Trojan.Encoder.31265

To ensure autorun and distribution

Sets the following service settings

Creates the following files on removable media

<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx
<Drive name for removable media>:\thlps_keeper_mayer_1965.docx
<Drive name for removable media>:\aoc_saq_d_v3_merchant.docx
<Drive name for removable media>:\nwfieldnotes1966.docx
<Drive name for removable media>:\holycrosschurchinstructions.docx
<Drive name for removable media>:\issi2013_template_for_posters.docx
<Drive name for removable media>:\applicantform_en.doc
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\delete.avi
<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\archer.avi
<Drive name for removable media>:\split.avi
<Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
<Drive name for removable media>:\indogerman2010.pptx

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

blocks the following features:

deletes volume shadow copies.

Executes the following

Reads files which store third party applications passwords

Modifies file system

Creates the following files

<DRIVERS>\etc\host
%PROGRAMDATA%\data
%APPDATA%\microsoft\windows\recent\how do i recover my files (readme).txt
%HOMEPATH%\pictures\how do i recover my files (readme).txt
%HOMEPATH%\music\how do i recover my files (readme).txt
%HOMEPATH%\videos\how do i recover my files (readme).txt
%HOMEPATH%\documents\how do i recover my files (readme).txt
%HOMEPATH%\downloads\how do i recover my files (readme).txt
%HOMEPATH%\desktop\how do i recover my files (readme).txt
%HOMEPATH%\favorites\how do i recover my files (readme).txt
%PROGRAMDATA%\microsoft\windows\start menu\how do i recover my files (readme).txt
C:\how do i recover my files (readme).txt
D:\how do i recover my files (readme).txt

Moves the following files

from %PROGRAMDATA%\data to %PROGRAMDATA%\data.mz173801
from %APPDATA%\microsoft\windows\recent\activator.lnk to %APPDATA%\microsoft\windows\recent\activator.lnk.mz173801

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

TCP

HTTP GET requests

UDP

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /C netsh firewall set opmode disable' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C netsh firewall set opmode disable
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
'%WINDIR%\syswow64\cmd.exe' /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...
'<SYSTEM32>\vssvc.exe'