Trojan.Encoder.43558

Technical Information

To ensure autorun and distribution

Modifies master boot record (MBR).

Modifies file system

Creates the following files

%WINDIR%\syswow64\windowspowershell\v1.0\chave_criptografia.bin
C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini
C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi
C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.exe
C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\appl...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\micr...
%LOCALAPPDATA%\microsoft\windows\caches\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.3.ver0x0000000000000001.db
%LOCALAPPDATA%\microsoft\windows\caches\{098fe311-a2cf-4047-b83d-2e53e386112e}.3.ver0x0000000000000001.db
%LOCALAPPDATA%\microsoft\windows\caches\{f93ec634-2b31-4c08-8fae-44bde07ebd9d}.3.ver0x0000000000000001.db
%LOCALAPPDATA%\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.3.ver0x0000000000000002.db
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\mozi...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\pack...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\star...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\diagnosis\d...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\search\data...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\vault\ac658...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\cli...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\sta...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows def...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\mozilla\uninstall_pin...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{050d4f...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{295d15...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{33d1fd...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{38b2c7...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{ca6754...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{f65db0...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\regid.1991-06.com.mic...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\a...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\m...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\w...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\crypto\systemkeys\d3c41fa3ac...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\search\data\applications\win...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\vault\ac658cb4-9126-49bd-b87...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\caches\{098fe311-a2c...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\caches\{6af0698e-d55...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\caches\{ddf571f2-be9...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\caches\{f93ec634-2b3...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\clipsvc\archive\apps...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defender.bak\scans\h...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defender.bak\scans\m...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defender.bak\support...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\mozilla\uninstall_ping_308046b0af4a39c...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\package cache\{13a4ee12-23ea-3371-91ee...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\package cache\{bd95a8cd-1d9f-35ad-981a...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\package cache\{ec9807de-b577-47b1-a024...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\regid.1991-06.com.microsoft\regid.1991...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\administrative too...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\microsoft office 2...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\crypto\systemkeys\d3c41fa3acf8a2df1a3b10b0caa...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\15...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3c...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\administrative to...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\windows defender.bak\scans\backupstore\2d6bdf...
C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\windows defender.bak\scans\history\results\re...

Moves the following files

from C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini to C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.encrypted
from C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi to C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi.encrypted
from C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.exe to C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.exe.encrypted
from C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini to C:\documents and settings\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini.encrypted
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\appl... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\appl...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\micr... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\micr...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\mozi... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\mozi...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\star... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\star...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\diagnosis\d... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\diagnosis\d...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\vault\ac658... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\vault\ac658...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows def... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows def...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{050d4f... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{050d4f...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{295d15... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{295d15...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{33d1fd... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{33d1fd...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{38b2c7... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{38b2c7...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{ca6754... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{ca6754...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{f65db0... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\package cache\{f65db0...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\a... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\a...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\m... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\m...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\w... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\w...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\search\data\applications\win... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\search\data\applications\win...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defender.bak\scans\h... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defender.bak\scans\h...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defender.bak\scans\m... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defender.bak\scans\m...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defender.bak\support... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows defender.bak\support...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\mozilla\uninstall_ping_308046b0af4a39c... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\mozilla\uninstall_ping_308046b0af4a39c...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\regid.1991-06.com.microsoft\regid.1991... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\regid.1991-06.com.microsoft\regid.1991...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\administrative too... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\administrative too...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\microsoft office 2... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\microsoft office 2...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\crypto\systemkeys\d3c41fa3acf8a2df1a3b10b0caa... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\crypto\systemkeys\d3c41fa3acf8a2df1a3b10b0caa...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\diagnosticlogcsp\collectors\diagnosticlogcsp_...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\15... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\15...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3c... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3c...
from C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\windows defender.bak\scans\history\results\re... to C:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\windows defender.bak\scans\history\results\re...

Modifies the following files

Changes user data files extensions (Trojan.Encoder).

Network activity

UDP

DNS ASK mo#####.map.fastly.net
DNS ASK co##############e-chains.prod.autograph.services.mozaws.net

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней