Trojan.Encoder.33710

Technical Information

Malicious functions

Reads files which store third party applications passwords

%HOMEPATH%\desktop\1189.jpeg
%HOMEPATH%\desktop\tree_view.htm
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\sdkfailsafeemulator.cer
%HOMEPATH%\desktop\pushkin.jpg
%HOMEPATH%\desktop\pushkin.jpeg
%HOMEPATH%\desktop\parnas_01.jpeg
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\iisstart.html
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\browse.html
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\adadsi.html
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\64bit_notes.htm
%HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
%HOMEPATH%\desktop\2.jpg
%HOMEPATH%\desktop\168.jpg
%HOMEPATH%\desktop\168.jpeg
%HOMEPATH%\desktop\13.jpg
%HOMEPATH%\desktop\13.jpeg
%HOMEPATH%\desktop\tree_view.html
%HOMEPATH%\desktop\trivial-merge.html

Modifies file system

Creates the following files

%TEMP%\_mei25802\msword.exe.manifest
%HOMEPATH%\favorites\links for united states\gobiernousa.gov.url.enc
%HOMEPATH%\favorites\links for united states\desktop.ini.enc
%HOMEPATH%\favorites\links\web slice gallery.url.enc
%HOMEPATH%\favorites\links\suggested sites.url.enc
%HOMEPATH%\favorites\links\desktop.ini.enc
%HOMEPATH%\favorites\desktop.ini.enc
%HOMEPATH%\downloads\winamp5666_full_all.exe.enc
%HOMEPATH%\downloads\thunderbird setup 31.6.0.exe.enc
%HOMEPATH%\downloads\tcmd851ax64.exe.enc
%HOMEPATH%\downloads\steamsetup.exe.enc
%HOMEPATH%\favorites\microsoft websites\ie add-on site.url.enc
%HOMEPATH%\favorites\links for united states\usa.gov.url.enc
%HOMEPATH%\downloads\mirc741.exe.enc
%HOMEPATH%\downloads\magent_rfrset.exe.enc
%HOMEPATH%\downloads\k-lite_codec_pack_1110_mega_dlm.exe.enc
%HOMEPATH%\downloads\k-lite_codec_pack_1110_mega.exe.enc
%HOMEPATH%\downloads\jre-8u45-windows-x64.exe.enc
%HOMEPATH%\downloads\icq_rfrset.exe.enc
%HOMEPATH%\downloads\desktop.ini.enc
%HOMEPATH%\downloads\chromesetup.exe.enc
%HOMEPATH%\documents\desktop.ini.enc
%HOMEPATH%\desktop\wrar520.exe.enc
%HOMEPATH%\downloads\pidgin-2.10.11.exe.enc
%TEMP%\_mei25802\cryptography-3.3.1-py3.7.egg-info\license.psf
%HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url.enc
%HOMEPATH%\videos\desktop.ini.enc
%HOMEPATH%\searches\indexed locations.search-ms.enc
%HOMEPATH%\searches\everywhere.search-ms.enc
%HOMEPATH%\searches\desktop.ini.enc
%HOMEPATH%\saved games\desktop.ini.enc
%HOMEPATH%\pictures\desktop.ini.enc
%HOMEPATH%\music\desktop.ini.enc
%HOMEPATH%\links\recentplaces.lnk.enc
%HOMEPATH%\links\downloads.lnk.enc
%HOMEPATH%\links\desktop.lnk.enc
%HOMEPATH%\links\desktop.ini.enc
%HOMEPATH%\favorites\windows live\windows live spaces.url.enc
%HOMEPATH%\favorites\windows live\windows live mail.url.enc
%HOMEPATH%\favorites\windows live\windows live gallery.url.enc
%HOMEPATH%\favorites\windows live\get windows live.url.enc
%HOMEPATH%\favorites\msn websites\msnbc news.url.enc
%HOMEPATH%\favorites\msn websites\msn.url.enc
%HOMEPATH%\favorites\msn websites\msn sports.url.enc
%HOMEPATH%\favorites\msn websites\msn money.url.enc
%HOMEPATH%\favorites\msn websites\msn entertainment.url.enc
%HOMEPATH%\favorites\msn websites\msn autos.url.enc
%HOMEPATH%\favorites\microsoft websites\microsoft store.url.enc
%HOMEPATH%\favorites\microsoft websites\microsoft at work.url.enc
%HOMEPATH%\desktop\total commander 64 bit.lnk.enc
%HOMEPATH%\downloads\opera_ni_stable.exe.enc
%HOMEPATH%\desktop\telegram.lnk.enc
%HOMEPATH%\desktop\qip 2012.lnk.enc
%HOMEPATH%\desktop\mail.ru agent.lnk.enc
%TEMP%\_mei25802\libssl-1_1.dll
%TEMP%\_mei25802\cryptography-3.3.1-py3.7.egg-info\installer
%TEMP%\_mei25802\cryptography-3.3.1-py3.7.egg-info\authors.rst
%TEMP%\_mei25802\certifi\cacert.pem
%TEMP%\_mei25802\base_library.zip
%TEMP%\_mei25802\include\pyconfig.h
%TEMP%\_mei25802\unicodedata.pyd
%TEMP%\_mei25802\select.pyd
%TEMP%\_mei25802\python37.dll
%TEMP%\_mei25802\python3.dll
%TEMP%\_mei25802\pyexpat.pyd
%TEMP%\_mei25802\libcrypto-1_1.dll
%TEMP%\_mei25802\cryptography-3.3.1-py3.7.egg-info\license.apache
%TEMP%\_mei25802\cryptography\hazmat\bindings\_openssl.pyd
%TEMP%\_mei25802\_ssl.pyd
%TEMP%\_mei25802\_socket.pyd
%TEMP%\_mei25802\_queue.pyd
%TEMP%\_mei25802\_lzma.pyd
%TEMP%\_mei25802\_hashlib.pyd
%TEMP%\_mei25802\_decimal.pyd
%TEMP%\_mei25802\_cffi_backend.cp37-win_amd64.pyd
%TEMP%\_mei25802\_bz2.pyd
%TEMP%\_mei25802\vcruntime140.dll
%HOMEPATH%\downloads\ryukreadme.txt
%HOMEPATH%\favorites\microsoft websites\microsoft at home.url.enc
%TEMP%\_mei25802\cryptography-3.3.1-py3.7.egg-info\license.bsd
%TEMP%\_mei25802\cryptography-3.3.1-py3.7.egg-info\record
%TEMP%\_mei25802\cryptography-3.3.1-py3.7.egg-info\license
%HOMEPATH%\desktop\icq.lnk.enc
%HOMEPATH%\desktop\desktop.ini.enc
%HOMEPATH%\desktop\calc.exe.enc
%HOMEPATH%\desktop\adadsi.html.enc
%HOMEPATH%\desktop\about.html.enc
%HOMEPATH%\desktop\64bit_notes.htm.enc
%HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.enc
%HOMEPATH%\desktop\2.jpg.enc
%HOMEPATH%\desktop\168.jpg.enc
%HOMEPATH%\desktop\168.jpeg.enc
%HOMEPATH%\desktop\13.jpg.enc
%HOMEPATH%\desktop\13.jpeg.enc
%HOMEPATH%\desktop\1189.jpeg.enc
%HOMEPATH%\contacts\user.contact.enc
%HOMEPATH%\contacts\desktop.ini.enc
%HOMEPATH%\ntuser.pol.enc
%HOMEPATH%\ntuser.ini.enc
%HOMEPATH%\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.enc
%HOMEPATH%\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.enc
%HOMEPATH%\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.enc
%TEMP%\_mei25802\cryptography-3.3.1-py3.7.egg-info\top_level.txt
%TEMP%\_mei25802\cryptography-3.3.1-py3.7.egg-info\wheel
%TEMP%\_mei25802\cryptography-3.3.1-py3.7.egg-info\metadata
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021032720210328\index.dat

Modifies the following files

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'pa###bin.com':443
'5.###.200.85':80
'5.##2.96.85':80
'5.##2.84.85':80
'5.###.248.85':80
'5.###.100.85':80
'5.###.176.85':80
'5.###.168.85':80
'5.###.160.85':80
'5.###.120.85':80
'5.###.232.85':80
'5.##5.0.85':80
'5.##4.32.85':80
'5.##2.36.85':80
'5.##.105.85':80
'5.##.16.85':80
'5.##.54.85':80
'5.##.0.85':80
'5.###.128.85':80
'5.#.2.85':80
'5.##7.0.85':80
'31.##.139.85':80
'31.##.131.85':80
'31.##.104.85':80
'31.#0.16.85':80
'31.#1.96.85':80
'31.##.160.85':80
'31.#8.26.85':80
'31.#8.16.85':80
'5.##.64.85':80
'5.##8.6.85':80
'ac####.jpmorgan.com':443
'31.##.208.85':80
'31.#.96.85':80
'31.#.192.85':80
'23.#6.98.85':80
'8.##.51.85':80
'5.##5.32.85':80
'5.###.180.85':80
'31.##.128.85':80
'5.##8.0.85':80
'5.##.112.85':80
'5.##.24.85':80
'5.##.182.85':80
'2.##.108.85':80
'co#####.facebook.net':443
'fb##n.com':80
'2.##.36.85':80
'2.##.136.85':80
'fa###ook.com':80
'ap##.#acebook.com':80
'fb##x.com':80
'31.##.141.85':80
'fa###ook.com':443
'gr###.facebook.com':443
'gr###.facebook.com':80
'lo###.facebook.com':80
'2.##.39.85':80
'fb##n.net':443
'fb##n.net':80
'88.##9.171.94':80
'2.##.173.85':80
'co#####.facebook.net':80
'31.#8.2.85':80
'2.##.244.85':80
'fb##x.com':443
'8.###.171.94':80
'5.##.156.85':80
'5.#.16.85':80
'5.#.8.85':80
'5.#.4.85':80
'5.#.3.241':80
'5.#.3.85':80
'5.#.2.201':80
'2.##.168.85':80
'5.#.2.196':80
'fb##n.com':443
'5.#.2.3':80
'5.#.0.85':80
'5.#.2.0':80
'st####.xx.fbcdn.net':443
'm.###ebook.com':443
'2.##.204.85':80
'2.##.150.85':80
'5.#.2.185':80
'31.##.144.85':80

TCP

HTTP GET requests

http://www.fb##n.com/
http://5.##.16.85/doc/ui/images/login-icons.png
http://5.##.16.85/doc/i18n/en/Common.json?ve#######################
http://5.##.16.85/doc/script/login.js?ve#######################
http://5.##.16.85/doc/script/lib/encryption/encryption.js?ve#######################
http://5.##.16.85/doc/script/isapi/response.js?ve#######################
http://5.##.16.85/doc/script/common/plugin.js?ve#######################
http://5.##.16.85/doc/script/wizard.js?ve#######################
http://5.##.16.85/doc/script/config/ui.config.js?ve#######################
http://5.##.16.85/doc/script/isapi/device.js?ve#######################
http://5.##.16.85/doc/script/config/service.js?ve#######################
http://5.##.16.85/doc/script/config/network/advancedWAN.js?ve#######################
http://5.##.16.85/doc/script/config/storage/storageManageHarddisk.js?ve#######################
http://5.##.16.85/SDK/activateStatus
http://5.##.16.85/doc/script/config/system/channelDigital.js?ve#######################
http://5.##.16.85/doc/script/service.js?ve#######################
http://5.##.16.85/doc/script/lib/jquery/jquery-ui/jquery.ui.table.js?ve#######################
http://5.##.16.85/doc/script/lib/jquery/jquery-ui/jquery.ui.slider.js?ve#######################
http://5.##.16.85/doc/script/lib/jquery/jquery-ui/ui.jquery.js?ve#######################
http://5.##.16.85/doc/script/lib/jquery/resize/jquery.ba-resize.js?ve#######################
http://5.##.16.85/doc/i18n/en/Login.json?ve#######################
http://5.##.16.85/doc/i18n/en/Wizard.json?ve#######################
http://5.##.16.85/doc/ui/images/logo.png
http://5.##.16.85/doc/page/
http://5.##.16.85/doc/ui/images/config-icons.png
http://5.##.16.85/doc/ui/images/login-bg.png
http://5.##.16.85/doc/script/config/network/advancedWifi.js?ve#######################
http://5.##.16.85/doc/i18n/Languages.json?ve#######################
http://5.##.16.85/doc/script/common.js?ve#######################
http://fb##n.com/
http://fb##x.com/
http://lo###.facebook.com/
http://www.fa###ook.com/
http://5.##.16.85/doc/page/login.asp?_1############
http://5.##.16.85/doc/ui/css/ui.css?ve###################
http://5.##.16.85/doc/ui/images/login.jpg
http://5.##.16.85/doc/script/lib/seajs/config/sea-config.js?ve###################
http://5.##.16.85/doc/script/lib/seajs/nocache/nocache-1.0.0.js
http://5.##.16.85/doc/script/lib/jquery/jquery/jquery-1.12.1.min.js
http://5.##.16.85/favicon.ico
http://5.##.16.85/doc/script/lib/jquery/layout/jquery.layout-1.4.1.js?ve#######################
http://5.##.16.85/doc/script/lib/jquery/artDialog/jquery.artDialog.source-4.1.6.js?ve#######################
http://5.##.16.85/doc/script/lib/jquery/cookie/jquery.cookie.js?ve#######################
http://5.##.16.85/doc/script/isapi/websdk.js?ve#######################
http://5.##.16.85/doc/script/lib/encryption/cryptico.min.js?ve#######################
http://5.##.16.85/doc/script/lib/base64.js?ve#######################
http://5.##.16.85/doc/script/lib/angularjs/angularjs/angular-1.2.0.min.js?ve#######################
http://5.##.16.85/doc/script/lib/webSession.js?ve#######################
http://5.##.16.85/doc/script/lib/translator.js?ve#######################
http://5.##.16.85/doc/script/lib/dialog.js?ve#######################
http://5.##.16.85/doc/script/lib/utils.js?ve#######################
http://5.##.16.85/doc/script/lib/encryption/AES.js?ve#######################
http://5.##.16.85/doc/script/lib/encryption/crypto-3.1.2.min.js?ve#######################
http://5.##.16.85/SDK/language
http://5.##.16.85/ISAPI/Security/extern/capabilities

'pa###bin.com':443

'fb##x.com':443

'fb##n.com':443

'co#####.facebook.net':443

'ac####.jpmorgan.com':443

UDP

DNS ASK pa###bin.com
DNS ASK st####.xx.fbcdn.net
DNS ASK m.###ebook.com
DNS ASK microsoft.com
DNS ASK st####.facebook.com
DNS ASK s-######.ak.facebook.com
DNS ASK ap##.#acebook.com
DNS ASK co#####.facebook.net
DNS ASK st####.ak.fbcdn.net
DNS ASK gr###.facebook.com
DNS ASK fb##n.net
DNS ASK fa###ook.com
DNS ASK st####.##.connect.facebook.com
DNS ASK lo###.facebook.com
DNS ASK fb##x.com
DNS ASK fb##n.com
DNS ASK ac####.jpmorgan.com
DNS ASK st####.rapidssl.com

Miscellaneous

Searches for the following windows

ClassName: 'DDEMLMom' WindowName: ''
ClassName: 'IEFrame' WindowName: ''
ClassName: 'Static' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial