Trojan.Encoder.39002

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\windows update

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)
Registry Editor (RegEdit)
Windows Defender

modifies the following system settings:

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'DisallowRun' = '00000001'

Reads files which store third party applications passwords

%HOMEPATH%\desktop\1189.jpg
%HOMEPATH%\desktop\pushkin.jpg
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\ituneshelpunavailable.html
%HOMEPATH%\desktop\trivial-merge.html
%HOMEPATH%\desktop\iisstart.html
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\adadsi.html
%HOMEPATH%\desktop\210252809.jpg
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\tree_view.html

Modifies file system

Creates the following files

%TEMP%\tmpb367.tmp
<Current directory>\gxcso0pc.sos
<Current directory>\aikdvvnf.sos
<Current directory>\cos0xhgk.sos
<Current directory>\3kdess0w.sos
<Current directory>\5lyggr51.sos
<Current directory>\rgaw2ywd.sos
<Current directory>\d1zb2sqx.sos
<Current directory>\dpk1xtno.sos
<Current directory>\bd1gycu2.sos
<Current directory>\dpqdgxeq.sos
<Current directory>\faid25hq.sos
<Current directory>\0japgm1y.sos
<Current directory>\ihbwlnar.sos
<Current directory>\0d2ctvqw.sos
<Current directory>\o4yukwei.sos
<Current directory>\xl22rrx3.sos
<Current directory>\ccksgcid.sos
<Current directory>\klt4g4nz.sos
<Current directory>\ndd5gsgu.sos
<Current directory>\qaws3lca.sos
<Current directory>\fydbfvag.sos
<Current directory>\1rzaihbs.sos
<Current directory>\zaz4chnd.sos
<Current directory>\o3afeink.sos
<Current directory>\sfrferu3.sos
<Current directory>\xet4rozu.sos
<Current directory>\vw3w5yhq.sos
<Current directory>\izx4cfyp.sos
<Current directory>\l4zx3iru.sos
<Current directory>\aben5nbi.sos
<Current directory>\gwjggah5.sos
<Current directory>\imeyoyoa.sos
<Current directory>\z3enp5v5.sos
<Current directory>\rmtrnrxd.sos
<Current directory>\nto1qqpd.sos
<Current directory>\deolfk5m.sos
<Current directory>\t4i0hrjh.sos
<Current directory>\3hh43mko.sos
<Current directory>\fjo53lkt.sos
<Current directory>\tpzoiidc.sos
<Current directory>\00bbtc21.sos
<Current directory>\vlxcygwb.sos
<Current directory>\5yhiplls.sos
<Current directory>\fvi1vh5x.sos
<Current directory>\ecc5kgyu.sos
<Current directory>\pgjdqedr.sos
<Current directory>\gtg4bev1.sos
<Current directory>\p3a1u41g.sos
<Current directory>\xcj3ngfk.sos
<Current directory>\5uptmek3.sos
<Current directory>\wvofyjq5.sos
<Current directory>\nu3fm4tp.sos
<Current directory>\ezag1zwn.sos
<Current directory>\davkc32u.sos
<Current directory>\ovn4vvbx.sos
<Current directory>\fgtjw5nl.sos
<Current directory>\wkigvjts.sos
<Current directory>\emnpo2bl.sos
<Current directory>\4bj4gk5m.sos
<Current directory>\vm2kgqjx.sos
<Current directory>\1rnrh5ve.sos
<Current directory>\kqpdg1ze.sos
<Current directory>\v434zrtj.sos
<Current directory>\qmcscp4y.sos
<Current directory>\n2yfqnqx.sos
<Current directory>\abboiy02.sos
<Current directory>\ywdn3dnb.sos
<Current directory>\woec2sil.sos
<Current directory>\daz3fcqp.sos
<Current directory>\stzqjnbk.sos
<Current directory>\hpd4pbrt.sos
<Current directory>\t33wztbv.sos
<Current directory>\i0ygsnk3.sos
<Current directory>\mckegyqv.sos
<Current directory>\4rd5ddes.sos
<Current directory>\5qe4rep5.sos
<Current directory>\itiqyhd3.sos
<Current directory>\2jlfvgol.sos
<Current directory>\5rofmdh1.sos
<Current directory>\h0k1efeg.sos
<Current directory>\1nih1gta.sos
<Current directory>\wl50dr0g.sos
<Current directory>\qdo5jtlg.sos
<Current directory>\o4jpubfg.sos
<Current directory>\amufvtjv.sos
<Current directory>\m1tesbyt.sos
<Current directory>\njcpxuoe.sos
<Current directory>\lcxm04l3.sos
<Current directory>\rx5uyrmi.sos
<Current directory>\5kiyu5ej.sos
<Current directory>\tmswno54.sos
<Current directory>\nw12m0ia.sos
<Current directory>\2lp21vwx.sos
<Current directory>\qwapsqlk.sos
<Current directory>\lib5g4wk.sos
<Current directory>\jvcit3j2.sos
<Current directory>\1cgsrbbs.sos
<Current directory>\fqqgor1m.sos
<Current directory>\jkyciveg.sos
<Current directory>\leniddd5.sos
<Current directory>\jte3gmm1.sos
<Current directory>\kew3nids.sos
<Current directory>\d41kcwwj.sos
<Current directory>\4iz3o1rj.sos
<Current directory>\dymh1h3s.sos
<Current directory>\v0xgiyzn.sos
<Current directory>\jpdsmfts.sos
<Current directory>\cbaopp2m.sos
<Current directory>\pofm0f3f.sos
<Current directory>\t031e2kv.sos
<Current directory>\x2ynzz5t.sos
<Current directory>\gjbxay3n.sos
<Current directory>\clqfrsgh.sos
<Current directory>\qyh5g1ao.sos
<Current directory>\qgblripj.sos
<Current directory>\mvvt1rwj.sos
<Current directory>\if2dk1zn.sos
<Current directory>\gn3kbk23.sos
<Current directory>\uylrsmkj.sos
<Current directory>\z2cktzap.sos
<Current directory>\p02olrg5.sos
<Current directory>\1phokry2.sos
<Current directory>\no3evbiu.sos
<Current directory>\dywd2nhq.sos
<Current directory>\pmpcfwqj.sos
<Current directory>\fobqzmyx.sos
<Current directory>\iw0elykt.sos
<Current directory>\3gn1twuc.sos
<Current directory>\flmpcvas.sos
<Current directory>\1cc3gwla.sos
<Current directory>\54imo4fq.sos
<Current directory>\mglqj3oq.sos
<Current directory>\on4gghqn.sos
<Current directory>\hbx0myfp.sos
<Current directory>\cw1eoxvr.sos
<Current directory>\q5shmgws.sos
<Current directory>\4ac4eszy.sos
<Current directory>\lcd2wacs.sos
<Current directory>\1mfuj4oa.sos
<Current directory>\mwb3knc5.sos
<Current directory>\zvax22ie.sos
<Current directory>\r0vsmpmd.sos
<Current directory>\m1pao4jq.sos
<Current directory>\4fcvzymp.sos
<Current directory>\rbjd3qhf.sos
<Current directory>\3kscyn5a.sos
<Current directory>\dlxc3m45.sos
<Current directory>\hhjslbdz.sos
<Current directory>\i4dhgv2m.sos
<Current directory>\r00hyfqw.sos
<Current directory>\13cnra3x.sos
<Current directory>\sv0wutgz.sos
<Current directory>\0jeutx4u.sos
<Current directory>\xe0dasol.sos
<Current directory>\wmnc10cd.sos
<Current directory>\rgdu2xdo.sos
<Current directory>\cuxyixy3.sos
<Current directory>\ez3zivxh.sos
<Current directory>\bba1vle0.sos
<Current directory>\lt01z324.sos
<Current directory>\uki4qgx1.sos
<Current directory>\yqpqlhd0.sos
<Current directory>\p4iswz3i.sos
<Current directory>\iksbodmu.sos
<Current directory>\ar4zybzp.sos
<Current directory>\vbmoxozp.sos
<Current directory>\qpdgxlnt.sos
<Current directory>\4xdimto0.sos
<Current directory>\lgsoxm1h.sos
<Current directory>\eeat2y2p.sos
<Current directory>\tfoorrka.sos
<Current directory>\x0lefj00.sos
<Current directory>\outy0guw.sos
<Current directory>\yfb5ju3i.sos
<Current directory>\0q3ijcdf.sos
<Current directory>\arg3h5yp.sos
<Current directory>\ldmztrcv.sos
<Current directory>\peo0etlm.sos
<Current directory>\vz1sgbym.sos
<Current directory>\2hyveswy.sos
<Current directory>\dibic3bw.sos
<Current directory>\p0qrs1gd.sos
<Current directory>\tgeqc1xq.sos
<Current directory>\4wdyxsib.sos
<Current directory>\45fhe5he.sos
<Current directory>\fwztspmv.sos
<Current directory>\rxabuthz.sos
<Current directory>\beln03jh.sos
<Current directory>\5gfxhejp.sos
<Current directory>\smwo4plq.sos
<Current directory>\ouwjdqok.sos
<Current directory>\rgmbclux.sos
<Current directory>\3m1g241x.sos
<Current directory>\hsvkiijy.sos
<Current directory>\oj1xkmkr.sos
<Current directory>\wqf5izno.sos
<Current directory>\j3mu3fcc.sos
<Current directory>\d34gnmsi.sos
<Current directory>\yztp1hjg.sos
<Current directory>\k5sdr13c.sos
<Current directory>\hwlal2zf.sos
<Current directory>\dbz3d2n2.sos
<Current directory>\vd2jckn5.sos
<Current directory>\z5ot1le3.sos
<Current directory>\55ejnens.sos
<Current directory>\ra1woneu.sos
