Trojan.Encoder.32060

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'taskhostw' = 'C:\Users\taskhostw.exe'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'taskhostw' = '%APPDATA%\taskhostw.exe'

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\taskhostw.exe

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'

Malicious functions

To bypass firewall, removes or modifies the following registry keys

[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Reads files which store third party applications passwords

%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\testee.cer
%HOMEPATH%\desktop\toolbar.bmp

Modifies file system

Creates the following files

C:\users\taskhostw.exe
%ProgramFiles(x86)%\adobe\acrobat reader dc\esl\readme.txt
C:\totalcmd\readme.txt
<Current directory>\readme.txt
%HOMEPATH%\favorites\links for united states\readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\readme.txt
%ProgramFiles%\readme.txt
%ProgramFiles%\360tray\readme.txt
%PROGRAMDATA%\adobe\arm\s\readme.txt
%ProgramFiles%\a2cmd\readme.txt
%HOMEPATH%\favorites\microsoft websites\readme.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\readme.txt
%PROGRAMDATA%\adobe\arm\reader_15.007.20033\readme.txt
%PROGRAMDATA%\adobe\arm\s\10428\readme.txt
%ProgramFiles%\a2hijackfree\readme.txt
%ProgramFiles%\a2scan\readme.txt
%ProgramFiles%\a2service\readme.txt
%ProgramFiles%\a2start\readme.txt
%ProgramFiles%\a2upd\readme.txt
%HOMEPATH%\favorites\msn websites\readme.txt
%ProgramFiles%\a2wizard\readme.txt
%ProgramFiles%\aavshield\readme.txt
%ProgramFiles%\about\readme.txt
%PROGRAMDATA%\microsoft\assistance\client\1.0\en-us\readme.txt
%ProgramFiles%\a2guard\readme.txt
%PROGRAMDATA%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\readme.txt
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\readme.txt
C:\users\public\music\sample music\readme.txt
C:\users\public\pictures\sample pictures\readme.txt
%APPDATA%\taskhostw.exe
C:\users\public\desktop\readme.txt
C:\users\public\videos\readme.txt
C:\users\public\music\readme.txt
C:\users\public\pictures\readme.txt
C:\users\public\downloads\readme.txt
C:\users\public\documents\readme.txt
%HOMEPATH%\videos\readme.txt
%HOMEPATH%\desktop\readme.txt
%HOMEPATH%\contacts\readme.txt
%HOMEPATH%\pictures\readme.txt
%PROGRAMDATA%\microsoft\windows\start menu\programs\startup\taskhostw.exe
%HOMEPATH%\saved games\readme.txt
%HOMEPATH%\music\readme.txt
%HOMEPATH%\favorites\readme.txt
%HOMEPATH%\links\readme.txt
%HOMEPATH%\downloads\readme.txt
%HOMEPATH%\documents\readme.txt
%ProgramFiles(x86)%\readme.txt
%ProgramFiles(x86)%\adobe\acrobat reader dc\readme.txt
%HOMEPATH%\favorites\links\readme.txt
C:\users\public\videos\sample videos\readme.txt
C:\far2\readme.txt
%PROGRAMDATA%\readme.txt
%HOMEPATH%\searches\readme.txt
%ProgramFiles%\ackwin32\readme.txt
%HOMEPATH%\favorites\windows live\readme.txt

Moves the following files

from %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm to %ProgramFiles(x86)%\adobe\acrobat reader dc\readme.htm.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\extendscript.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\extendscript.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ashpopwz\ashpopwz.exe to %ProgramFiles%\ashpopwz\ashpopwz.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\eula.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\eula.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ashmaisv\ashmaisv.exe to %ProgramFiles%\ashmaisv\ashmaisv.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.sig.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ashlogv\ashlogv.exe to %ProgramFiles%\ashlogv\ashlogv.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cryptocme.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ashenhcd\ashenhcd.exe to %ProgramFiles%\ashenhcd\ashenhcd.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cooltype.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\cooltype.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ashdug\ashdug.exe to %ProgramFiles%\ashdug\ashdug.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ashquick\ashquick.exe to %ProgramFiles%\ashquick\ashquick.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ashdisp\ashdisp.exe to %ProgramFiles%\ashdisp\ashdisp.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ccme_ecc.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ccme_ecc.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ashchest\ashchest.exe to %ProgramFiles%\ashchest\ashchest.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ccme_base_non_fips.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ccme_base_non_fips.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ashavsrv\ashavsrv.exe to %ProgramFiles%\ashavsrv\ashavsrv.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ccme_base.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ccme_base.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ashavast\ashavast.exe to %ProgramFiles%\ashavast\ashavast.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ccme_asym.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ccme_asym.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ash\ash.exe to %ProgramFiles%\ash\ash.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\bibutils.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\bibutils.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\armorsurf\armorsurf.exe to %ProgramFiles%\armorsurf\armorsurf.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ccme_ecdrbg.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ccme_ecdrbg.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pdfprevhndlr.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pdfprevhndlr.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\avadmin\avadmin.exe to %ProgramFiles%\avadmin\avadmin.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\icudt40.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\icudt40.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rt3d.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rt3d.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\autotrace\autotrace.exe to %ProgramFiles%\autotrace\autotrace.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\autostartexplorer\autostartexplorer.exe to %ProgramFiles%\autostartexplorer\autostartexplorer.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\reader_sl.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\reader_sl.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\autodown\autodown.exe to %ProgramFiles%\autodown\autodown.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pmd.cer to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pmd.cer.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\aswupdsv\aswupdsv.exe to %ProgramFiles%\aswupdsv\aswupdsv.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pe.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pe.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\aswregsvr\aswregsvr.exe to %ProgramFiles%\aswregsvr\aswregsvr.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pdfsigqformalrep.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\pdfsigqformalrep.pdf.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\bib.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\bib.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ash_updatemediator\ash_updatemediator.exe to %ProgramFiles%\ash_updatemediator\ash_updatemediator.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ashwebsv\ashwebsv.exe to %ProgramFiles%\ashwebsv\ashwebsv.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ashupd\ashupd.exe to %ProgramFiles%\ashupd\ashupd.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\onix32.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\onix32.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ashskpck\ashskpck.exe to %ProgramFiles%\ashskpck\ashskpck.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\logtransport2.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\logtransport2.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ashskpcc\ashskpcc.exe to %ProgramFiles%\ashskpcc\ashskpcc.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\logsession.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\logsession.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ashsimpl\ashsimpl.exe to %ProgramFiles%\ashsimpl\ashsimpl.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\jp2klib.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\jp2klib.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ashsimp2\ashsimp2.exe to %ProgramFiles%\ashsimp2\ashsimp2.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\icucnv40.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\icucnv40.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ashserv\ashserv.exe to %ProgramFiles%\ashserv\ashserv.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\armor2net\armor2net.exe to %ProgramFiles%\armor2net\armor2net.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrotextextractor.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrotextextractor.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ackwin32\ackwin32.exe to %ProgramFiles%\ackwin32\ackwin32.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32res.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32res.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\about\about.exe to %ProgramFiles%\about\about.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\aavshield\aavshield.exe to %ProgramFiles%\aavshield\aavshield.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32info.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32info.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\a2wizard\a2wizard.exe to %ProgramFiles%\a2wizard\a2wizard.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\a2upd\a2upd.exe to %ProgramFiles%\a2upd\a2upd.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\a2start\a2start.exe to %ProgramFiles%\a2start\a2start.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrosup64.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrosup64.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\a2service\a2service.exe to %ProgramFiles%\a2service\a2service.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\a2scan\a2scan.exe to %ProgramFiles%\a2scan\a2scan.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrobroker.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrobroker.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\a2hijackfree\a2hijackfree.exe to %ProgramFiles%\a2hijackfree\a2hijackfree.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ace.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ace.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\a2guard\a2guard.exe to %ProgramFiles%\a2guard\a2guard.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\a3dutils.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\a2cmd\a2cmd.exe to %ProgramFiles%\a2cmd\a2cmd.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\360tray\360tray.exe to %ProgramFiles%\360tray\360tray.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\1494870c-9912-c184-4cc9-b401-a53f4d8de290.pdf.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\esl\aiodlite.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrofx32.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrofx32.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobexmp.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobexmp.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\axsle.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\axsle.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\agb5\agb5.exe to %ProgramFiles%\agb5\agb5.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\antivirus\antivirus.exe to %ProgramFiles%\antivirus\antivirus.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\axe8sharedexpat.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\axe8sharedexpat.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\anti-trojan\anti-trojan.exe to %ProgramFiles%\anti-trojan\anti-trojan.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\arh.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\arh.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\amsn\amsn.exe to %ProgramFiles%\amsn\amsn.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ahclient.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\ahclient.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\amon\amon.exe to %ProgramFiles%\amon\amon.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agmgpuoptin.ini.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\alsvc\alsvc.exe to %ProgramFiles%\alsvc\alsvc.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agm.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\agm.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\aoltbserver\aoltbserver.exe to %ProgramFiles%\aoltbserver\aoltbserver.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\almon\almon.exe to %ProgramFiles%\almon\almon.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\airdefense\airdefense.exe to %ProgramFiles%\airdefense\airdefense.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adoberfp.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adoberfp.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\aimpro\aimpro.exe to %ProgramFiles%\aimpro\aimpro.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobelinguistic.dll to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobelinguistic.dll.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\aim6\aim6.exe to %ProgramFiles%\aim6\aim6.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobecollabsync.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobecollabsync.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ahnsd\ahnsd.exe to %ProgramFiles%\ahnsd\ahnsd.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adobe.reader.dependencies.manifest.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\ageofconan\ageofconan.exe to %ProgramFiles%\ageofconan\ageofconan.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adelrcp.exe to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\adelrcp.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles%\admunch\admunch.exe to %ProgramFiles%\admunch\admunch.exe.id=78cbafe1.[recoryfile@tutanota.com]..jwjs
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\rtc.der.id=78cbafe1.[recoryfile@tutanota.com]..jwjs

Modifies user data files (Trojan.Encoder).

Network activity

TCP

HTTP GET requests

http://ip##pi.com/csv/?fi##################
http://fi####iles.online/api/gen.php

UDP

DNS ASK fi####iles.online
DNS ASK ip##pi.com

Miscellaneous

Executes the following

'<SYSTEM32>\netsh.exe' Advfirewall set allprofiles state off
'<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet
'<SYSTEM32>\cmd.exe' /C vssadmin Delete Shadows /All /Quiet
'<SYSTEM32>\vssvc.exe'
'<SYSTEM32>\svchost.exe' -k swprv

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial