Trojan.Encoder.34027

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\how to decrypt files.txt
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\hanni_umami_chapter.doc
<Drive name for removable media>:\ovp25012015.doc
<Drive name for removable media>:\lisp_success.doc

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)

deletes volume shadow copies.

Modifies file system

Creates the following files

%ProgramFiles%\how to decrypt files.txt
C:\users\default\downloads\how to decrypt files.txt
C:\users\default\desktop\how to decrypt files.txt
C:\users\default\documents\how to decrypt files.txt
C:\users\default\how to decrypt files.txt
%HOMEPATH%\desktop\how to decrypt files.txt
D:\how to decrypt files.txt
C:\users\default\favorites\how to decrypt files.txt
D:\$recycle.bin\how to decrypt files.txt
%HOMEPATH%\links\how to decrypt files.txt
%HOMEPATH%\documents\how to decrypt files.txt
%HOMEPATH%\favorites\how to decrypt files.txt
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\how to decrypt files.txt
%HOMEPATH%\music\how to decrypt files.txt
%HOMEPATH%\pictures\how to decrypt files.txt
%HOMEPATH%\downloads\how to decrypt files.txt
C:\users\public\favorites\how to decrypt files.txt
C:\users\public\videos\how to decrypt files.txt
C:\users\default\pictures\how to decrypt files.txt
C:\users\public\pictures\sample pictures\how to decrypt files.txt
C:\users\public\music\sample music\how to decrypt files.txt
C:\users\public\recorded tv\sample media\how to decrypt files.txt
C:\users\public\recorded tv\how to decrypt files.txt
C:\users\public\libraries\how to decrypt files.txt
C:\users\public\music\how to decrypt files.txt
%HOMEPATH%\saved games\how to decrypt files.txt
C:\users\public\pictures\how to decrypt files.txt
C:\users\public\downloads\how to decrypt files.txt
C:\users\public\documents\how to decrypt files.txt
C:\users\public\desktop\how to decrypt files.txt
C:\users\default\videos\how to decrypt files.txt
C:\users\default\saved games\how to decrypt files.txt
C:\users\public\how to decrypt files.txt
C:\users\default\links\how to decrypt files.txt
C:\users\default\music\how to decrypt files.txt
%HOMEPATH%\videos\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\push\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\performance\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\oldage\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\layeredtitles\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\memories\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\huecycle\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\babygirl\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\pets\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\full\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\babyboy\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\how to decrypt files.txt
%ProgramFiles%\dvd maker\en-us\how to decrypt files.txt
%ProgramFiles%\dvd maker\how to decrypt files.txt
C:\$recycle.bin\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\flippage\how to decrypt files.txt
%ProgramFiles%\msbuild\how to decrypt files.txt
C:\users\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\resizingpanels\how to decrypt files.txt
%ProgramFiles(x86)%\uninstall information\how to decrypt files.txt
%ProgramFiles(x86)%\msbuild\microsoft\how to decrypt files.txt
%ProgramFiles(x86)%\msbuild\how to decrypt files.txt
%ProgramFiles%\uninstall information\how to decrypt files.txt
%ProgramFiles(x86)%\how to decrypt files.txt
%ProgramFiles%\msbuild\microsoft\how to decrypt files.txt
%HOMEPATH%\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\vignette\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\travel\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\videowall\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\stacking\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\sports\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\specialoccasion\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\shatter\how to decrypt files.txt
%ProgramFiles%\dvd maker\shared\dvdstyles\rectangles\how to decrypt files.txt
C:\users\public\videos\sample videos\how to decrypt files.txt

Modifies the following files

<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\hanni_umami_chapter.doc
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\ovp25012015.doc

Creates ransom message files (Trojan.Encoder).

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Creates and executes the following

'<SYSTEM32>\vssadmin.exe' delete shadows /all /quiet' (with hidden window)
'<SYSTEM32>\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures' (with hidden window)
'<SYSTEM32>\cmd.exe' /c bcdedit /set {current} recoveryenabled no' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c bcdedit /set {current} recoveryenabled no
'<SYSTEM32>\bcdedit.exe' /set {current} bootstatuspolicy ignoreallfailures