<Current directory>\keatc52c.sos
<Current directory>\xxqonrkg.sos
<Current directory>\o55i31oy.sos
<Current directory>\scnlareb.sos
<Current directory>\jzbfw3te.sos
<Current directory>\rnwsgcyb.sos
<Current directory>\l3axuqtg.sos
<Current directory>\enbffpx2.sos
<Current directory>\egzckyus.sos
<Current directory>\izv2xhnx.sos
<Current directory>\0x11mwvc.sos
<Current directory>\fh1fh1hz.sos
<Current directory>\ggichq2p.sos
<Current directory>\dlp0tz5c.sos
<Current directory>\tomecaj3.sos
<Current directory>\pfl2wz5m.sos
<Current directory>\4sdpvtzk.sos
<Current directory>\zyglkclm.sos
<Current directory>\lovkhc1u.sos
<Current directory>\tqa15xak.sos
<Current directory>\tofj1sof.sos
<Current directory>\yvrhiszx.sos
<Current directory>\jqxg1zjh.sos
<Current directory>\n2stquf2.sos
<Current directory>\t1jblyyu.sos
<Current directory>\p10rdpeh.sos
<Current directory>\v5s0ms04.sos
<Current directory>\eyw2lhjs.sos
<Current directory>\fj53rlll.sos
<Current directory>\sdcztcsx.sos
<Current directory>\xd4vqkdf.sos
<Current directory>\h5ink3ko.sos
<Current directory>\bx00402b.sos
<Current directory>\z04qdpgt.sos
<Current directory>\qikcj2dg.sos
<Current directory>\iyxgillc.sos
<Current directory>\pa1qjuu0.sos
<Current directory>\tzateoo5.sos
<Current directory>\i22zzfx3.sos
<Current directory>\1oihslur.sos
<Current directory>\c2beco5c.sos
<Current directory>\d1xdantw.sos
<Current directory>\zmhe0k5x.sos
<Current directory>\kxcy3lv4.sos
<Current directory>\w00jzct4.sos
<Current directory>\gpaemmna.sos
<Current directory>\xf4qairs.sos
<Current directory>\igffpges.sos
<Current directory>\ottgpxqw.sos
<Current directory>\finilvhi.sos
<Current directory>\letqvwr1.sos
<Current directory>\owwqenfg.sos
<Current directory>\y4dqrnw2.sos
<Current directory>\ejijnh2o.sos
<Current directory>\ay1edrjl.sos
<Current directory>\3llty4gq.sos
<Current directory>\s0y13h3c.sos
<Current directory>\41pzggpu.sos
<Current directory>\233smbzz.sos
<Current directory>\3jbsxagm.sos
<Current directory>\phqpr4ac.sos
<Current directory>\i3czxlkm.sos
<Current directory>\l0ppneee.sos
<Current directory>\ty3i0rbu.sos
<Current directory>\yit4pl2y.sos
<Current directory>\cslsy3cy.sos
<Current directory>\m3lcplpk.sos
<Current directory>\0p5agsu2.sos
<Current directory>\b3ph5isb.sos
<Current directory>\3ye5ux1s.sos
<Current directory>\tgwqflrn.sos
<Current directory>\bmjuvnab.sos
<Current directory>\ivi1ybcm.sos
<Current directory>\yvzvense.sos
<Current directory>\qrlugahn.sos
<Current directory>\img0lkff.sos
<Current directory>\ymprgjkf.sos
<Current directory>\1ztcq3ws.sos
<Current directory>\sv2n0nzr.sos
<Current directory>\eageanqa.sos
<Current directory>\sx0iurnc.sos
<Current directory>\v2vyed3q.sos
<Current directory>\ouzpijpu.sos
<Current directory>\ckuc3n1y.sos
<Current directory>\sa5dfr5n.sos
<Current directory>\jpq1vrlw.sos
<Current directory>\w2zqp04p.sos
<Current directory>\xzrqlyvc.sos
%WINDIR%\syswow64\<File name>.exe
<Current directory>\gdzd4pqj.sos
<Current directory>\ilxghbfk.sos
<Current directory>\we1xonwk.sos
<Current directory>\mldov123.sos
<Current directory>\yksmsfjb.sos
<Current directory>\2ff1slpz.sos
<Current directory>\xz5lbe44.sos
<Current directory>\myhldu2j.sos
<Current directory>\42ahwj42.sos
<Current directory>\bdojuoxo.sos
<Current directory>\mltmskth.sos
<Current directory>\do1oydye.sos
<Current directory>\ao12ppel.sos
<Current directory>\lpbzhljr.sos
<Current directory>\hpevwmpj.sos
<Current directory>\xu52yldh.sos
<Current directory>\nlpfg1jh.sos
<Current directory>\wtageym4.sos
<Current directory>\g0rutppc.sos
<Current directory>\0einuvja.sos
<Current directory>\snhxj0zc.sos
<Current directory>\p4wat22m.sos
<Current directory>\si2dryd5.sos
<Current directory>\ppsoleba.sos
<Current directory>\utzoifgc.sos
<Current directory>\lbsrnwam.sos
<Current directory>\mzsansqg.sos
<Current directory>\gskhaztr.sos
<Current directory>\v4cet51u.sos
<Current directory>\ge04ewcb.sos
<Current directory>\2ezezcqt.sos
<Current directory>\s5yssp2g.sos
<Current directory>\23qi5fng.sos
<Current directory>\2rzycezv.sos
<Current directory>\pi10v54r.sos
<Current directory>\scuom2zf.sos
<Current directory>\uur0fdzy.sos
<Current directory>\hg2f5thd.sos
<Current directory>\z12afx5l.sos
<Current directory>\hfu2s4lt.sos
<Current directory>\pdws3l0y.sos
<Current directory>\szgevnc2.sos
<Current directory>\vyekyppe.sos
<Current directory>\4qpxh4gz.sos
<Current directory>\hmljrhlj.sos
<Current directory>\w13suzak.sos
<Current directory>\noxsjquy.sos
<Current directory>\bodpdps5.sos
<Current directory>\oo0bnhf2.sos
<Current directory>\3feqeryb.sos
<Current directory>\wnbicfvk.sos
<Current directory>\i2jt1eg3.sos
<Current directory>\mknunbz4.sos
<Current directory>\rssel5cr.sos
<Current directory>\5xt3f2kc.sos
<Current directory>\tmltggmr.sos
<Current directory>\2bkkroer.sos
<Current directory>\d5dqqosz.sos
<Current directory>\srj3wcky.sos
<Current directory>\1xsya4hj.sos
<Current directory>\cmibmt2p.sos
<Current directory>\yfzuaeqw.sos
<Current directory>\0six1l1o.sos
<Current directory>\wdq2tzgw.sos
<Current directory>\2uq0pvoc.sos
<Current directory>\x1sckrpm.sos
<Current directory>\adl3c3rj.sos
<Current directory>\a02amfcg.sos
<Current directory>\5kapltbn.sos
<Current directory>\upn40b5o.sos
<Current directory>\kkv5ne5h.sos
<Current directory>\kv0ajseq.sos
<Current directory>\a2khkqxa.sos
<Current directory>\p4zl4nzx.sos
<Current directory>\044ymxjc.sos
<Current directory>\ttpxwufz.sos
<Current directory>\kdbedgxc.sos
<Current directory>\fijkx1ex.sos
<Current directory>\gvymtsps.sos
<Current directory>\nvqg2ihp.sos
<Current directory>\agphcrpc.sos
<Current directory>\cg5sc2xb.sos
<Current directory>\zuglhwdn.sos
<Current directory>\tev0yzqo.sos
<Current directory>\ncypgj4f.sos
<Current directory>\pm2pn0yh.sos
<Current directory>\gs0axu5i.sos
<Current directory>\foqck14z.sos
<Current directory>\spjbxf4g.sos
<Current directory>\pcjq0gxj.sos
<Current directory>\carnvjyq.sos
<Current directory>\jtrubsu1.sos
<Current directory>\3k0tlmgd.sos
<Current directory>\pox51xsm.sos
<Current directory>\4e1a3j0k.sos
<Current directory>\zyefbrlj.sos
<Current directory>\a1iyzraq.sos
<Current directory>\u2cabtji.sos
<Current directory>\ojvtqeue.sos
<Current directory>\43tbii5k.sos
<Current directory>\e2bfyw1l.sos
<Current directory>\o0iqixgg.sos
<Current directory>\hbtwpnc2.sos
<Current directory>\gfrrdobf.sos
<Current directory>\oue1qxfp.sos
<Current directory>\wje5deps.sos
<Current directory>\3d3yf0v1.sos
<Current directory>\cwsmzfen.sos
<Current directory>\ntg4uaew.sos
<Current directory>\yaggkcdv.sos
<Current directory>\zkbpblbx.sos
<Current directory>\41oyii3v.sos
<Current directory>\mwqkri4h.sos
<Current directory>\h1bptlyk.sos
<Current directory>\1mtnto4d.sos
<Current directory>\nsgtvxum.sos
<Current directory>\f1u2pq1u.sos
<Current directory>\qwdbsbff.sos
<Current directory>\2oyiude5.sos
<Current directory>\oii5nnek.sos
<Current directory>\rujllykj.sos
<Current directory>\sjudhx5o.sos
<Current directory>\n3nnfiv0.sos
<Current directory>\paki2n14.sos
<Current directory>\y51b5buw.sos
<Current directory>\f2wludzy.sos
<Current directory>\c0gig5gc.sos
<Current directory>\jsswxeyj.sos
<Current directory>\pjbfrstl.sos
<Current directory>\whardk2v.sos
<Current directory>\f5zovngp.sos
<Current directory>\e5qbrmil.sos
<Current directory>\m42r03xx.sos
<Current directory>\eztgjnxp.sos
<Current directory>\rsdlg3xq.sos
<Current directory>\jasenpbm.sos
<Current directory>\rrc2lmcu.sos
<Current directory>\pk5ubv33.sos
<Current directory>\3hjskouf.sos
<Current directory>\z4vmakwd.sos
<Current directory>\jucw3hqj.sos

Moves the following system files

from %WINDIR%\professionaleducation.xml to <Current directory>\sws3ks1h.sos
from %WINDIR%\professionalworkstation.xml to <Current directory>\s5foevbw.sos
from %WINDIR%\serverrdsh.xml to <Current directory>\bj5ldfom.sos
from %WINDIR%\education.xml to <Current directory>\jiu2kuhh.sos
from %WINDIR%\enterprise.xml to <Current directory>\n0vyc41l.sos
from %WINDIR%\professional.xml to <Current directory>\g4l5bfgd.sos
from %WINDIR%\fonts\fms_metadata.xml to <Current directory>\bhjwrqxn.sos
from %WINDIR%\identitycrl\wlive48x48.png to <Current directory>\5i31qeu3.sos
from %WINDIR%\appcompat\programs\install\install_ffff_697d9b86-6ade-46f3-a917-2aeb844ae975.txt to <Current directory>\euvqgg1h.sos

Moves the following files

from %APPDATA%\mozilla\firefox\profiles\la5zhz1m.default-release\prefs.js to <Current directory>\5qe4rep5.sos

Modifies the following files

%APPDATA%\microsoft\windows\themes\transcodedwallpaper
%APPDATA%\microsoft\windows\themes\cachedfiles\cachedimage_1152_864_pos2.jpg

Network activity

Connects to

'ra#.####ubusercontent.com':443

TCP

Other

'ra#.####ubusercontent.com':443

UDP

DNS ASK ra#.####ubusercontent.com

Miscellaneous

Executes the following

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Get-MpPreference -verbose
'%WINDIR%\syswow64\schtasks.exe' /create /tn "Windows Update" /tr "%WINDIR%\SysWOW64\Eleven.exe" /sc MINUTE /mo 1 /ru SYSTEM /f /rl HIGHEST
'%WINDIR%\syswow64\schtasks.exe' /create /tn "Windows Update" /tr "%WINDIR%\SysWOW64\Eleven.exe" /sc MINUTE /mo 1 /ru SYSTEM /f /rl HIGHEST' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial