Trojan.Encoder.29636

Technical Information

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\about.htm
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\advice_process.htm
%HOMEPATH%\desktop\alert.html
%HOMEPATH%\desktop\browse.html
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\tileimage.bmp
%HOMEPATH%\desktop\toolbar.bmp

Modifies file system

Creates the following files

%HOMEPATH%\favorites\links\почта.url
%HOMEPATH%\favorites\links\яндекс.url

Moves the following files

from %APPDATA%\.purple\prefs.xml to %APPDATA%\.purple\prefs.xml.zyr
from %APPDATA%\telegram desktop\unins000.exe to %APPDATA%\telegram desktop\unins000.exe.zyr
from %APPDATA%\telegram desktop\updater.exe to %APPDATA%\telegram desktop\updater.exe.zyr
from %APPDATA%\thunderbird\profiles\cr5sc40q.default\blocklist.xml to %APPDATA%\thunderbird\profiles\cr5sc40q.default\blocklist.xml.zyr
from %APPDATA%\thunderbird\profiles\cr5sc40q.default\cert8.db to %APPDATA%\thunderbird\profiles\cr5sc40q.default\cert8.db.zyr
from %APPDATA%\thunderbird\profiles\cr5sc40q.default\key3.db to %APPDATA%\thunderbird\profiles\cr5sc40q.default\key3.db.zyr
from %APPDATA%\thunderbird\profiles\cr5sc40q.default\mailviews.dat to %APPDATA%\thunderbird\profiles\cr5sc40q.default\mailviews.dat.zyr
from %APPDATA%\thunderbird\profiles\cr5sc40q.default\secmod.db to %APPDATA%\thunderbird\profiles\cr5sc40q.default\secmod.db.zyr
from %APPDATA%\thunderbird\profiles\cr5sc40q.default\virtualfolders.dat to %APPDATA%\thunderbird\profiles\cr5sc40q.default\virtualfolders.dat.zyr
from %APPDATA%\winrar\version.dat to %APPDATA%\winrar\version.dat.zyr
from %HOMEPATH%\favorites\links\почта.url to %HOMEPATH%\favorites\links\почта.url.zyr
from %HOMEPATH%\favorites\links\яндекс.url to %HOMEPATH%\favorites\links\яндекс.url.zyr
from %TEMP%\aucheck_parser.txt to %TEMP%\aucheck_parser.txt.zyr
from %TEMP%\dd_clwireg.txt to %TEMP%\dd_clwireg.txt.zyr
from %TEMP%\dd_depcheck_netfx20_exp_35.txt to %TEMP%\dd_depcheck_netfx20_exp_35.txt.zyr
from %TEMP%\dd_depcheck_netfx_exp_35.txt to %TEMP%\dd_depcheck_netfx_exp_35.txt.zyr
from %TEMP%\dd_dotnetfx20error.txt to %TEMP%\dd_dotnetfx20error.txt.zyr
from %TEMP%\dd_dotnetfx20install.txt to %TEMP%\dd_dotnetfx20install.txt.zyr
from %TEMP%\dd_dotnetfx35error.txt to %TEMP%\dd_dotnetfx35error.txt.zyr
from %TEMP%\dd_dotnetfx35install.txt to %TEMP%\dd_dotnetfx35install.txt.zyr
from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.zyr
from %TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt to %TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt.zyr
from %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt.zyr
from %TEMP%\dd_net_framework20_setup74f9.txt to %TEMP%\dd_net_framework20_setup74f9.txt.zyr
from %TEMP%\dd_net_framework30_setup7762.txt to %TEMP%\dd_net_framework30_setup7762.txt.zyr
from %TEMP%\dd_net_framework35_msi77c4.txt to %TEMP%\dd_net_framework35_msi77c4.txt.zyr
from %TEMP%\dd_wcf_retca4a2a.txt to %TEMP%\dd_wcf_retca4a2a.txt.zyr
from %TEMP%\dd_xps.txt to %TEMP%\dd_xps.txt.zyr
from %APPDATA%\telegram desktop\unins000.dat to %APPDATA%\telegram desktop\unins000.dat.zyr
from %TEMP%\downloader.exe to %TEMP%\downloader.exe.zyr
from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\telegram.exe.zyr
from %APPDATA%\sun\java\au\au.cab to %APPDATA%\sun\java\au\au.cab.zyr
from %APPDATA%\.purple\status.xml to %APPDATA%\.purple\status.xml.zyr
from %APPDATA%\icq-profile\installerlang.xml to %APPDATA%\icq-profile\installerlang.xml.zyr
from %APPDATA%\microsoft\dbgclr\7.1\objbrow.dat to %APPDATA%\microsoft\dbgclr\7.1\objbrow.dat.zyr
from %APPDATA%\microsoft\internet explorer\brndlog.txt to %APPDATA%\microsoft\internet explorer\brndlog.txt.zyr
from %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk to %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk.zyr
from %APPDATA%\microsoft\internet explorer\quick launch\icq.lnk to %APPDATA%\microsoft\internet explorer\quick launch\icq.lnk.zyr
from %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk to %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk.zyr
from %APPDATA%\microsoft\internet explorer\quick launch\microsoft office outlook.lnk to %APPDATA%\microsoft\internet explorer\quick launch\microsoft office outlook.lnk.zyr
from %APPDATA%\microsoft\internet explorer\quick launch\mozilla firefox.lnk to %APPDATA%\microsoft\internet explorer\quick launch\mozilla firefox.lnk.zyr
from %APPDATA%\microsoft\internet explorer\quick launch\mozilla thunderbird.lnk to %APPDATA%\microsoft\internet explorer\quick launch\mozilla thunderbird.lnk.zyr
from %APPDATA%\microsoft\internet explorer\quick launch\opera.lnk to %APPDATA%\microsoft\internet explorer\quick launch\opera.lnk.zyr
from %APPDATA%\microsoft\internet explorer\quick launch\qip 2012.lnk to %APPDATA%\microsoft\internet explorer\quick launch\qip 2012.lnk.zyr
from %APPDATA%\microsoft\internet explorer\quick launch\telegram.lnk to %APPDATA%\microsoft\internet explorer\quick launch\telegram.lnk.zyr
from %APPDATA%\microsoft\internet explorer\quick launch\windows media player.lnk to %APPDATA%\microsoft\internet explorer\quick launch\windows media player.lnk.zyr
from %APPDATA%\microsoft\msdn\7.0\objbrow.dat to %APPDATA%\microsoft\msdn\7.0\objbrow.dat.zyr
from %APPDATA%\microsoft\outlook\outcmd.dat to %APPDATA%\microsoft\outlook\outcmd.dat.zyr
from %APPDATA%\microsoft\outlook\outlook.xml to %APPDATA%\microsoft\outlook\outlook.xml.zyr
from %APPDATA%\microsoft\publisher\pubcmd12.dat to %APPDATA%\microsoft\publisher\pubcmd12.dat.zyr
from %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\blocklist.xml to %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\blocklist.xml.zyr
from %APPDATA%\opera software\opera stable\favorites.db to %APPDATA%\opera software\opera stable\favorites.db.zyr
from %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt to %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt.zyr
from %APPDATA%\opera software\opera stable\thumbnails.db to %APPDATA%\opera software\opera stable\thumbnails.db.zyr
from %APPDATA%\opera software\opera stable\dictionaries\dictionaries.xml to %APPDATA%\opera software\opera stable\dictionaries\dictionaries.xml.zyr
from %APPDATA%\qipguard\chrome.dll to %APPDATA%\qipguard\chrome.dll.zyr
from %APPDATA%\qipguard\qipguard.exe to %APPDATA%\qipguard\qipguard.exe.zyr
from %APPDATA%\qipguard\qipguard_upd.exe to %APPDATA%\qipguard\qipguard_upd.exe.zyr
from %APPDATA%\qipguard\sqlite3.dll to %APPDATA%\qipguard\sqlite3.dll.zyr
from %APPDATA%\telegram desktop\log.txt to %APPDATA%\telegram desktop\log.txt.zyr
from %TEMP%\mirc743.exe to %TEMP%\mirc743.exe.zyr

Moves itself

from <Full path to file> to C:\user\systems\local.exe

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial