Trojan.Encoder.29723

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\_nemty_o6dttbk_

Creates the following files on removable media

<Drive name for removable media>:\_nemty_o6dttbk_-decrypt.txt
<Drive name for removable media>:\february_catalogue__2015.doc
<Drive name for removable media>:\cveuropeo.doc
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\dashborder_120.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\delete.avi
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im sql.*
'%WINDIR%\syswow64\net.exe' stop SQLAgent$SQLEXPRESS
'%WINDIR%\syswow64\net.exe' stop SQLBrowser
'%WINDIR%\syswow64\net.exe' stop AcrSch2Svc
'%WINDIR%\syswow64\net.exe' stop Apache2.4
'%WINDIR%\syswow64\taskkill.exe' /f /im Flow.*
'%WINDIR%\syswow64\net.exe' stop SQLWriter
'%WINDIR%\syswow64\net.exe' stop MSSQL$SQLEXPRESS
'%WINDIR%\syswow64\net.exe' stop AcronisAgent
'%WINDIR%\syswow64\net.exe' stop cbVSCService11
'%WINDIR%\syswow64\net.exe' stop MSSQLServerADHelper100
'%WINDIR%\syswow64\net.exe' stop QBCFMontorService
'%WINDIR%\syswow64\net.exe' stop OracleServiceXE
'%WINDIR%\syswow64\net.exe' stop OracleXETNSListener
'%WINDIR%\syswow64\net.exe' stop MongoDB
'%WINDIR%\syswow64\taskkill.exe' /f /im thunderbird.*
'%WINDIR%\syswow64\taskkill.exe' /f /im excel.*
'%WINDIR%\syswow64\taskkill.exe' /f /im WBGX.*
'%WINDIR%\syswow64\net.exe' stop
'%WINDIR%\syswow64\net.exe' stop QBVSS
'%WINDIR%\syswow64\taskkill.exe' /f /im node.*
'%WINDIR%\syswow64\taskkill.exe' /f /im QBW32.*
'%WINDIR%\syswow64\taskkill.exe' /f /im onenote.*
'%WINDIR%\syswow64\taskkill.exe' /f /im virtualboxvm.*
'%WINDIR%\syswow64\taskkill.exe' /f /im wordpad.*
'%WINDIR%\syswow64\taskkill.exe' /f /im outlook.*
'%WINDIR%\syswow64\taskkill.exe' /f /im oracle.*
'%WINDIR%\syswow64\taskkill.exe' /f /im Teams.*
'%WINDIR%\syswow64\taskkill.exe' /f /im winword.*
'%WINDIR%\syswow64\net.exe' stop DbxSvc
'%WINDIR%\syswow64\net.exe' stop CobianBackup11

Modifies file system

Creates the following files

%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\650860e5119ec19a8de142e32f03c712_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
C:\far2\plugins\compare\_nemty_o6dttbk_-decrypt.txt
C:\far2\plugins\drawline\_nemty_o6dttbk_-decrypt.txt
C:\far2\plugins\editcase\_nemty_o6dttbk_-decrypt.txt
C:\far2\plugins\emenu\_nemty_o6dttbk_-decrypt.txt
C:\far2\plugins\farcmds\_nemty_o6dttbk_-decrypt.txt
C:\far2\plugins\filecase\_nemty_o6dttbk_-decrypt.txt
C:\far2\plugins\ftp\_nemty_o6dttbk_-decrypt.txt
C:\far2\plugins\ftp\lib\_nemty_o6dttbk_-decrypt.txt
C:\far2\plugins\autowrap\_nemty_o6dttbk_-decrypt.txt
C:\far2\plugins\brackets\_nemty_o6dttbk_-decrypt.txt
C:\far2\plugins\hlfviewer\_nemty_o6dttbk_-decrypt.txt
C:\far2\plugins\proclist\_nemty_o6dttbk_-decrypt.txt
C:\far2\plugins\tmppanel\_nemty_o6dttbk_-decrypt.txt
C:\far2\pluginsdk\_nemty_o6dttbk_-decrypt.txt
C:\far2\pluginsdk\headers.c\_nemty_o6dttbk_-decrypt.txt
C:\far2\pluginsdk\headers.pas\_nemty_o6dttbk_-decrypt.txt
C:\msocache\_nemty_o6dttbk_-decrypt.txt
C:\msocache\all users\_nemty_o6dttbk_-decrypt.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\_nemty_o6dttbk_-decrypt.txt
C:\far2\plugins\macroview\_nemty_o6dttbk_-decrypt.txt
C:\far2\plugins\network\_nemty_o6dttbk_-decrypt.txt
C:\far2\plugins\arclite\_nemty_o6dttbk_-decrypt.txt
C:\far2\plugins\align\_nemty_o6dttbk_-decrypt.txt
C:\far2\plugins\_nemty_o6dttbk_-decrypt.txt
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\94a9cdfb09e37d01f75d09c2c4488906_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
C:\_nemty_o6dttbk_-decrypt.txt
C:\documents and settings\_nemty_o6dttbk_-decrypt.txt
D:\_nemty_o6dttbk_-decrypt.txt
C:\far2\_nemty_o6dttbk_-decrypt.txt
C:\far2\addons\colors\_nemty_o6dttbk_-decrypt.txt
C:\far2\addons\_nemty_o6dttbk_-decrypt.txt
C:\far2\addons\colors\custom_highlighting\_nemty_o6dttbk_-decrypt.txt
C:\far2\addons\colors\default_highlighting\_nemty_o6dttbk_-decrypt.txt
%HOMEPATH%\adobeupdate.exe
C:\far2\addons\macros\_nemty_o6dttbk_-decrypt.txt
C:\far2\addons\shell\_nemty_o6dttbk_-decrypt.txt
C:\far2\addons\xlat\_nemty_o6dttbk_-decrypt.txt
C:\far2\addons\xlat\russian\_nemty_o6dttbk_-decrypt.txt
C:\far2\documentation\_nemty_o6dttbk_-decrypt.txt
C:\far2\documentation\eng\_nemty_o6dttbk_-decrypt.txt
C:\far2\documentation\rus\_nemty_o6dttbk_-decrypt.txt
C:\far2\encyclopedia\_nemty_o6dttbk_-decrypt.txt
C:\far2\encyclopedia\tap\_nemty_o6dttbk_-decrypt.txt
C:\far2\fexcept\_nemty_o6dttbk_-decrypt.txt
C:\far2\addons\setup\_nemty_o6dttbk_-decrypt.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\_nemty_o6dttbk_-decrypt.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\_nemty_o6dttbk_-decrypt.txt

Sets the 'hidden' attribute to the following files

%HOMEPATH%\adobeupdate.exe

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

UDP

DNS ASK ap#.#pify.org
DNS ASK ne##y.hk

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=A: /on=A: /maxsize=401MB' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop DbxSvc' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop OracleXETNSListener' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop OracleServiceXE' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop AcrSch2Svc' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop AcronisAgent' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop Apache2.4' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop SQLWriter' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$SQLEXPRESS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQLServerADHelper100' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop MongoDB' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop SQLAgent$SQLEXPRESS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop SQLBrowser' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop CobianBackup11' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop cbVSCService11' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop QBCFMontorService' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop QBVSS' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im Flow.*' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c schtasks.exe /create /sc onstart /tn "_NEMTY_O6DTTBK_" /tr "%HOMEPATH%\AdobeUpdate.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im Teams.*' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im QBW32.*' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=A: /on=A: /maxsize=unbounded' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=D: /on=D: /maxsize=401MB' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=D: /on=D: /maxsize=unbounded' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=F: /on=F: /maxsize=401MB' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=F: /on=F: /maxsize=unbounded' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im sql.*' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im winword.*' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im wordpad.*' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im outlook.*' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im thunderbird.*' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im oracle.*' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im excel.*' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im onenote.*' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im virtualboxvm.*' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im node.*' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im WBGX.*' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowc...' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=A: /on=A: /maxsize=401MB
'%WINDIR%\syswow64\cmd.exe' /c net stop SQLBrowser
'%WINDIR%\syswow64\cmd.exe' /c net stop CobianBackup11
'%WINDIR%\syswow64\cmd.exe' /c net stop cbVSCService11
'%WINDIR%\syswow64\cmd.exe' /c net stop QBCFMontorService
'%WINDIR%\syswow64\cmd.exe' /c net stop QBVSS
'%WINDIR%\syswow64\cmd.exe' /c net stop
'%WINDIR%\syswow64\cmd.exe' /c schtasks.exe /create /sc onstart /tn "_NEMTY_O6DTTBK_" /tr "%HOMEPATH%\AdobeUpdate.exe"
'%WINDIR%\syswow64\cmd.exe' /c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowc...
'%WINDIR%\syswow64\schtasks.exe' /create /sc onstart /tn "_NEMTY_O6DTTBK_" /tr "%HOMEPATH%\AdobeUpdate.exe"
'<SYSTEM32>\vssvc.exe'
'%WINDIR%\syswow64\net1.exe' stop MongoDB
'%WINDIR%\syswow64\cmd.exe' /c net stop MongoDB
'%WINDIR%\syswow64\cmd.exe' /c net stop SQLAgent$SQLEXPRESS
'%WINDIR%\syswow64\net1.exe' stop AcrSch2Svc
'%WINDIR%\syswow64\net1.exe' stop QBVSS
'%WINDIR%\syswow64\net1.exe' stop CobianBackup11
'%WINDIR%\syswow64\net1.exe' stop OracleServiceXE
'%WINDIR%\syswow64\net1.exe' stop MSSQL$SQLEXPRESS
'%WINDIR%\syswow64\net1.exe' stop AcronisAgent
'%WINDIR%\syswow64\net1.exe' stop Apache2.4
'%WINDIR%\syswow64\net1.exe' stop SQLWriter
'%WINDIR%\syswow64\net1.exe' stop
'%WINDIR%\syswow64\net1.exe' stop OracleXETNSListener
'%WINDIR%\syswow64\net1.exe' stop cbVSCService11
'%WINDIR%\syswow64\net1.exe' stop MSSQLServerADHelper100
'%WINDIR%\syswow64\net1.exe' stop DbxSvc
'%WINDIR%\syswow64\net1.exe' stop QBCFMontorService
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQLServerADHelper100
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$SQLEXPRESS
'%WINDIR%\syswow64\cmd.exe' /c net stop SQLWriter
'%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB
'%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded
'%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=D: /on=D: /maxsize=401MB
'%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=D: /on=D: /maxsize=unbounded
'%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=F: /on=F: /maxsize=401MB
'%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=F: /on=F: /maxsize=unbounded
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im sql.*
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im winword.*
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im wordpad.*
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im outlook.*
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im thunderbird.*
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im oracle.*
'%WINDIR%\syswow64\cmd.exe' vssadmin resize shadowstorage /for=A: /on=A: /maxsize=unbounded
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im excel.*
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im virtualboxvm.*
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im node.*
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im QBW32.*
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im WBGX.*
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im Teams.*
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im Flow.*
'%WINDIR%\syswow64\cmd.exe' /c net stop DbxSvc
'%WINDIR%\syswow64\cmd.exe' /c net stop OracleXETNSListener
'%WINDIR%\syswow64\cmd.exe' /c net stop OracleServiceXE
'%WINDIR%\syswow64\cmd.exe' /c net stop AcrSch2Svc
'%WINDIR%\syswow64\cmd.exe' /c net stop AcronisAgent
'%WINDIR%\syswow64\cmd.exe' /c net stop Apache2.4
'%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im onenote.*
'%WINDIR%\syswow64\net1.exe' stop SQLAgent$SQLEXPRESS
'%WINDIR%\syswow64\net1.exe' stop SQLBrowser

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial