\Colorer\hrc\changes.txt.WNCRYT
%TEMP%\IXP000.TMP\f.wnry
C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.WNCRYT
C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.WNCRYT
C:\Far2\Documentation\rus\@WanaDecryptor@.exe
C:\Far2\Documentation\rus\@Please_Read_Me@.txt
C:\Far2\Documentation\rus\TechInfo.txt.WNCRYT
C:\Far2\Plugins\7-Zip\@WanaDecryptor@.exe
C:\Far2\Plugins\7-Zip\@Please_Read_Me@.txt
C:\Far2\Plugins\7-Zip\far7z.txt.WNCRYT
C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.WNCRYT
C:\Far2\Plugins\FTP\FtpCmds.txt.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\RegExp\@WanaDecryptor@.exe.lnk
C:\Far2\Plugins\ExtSearch\sources\RegExp\@Please_Read_Me@.txt
C:\Far2\Plugins\FTP\Notes_rus.txt.WNCRYT
C:\Far2\Plugins\FTP\Notes.txt.WNCRYT
C:\Far2\Plugins\FTP\FtpCmds_rus.txt.WNCRYT
C:\Far2\Plugins\ExtSearch\doc\@Please_Read_Me@.txt
C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.WNCRYT
C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\@WanaDecryptor@.exe.lnk
C:\Far2\Plugins\ExtSearch\sources\@Please_Read_Me@.txt
C:\Far2\Plugins\ExtSearch\doc\@WanaDecryptor@.exe.lnk
%ALLUSERSPROFILE%\Desktop\@WanaDecryptor@.bmp
<STUBS_DIR>\runall.bat.WNCRYT
<STUBS_DIR>\proc_tools.txt.WNCRYT
C:\Documents and Settings\Default User\Desktop\@WanaDecryptor@.exe
C:\Documents and Settings\Default User\Desktop\@WanaDecryptor@.bmp
%ALLUSERSPROFILE%\Desktop\@WanaDecryptor@.exe
<STUBS_DIR>\proc_browsers.txt.WNCRYT
<STUBS_DIR>\proc_banks.txt.WNCRYT
<STUBS_DIR>\proc_av.txt.WNCRYT
<STUBS_DIR>\proc_im.txt.WNCRYT
<STUBS_DIR>\proc_games.txt.WNCRYT
<STUBS_DIR>\proc_fake.txt.WNCRYT
%HOMEPATH%\Desktop\@WanaDecryptor@.bmp
%TEMP%\IXP000.TMP\TaskData\Tor\tor.exe
%TEMP%\IXP000.TMP\TaskData\Tor\ssleay32.dll
%TEMP%\IXP000.TMP\TaskData\Tor\libssp-0.dll
%APPDATA%\tor\state.tmp
%TEMP%\IXP000.TMP\TaskData\Tor\taskhsvc.exe
%TEMP%\IXP000.TMP\TaskData\Tor\zlib1.dll
%TEMP%\IXP000.TMP\TaskData\Tor\libevent-2-0-5.dll
%TEMP%\IXP000.TMP\TaskData\Tor\libeay32.dll
%HOMEPATH%\Desktop\@WanaDecryptor@.exe
%TEMP%\IXP000.TMP\TaskData\Tor\libgcc_s_sjlj-1.dll
%TEMP%\IXP000.TMP\TaskData\Tor\libevent_extra-2-0-5.dll
%TEMP%\IXP000.TMP\TaskData\Tor\libevent_core-2-0-5.dll
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.WNCRYT
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak.WNCRYT
C:\AUTOEXEC.BAT.WNCRYT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.WNCRYT
%APPDATA%\Microsoft\Internet Explorer\brndlog.bak.WNCRYT
C:\Documents and Settings\Default User\Templates\sndrec.wav.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.H.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.H.WNCRYT
C:\Far2\PluginSDK\Headers.pas\PluginW.pas.WNCRYT
C:\Far2\PluginSDK\Headers.pas\FarKeysW.pas.WNCRYT
C:\Far2\PluginSDK\Headers.pas\FarColorW.pas.WNCRYT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\ESEARCH.BAT.WNCRYT
C:\Far2\Addons\Colors\Default Highlighting\import_colors.bat.WNCRYT
C:\Far2\Addons\Colors\Custom Highlighting\import_colors.bat.WNCRYT
<STUBS_DIR>\list_short.txt.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp.WNCRYT
C:\Far2\Plugins\ExtSearch\sources\esearch_debug.bat.WNCRYT
C:\Far2\RestoreSettings.cmd.WNCRYT
C:\Far2\ClearPluginsCache.cmd.WNCRYT
%HOMEPATH%\Templates\sndrec.wav.WNCRYT
C:\Far2\Addons\Colors\export_colors.bat.WNCRYT
C:\Far2\Addons\README.TXT.WNCRYT
C:\Far2\SaveSettings.cmd.WNCRYT
C:\Far2\Documentation\rus\Plugins.Review.txt.WNCRYT
%TEMP%\IXP000.TMP\msg\m_vietnamese.wnry
%TEMP%\IXP000.TMP\msg\m_turkish.wnry
%TEMP%\IXP000.TMP\msg\m_swedish.wnry
%TEMP%\IXP000.TMP\t.wnry
%TEMP%\IXP000.TMP\s.wnry
%TEMP%\IXP000.TMP\r.wnry
%TEMP%\IXP000.TMP\msg\m_romanian.wnry
%TEMP%\IXP000.TMP\msg\m_portuguese.wnry
%TEMP%\IXP000.TMP\msg\m_polish.wnry
%TEMP%\IXP000.TMP\msg\m_spanish.wnry
%TEMP%\IXP000.TMP\msg\m_slovak.wnry
%TEMP%\IXP000.TMP\msg\m_russian.wnry
%TEMP%\IXP000.TMP\taskdl.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\@Please_Read_Me@.txt
%TEMP%\IXP000.TMP\@Please_Read_Me@.txt
%TEMP%\IXP000.TMP\40291500909941.bat
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.WNCRYT
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.WNCRYT
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.WNCRYT
%TEMP%\IXP000.TMP\00000000.pky
%TEMP%\IXP000.TMP\u.wnry
%TEMP%\IXP000.TMP\taskse.exe
%TEMP%\IXP000.TMP\@WanaDecryptor@.exe
%TEMP%\IXP000.TMP\00000000.res
%TEMP%\IXP000.TMP\00000000.eky
%TEMP%\IXP000.TMP\msg\m_chinese (traditional).wnry
%TEMP%\IXP000.TMP\msg\m_chinese (simplified).wnry
%TEMP%\IXP000.TMP\msg\m_bulgarian.wnry
%TEMP%\IXP000.TMP\msg\m_danish.wnry
%TEMP%\IXP000.TMP\msg\m_czech.wnry
%TEMP%\IXP000.TMP\msg\m_croatian.wnry
<LS_APPDATA>\CSIDL_
%TEMP%\IXP000.TMP\1.xy_
%TEMP%\IXP000.TMP\1.xyz
%TEMP%\IXP000.TMP\c.wnry
%TEMP%\IXP000.TMP\b.wnry
<LS_APPDATA>\CSIDL_X
%TEMP%\IXP000.TMP\msg\m_dutch.wnry
%TEMP%\IXP000.TMP\msg\m_japanese.wnry
%TEMP%\IXP000.TMP\msg\m_italian.wnry
%TEMP%\IXP000.TMP\msg\m_indonesian.wnry
%TEMP%\IXP000.TMP\msg\m_norwegian.wnry
%TEMP%\IXP000.TMP\msg\m_latvian.wnry
%TEMP%\IXP000.TMP\msg\m_korean.wnry
%TEMP%\IXP000.TMP\msg\m_finnish.wnry
%TEMP%\IXP000.TMP\msg\m_filipino.wnry
%TEMP%\IXP000.TMP\msg\m_english.wnry
%TEMP%\IXP000.TMP\msg\m_greek.wnry
%TEMP%\IXP000.TMP\msg\m_german.wnry
%TEMP%\IXP000.TMP\msg\m_french.wnry
C:\Far2\Addons\Colors\@WanaDecryptor@.exe
C:\Far2\Addons\Colors\@Please_Read_Me@.txt
C:\Far2\Addons\@WanaDecryptor@.exe
C:\Far2\Addons\Colors\Default Highlighting\@Please_Read_Me@.txt
C:\Far2\Addons\Colors\Custom Highlighting\@WanaDecryptor@.exe.lnk
C:\Far2\Addons\Colors\Custom Highlighting\@Please_Read_Me@.txt
%HOMEPATH%\Templates\@WanaDecryptor@.exe
%HOMEPATH%\Templates\@Please_Read_Me@.txt
%HOMEPATH%\Templates\winword2.doc.WNCRYT
C:\Far2\Addons\@Please_Read_Me@.txt
C:\Far2\@WanaDecryptor@.exe
C:\Far2\@Please_Read_Me@.txt
C:\Far2\Addons\Colors\Default Highlighting\@WanaDecryptor@.exe.lnk
C:\Far2\Documentation\rus\Arc.Support.txt.WNCRYT
C:\Far2\Documentation\eng\@WanaDecryptor@.exe
C:\Far2\Documentation\eng\@Please_Read_Me@.txt
C:\Far2\Documentation\rus\Plugins.Install.txt.WNCRYT
C:\Far2\Documentation\rus\Far.FAQ.txt.WNCRYT
C:\Far2\Documentation\rus\Bug.Report.txt.WNCRYT
C:\Far2\Documentation\eng\Far.FAQ.txt.WNCRYT
C:\Far2\Documentation\eng\Bug.Report.txt.WNCRYT
C:\Far2\Documentation\eng\Arc.Support.txt.WNCRYT
C:\Far2\Documentation\eng\TechInfo.txt.WNCRYT
C:\Far2\Documentation\eng\Plugins.Review.txt.WNCRYT
C:\Far2\Documentation\eng\Plugins.Install.txt.WNCRYT
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\@Please_Read_Me@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\@Please_Read_Me@.txt
%TEMP%\IXP000.TMP\m.vbs
C:\Documents and Settings\Default User\Templates\powerpnt.ppt.WNCRYT
C:\Documents and Settings\Default User\Templates\excel4.xls.WNCRYT
C:\Documents and Settings\Default User\Templates\excel.xls.WNCRYT
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.WNCRYT
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\@Please_Read_Me@.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.WNCRYT
C:\@WanaDecryptor@.exe
C:\@Please_Read_Me@.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.WNCRYT
C:\Documents and Settings\Default User\Templates\winword.doc.WNCRYT
%HOMEPATH%\Templates\excel.xls.WNCRYT
<LS_APPDATA>\@WanaDecryptor@.exe.lnk
<LS_APPDATA>\@Please_Read_Me@.txt
%HOMEPATH%\Templates\winword.doc.WNCRYT
%HOMEPATH%\Templates\powerpnt.ppt.WNCRYT
%HOMEPATH%\Templates\excel4.xls.WNCRYT
C:\Documents and Settings\Default User\Templates\@WanaDecryptor@.exe
C:\Documents and Settings\Default User\Templates\@Please_Read_Me@.txt
C:\Documents and Settings\Default User\Templates\winword2.doc.WNCRYT
%TEMP%\IXP000.TMP\@WanaDecryptor@.exe.lnk
%APPDATA%\Microsoft\Internet Explorer\@Please_Read_Me@.txt
%APPDATA%\Microsoft\Internet Explorer\brndlog.txt.WNCRYT

Sets the 'hidden' attribute to the following files:

<LS_APPDATA>\CSIDL_X
<LS_APPDATA>\CSIDL_

Deletes the following files:

%TEMP%\103.WNCRYT
%TEMP%\IXP000.TMP\m.vbs

Moves the following files:

from C:\Far2\PluginSDK\Headers.pas\FarColorW.pas.WNCRYT to C:\Far2\PluginSDK\Headers.pas\FarColorW.pas.WNCRY
from C:\Far2\PluginSDK\Headers.pas\FarKeysW.pas.WNCRYT to C:\Far2\PluginSDK\Headers.pas\FarKeysW.pas.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.H.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.H.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.H.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.H.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CREGEXP.CPP.WNCRY
from C:\Far2\PluginSDK\Headers.pas\PluginW.pas.WNCRYT to C:\Far2\PluginSDK\Headers.pas\PluginW.pas.WNCRY
from C:\Documents and Settings\Default User\Templates\sndrec.wav.WNCRYT to C:\Documents and Settings\Default User\Templates\sndrec.wav.WNCRY
from %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.WNCRYT to %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.WNCRY
from C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.WNCRYT to C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.WNCRY
from C:\AUTOEXEC.BAT.WNCRYT to C:\AUTOEXEC.BAT.WNCRY
from C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak.WNCRYT to C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\RegExp\CLOCALE.CPP.WNCRY
from C:\Far2\Plugins\Colorer\hrc\common.jar.WNCRYT to C:\Far2\Plugins\Colorer\hrc\common.jar.WNCRY
from C:\Far2\Plugins\Colorer\hrc\auto\types\auto.jar.WNCRYT to C:\Far2\Plugins\Colorer\hrc\auto\types\auto.jar.WNCRY
from C:\Far2\Addons\Colors\import_colors.bat.WNCRYT to C:\Far2\Addons\Colors\import_colors.bat.WNCRY
from <LS_APPDATA>\IconCache.db.WNCRYT to <LS_APPDATA>\IconCache.db.WNCRY
from %HOMEPATH%\Templates\quattro.wb2.WNCRYT to %HOMEPATH%\Templates\quattro.wb2.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtChCase.cpp.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtSearchMix.cpp.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtSearchReg.cpp.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtSearch.cpp.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtMenu.cpp.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtRegExp.cpp.WNCRY
from <STUBS_DIR>\proc_banks.txt.WNCRYT to <STUBS_DIR>\proc_banks.txt.WNCRY
from <STUBS_DIR>\proc_browsers.txt.WNCRYT to <STUBS_DIR>\proc_browsers.txt.WNCRY
from <STUBS_DIR>\proc_av.txt.WNCRYT to <STUBS_DIR>\proc_av.txt.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ExtClipBoard.cpp.WNCRY
from <STUBS_DIR>\list_short.txt.WNCRYT to <STUBS_DIR>\list_short.txt.WNCRY
from <STUBS_DIR>\proc_fake.txt.WNCRYT to <STUBS_DIR>\proc_fake.txt.WNCRY
from <STUBS_DIR>\runall.bat.WNCRYT to <STUBS_DIR>\runall.bat.WNCRY
from %APPDATA%\tor\state.tmp to %APPDATA%\tor\state
from <STUBS_DIR>\proc_tools.txt.WNCRYT to <STUBS_DIR>\proc_tools.txt.WNCRY
from <STUBS_DIR>\proc_games.txt.WNCRYT to <STUBS_DIR>\proc_games.txt.WNCRY
from <STUBS_DIR>\proc_im.txt.WNCRYT to <STUBS_DIR>\proc_im.txt.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\esearch_debug.bat.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\esearch_debug.bat.WNCRY
from C:\Far2\ClearPluginsCache.cmd.WNCRYT to C:\Far2\ClearPluginsCache.cmd.WNCRY
from C:\Far2\RestoreSettings.cmd.WNCRYT to C:\Far2\RestoreSettings.cmd.WNCRY
from %HOMEPATH%\Templates\sndrec.wav.WNCRYT to %HOMEPATH%\Templates\sndrec.wav.WNCRY
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.WNCRY
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.WNCRY
from C:\Far2\SaveSettings.cmd.WNCRYT to C:\Far2\SaveSettings.cmd.WNCRY
from C:\Far2\Addons\Colors\Default Highlighting\import_colors.bat.WNCRYT to C:\Far2\Addons\Colors\Default Highlighting\import_colors.bat.WNCRY
from C:\Far2\Plugins\ExtSearch\sources\ESEARCH.BAT.WNCRYT to C:\Far2\Plugins\ExtSearch\sources\ESEARCH.BAT.WNCRY
from C:\Far2\Addons\Colors\Custom Highlighting\import_colors.bat.WNCRYT to C:\Far2\Addons\Colors\Custom Highlighting\import_colors.bat.WNCRY
from C:\Far2\Addons\README.TXT.WNCRYT to C:\Far2\Addons\README.TXT.WNCRY
from C:\Far2\Addons\Colors\export_colors.bat.WNCRYT to C:\Far2\Addons\Colors\export_colors.bat.WNCRY
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.WNCRY
from %HOMEPATH%\Templates\winword.doc.WNCRYT to %HOMEPATH%\Templates\winword.doc.WNCRY
from %HOMEPATH%\Templates\winword2.doc.WNCRYT to %HOMEPATH%\Templates\winword2.doc.WNCRY
from %HOMEPATH%\Templates\powerpnt.ppt.WNCRYT to %HOMEPATH%\Templates\powerpnt.ppt.WNCRY
from %HOMEPATH%\Templates\excel.xls.WNCRYT to %HOMEPATH%\Templates\excel.xls.WNCRY
from %HOMEPATH%\Templates\excel4.xls.WNCRYT to %HOMEPATH%\Templates\excel4.xls.WNCRY
from C:\Far2\Documentation\eng\Arc.Support.txt.WNCRYT to C:\Far2\Documentation\eng\Arc.Support.txt.WNCRY
from C:\Far2\Documentation\eng\Plugins.Review.txt.WNCRYT to C:\Far2\Documentation\eng\Plugins.Review.txt.WNCRY
from C:\Far2\Documentation\eng\TechInfo.txt.WNCRYT to C:\Far2\Documentation\eng\TechInfo.txt.WNCRY
from C:\Far2\Documentation\eng\Plugins.Install.txt.WNCRYT to C:\Far2\Documentation\eng\Plugins.Install.txt.WNCRY
from C:\Far2\Documentation\eng\Bug.Report.txt.WNCRYT to C:\Far2\Documentation\eng\Bug.Report.txt.WNCRY
from C:\Far2\Documentation\eng\Far.FAQ.txt.WNCRYT to C:\Far2\Documentation\eng\Far.FAQ.txt.WNCRY
from %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.WNCRYT to %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.WNCRY
from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.WNCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.WNCRY
from %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.WNCRYT to %ALLUSERSPROFILE%\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.WNCRY
from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.WNCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.WNCRY
from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.WNCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.WNCRY
from %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.WNCRYT to %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.WNCRY
from %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.WNCRYT to %ALLUSERSPROFILE%\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.WNCRY
from C:\Documents and Settings\Default User\Templates\winword.doc.WNCRYT to C:\Documents and Settings\Default User\Templates\winword.doc.WNCRY
from C:\Documents and Settings\Default User\Templates\winword2.doc.WNCRYT to C:\Documents and Settings\Default User\Templates\winword2.doc.WNCRY
from C:\Documents and Settings\Default User\Templates\powerpnt.ppt.WNCRYT to C:\Documents and Settings\Default User\Templates\powerpnt.ppt.WNCRY
from C:\Documents and Settings\Default User\Templates\excel.xls.WNCRYT to C:\Documents and Settings\Default User\Templates\excel.xls.WNCRY
from C:\Documents and Settings\Default User\Templates\excel4.xls.WNCRYT to C:\Documents and Settings\Default User\Templates\excel4.xls.WNCRY
from C:\Far2\Plugins\FTP\Notes.txt.WNCRYT to C:\Far2\Plugins\FTP\Notes.txt.WNCRY
from C:\Far2\Plugins\FTP\Notes_rus.txt.WNCRYT to C:\Far2\Plugins\FTP\Notes_rus.txt.WNCRY
from C:\Far2\Plugins\FTP\FtpCmds_rus.txt.WNCRYT to C:\Far2\Plugins\FTP\FtpCmds_rus.txt.WNCRY
from C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.WNCRY
from C:\Far2\Plugins\FTP\FtpCmds.txt.WNCRYT to C:\Far2\Plugins\FTP\FtpCmds.txt.WNCRY
from <STUBS_DIR>\list_full.txt.WNCRYT to <STUBS_DIR>\list_full.txt.WNCRY
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.WNCRY
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.WNCRY
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.WNCRYT to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.WNCRY
from C:\startup_local.bat.WNCRYT to C:\startup_local.bat.WNCRY
from C:\Documents and Settings\Default User\Templates\quattro.wb2.WNCRYT to C:\Documents and Settings\Default User\Templates\quattro.wb2.WNCRY
from C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.WNCRY
from C:\Far2\Documentation\rus\Plugins.Install.txt.WNCRYT to C:\Far2\Documentation\rus\Plugins.Install.txt.WNCRY
from C:\Far2\Documentation\rus\Plugins.Review.txt.WNCRYT to C:\Far2\Documentation\rus\Plugins.Review.txt.WNCRY
from C:\Far2\Documentation\rus\Far.FAQ.txt.WNCRYT to C:\Far2\Documentation\rus\Far.FAQ.txt.WNCRY
from C:\Far2\Documentation\rus\Arc.Support.txt.WNCRYT to C:\Far2\Documentation\rus\Arc.Support.txt.WNCRY
from C:\Far2\Documentation\rus\Bug.Report.txt.WNCRYT to C:\Far2\Documentation\rus\Bug.Report.txt.WNCRY
from C:\Far2\Documentation\rus\TechInfo.txt.WNCRYT to C:\Far2\Documentation\rus\TechInfo.txt.WNCRY
from C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.WNCRY
from C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.WNCRY
from C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.WNCRYT to C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.WNCRY
from C:\Far2\Plugins\7-Zip\far7z.txt.WNCRYT to C:\Far2\Plugins\7-Zip\far7z.txt.WNCRY
from C:\Far2\Plugins\Colorer\hrc\changes.txt.WNCRYT to C:\Far2\Plugins\Colorer\hrc\changes.txt.WNCRY

Changes user data files extensions (Trojan.Encoder).

Network activity:

Connects to:

'19#.#54.238.52':443
'62.##0.129.246':443
'17#.#2.197.82':443
'37.##7.195.87':443
'19#.#3.244.244':443
'localhost':1037
'localhost':9050
'80.##7.137.19':443
'21#.#1.66.117':9002
'19#.#09.206.212':443

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'Progman' WindowName: ''
ClassName: '' WindowName: 'Wana Decrypt0r 2.0'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial