Trojan.Encoder.32898

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'FxHrkpLpWn' = '<Full path to file>'

Creates the following files on removable media

<Drive name for removable media>:\766245-readme.txt

Malicious functions

Terminates or attempts to terminate

the following user processes:

firefox.exe

Reads files which store third party applications passwords

%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\toolbar.bmp
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%HOMEPATH%\desktop\weeklysheet1215.doc

Modifies file system

Creates the following files

<Current directory>\dbg_log.txt
%HOMEPATH%\contacts\766245-readme.txt
C:\users\public\videos\766245-readme.txt
C:\users\public\recorded tv\766245-readme.txt
C:\users\public\pictures\766245-readme.txt
C:\users\public\music\766245-readme.txt
C:\users\public\libraries\766245-readme.txt
C:\users\public\favorites\766245-readme.txt
C:\users\public\downloads\766245-readme.txt
C:\users\public\documents\766245-readme.txt
C:\users\public\desktop\766245-readme.txt
C:\users\default\videos\766245-readme.txt
C:\users\default\saved games\766245-readme.txt
C:\users\default\pictures\766245-readme.txt
C:\users\default\music\766245-readme.txt
C:\users\default\links\766245-readme.txt
C:\users\default\favorites\766245-readme.txt
C:\users\default\downloads\766245-readme.txt
C:\users\default\documents\766245-readme.txt
C:\users\default\desktop\766245-readme.txt
%HOMEPATH%\desktop\766245-readme.txt
%HOMEPATH%\documents\766245-readme.txt
%HOMEPATH%\downloads\766245-readme.txt
%HOMEPATH%\favorites\766245-readme.txt
%HOMEPATH%\favorites\msn websites\766245-readme.txt
%HOMEPATH%\favorites\microsoft websites\766245-readme.txt
%HOMEPATH%\favorites\links for united states\766245-readme.txt
%HOMEPATH%\favorites\links\766245-readme.txt
C:\users\public\videos\sample videos\766245-readme.txt
C:\users\public\recorded tv\sample media\766245-readme.txt
C:\users\public\pictures\sample pictures\766245-readme.txt
C:\users\public\music\sample music\766245-readme.txt
%ProgramFiles%\microsoft sql server compact edition\v3.5\desktop\766245-readme.txt
C:\far2\addons\xlat\russian\766245-readme.txt
C:\far2\plugins\ftp\lib\766245-readme.txt
C:\far2\addons\colors\default_highlighting\766245-readme.txt
C:\far2\addons\colors\custom_highlighting\766245-readme.txt
%HOMEPATH%\voip\766245-readme.txt
%HOMEPATH%\videos\766245-readme.txt
%HOMEPATH%\searches\766245-readme.txt
%HOMEPATH%\saved games\766245-readme.txt
%HOMEPATH%\pictures\766245-readme.txt
%HOMEPATH%\music\766245-readme.txt
%HOMEPATH%\links\766245-readme.txt
%HOMEPATH%\favorites\windows live\766245-readme.txt
%ProgramFiles%\microsoft sql server compact edition\v3.5\766245-readme.txt
C:\far2\pluginsdk\headers.pas\766245-readme.txt
C:\far2\pluginsdk\headers.c\766245-readme.txt
C:\users\public\766245-readme.txt
C:\users\default\766245-readme.txt
C:\totalcmd\language\766245-readme.txt
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\766245-readme.txt
%ProgramFiles%\microsoft sql server compact edition\766245-readme.txt
C:\far2\pluginsdk\766245-readme.txt
C:\far2\plugins\766245-readme.txt
C:\far2\fexcept\766245-readme.txt
C:\far2\encyclopedia\766245-readme.txt
C:\far2\documentation\766245-readme.txt
C:\far2\addons\766245-readme.txt
C:\users\766245-readme.txt
C:\totalcmd\766245-readme.txt
C:\recovery\766245-readme.txt
%ProgramFiles(x86)%\766245-readme.txt
%ProgramFiles%\766245-readme.txt
C:\far2\766245-readme.txt
<Current directory>\766245-readme.txt
C:\766245-readme.txt
%HOMEPATH%\766245-readme.txt
C:\far2\addons\colors\766245-readme.txt
C:\far2\addons\macros\766245-readme.txt
C:\far2\addons\setup\766245-readme.txt
C:\far2\plugins\proclist\766245-readme.txt
C:\far2\plugins\network\766245-readme.txt
C:\far2\plugins\macroview\766245-readme.txt
C:\far2\plugins\hlfviewer\766245-readme.txt
C:\far2\plugins\ftp\766245-readme.txt
C:\far2\plugins\filecase\766245-readme.txt
C:\far2\plugins\farcmds\766245-readme.txt
C:\far2\plugins\emenu\766245-readme.txt
C:\far2\plugins\editcase\766245-readme.txt
C:\far2\plugins\compare\766245-readme.txt
C:\far2\plugins\drawline\766245-readme.txt
C:\far2\plugins\brackets\766245-readme.txt
C:\far2\plugins\autowrap\766245-readme.txt
C:\far2\plugins\arclite\766245-readme.txt
C:\far2\plugins\align\766245-readme.txt
C:\far2\encyclopedia\tap\766245-readme.txt
C:\far2\documentation\rus\766245-readme.txt
C:\far2\documentation\eng\766245-readme.txt
C:\far2\addons\xlat\766245-readme.txt
C:\far2\addons\shell\766245-readme.txt
C:\far2\plugins\tmppanel\766245-readme.txt
D:\766245-readme.txt