Win32/Filecoder [Threat Name] go to Threat

Win32/Filecoder.J [Threat Variant Name]

Category trojan,worm
Size 10752 B
Aliases Trojan.Win32.Filecoder.y (Kaspersky)
  Trojan:Win32/Dynamer!dtc (Microsoft)
Short description

Win32/Filecoder.J is a trojan that encrypts files on local drives. To decrypt files the user is requested to send an SMS message to a specified telephone number in exchange for a password/instructions.


When executed, the trojan copies itself into the following location:

  • %system%\­UKIKJULZ.exe

The trojan creates the following files:

  • %drive%\­HOW TO DECRYPT FILES.txt

The trojan writes the following entries to the file:

  • Ваши файлы почему-то зашифровались. Чтобы расшифровать вам нужно отправить смс "bas1141 744" на номер "4460" - Без кавычек и тогда вам придет код для расшифровки файла.

The following Registry entries are created:

  • [HKEY_LOCAL_MACHINE\­SOFTWARE\­Classes\­.crypted]
    • "(Default)" = "XBYSDGFMKA"
    • "(Default)" = "CRYPTED!"
  • [HKEY_LOCAL_MACHINE\­SOFTWARE\­Classes\­XBYSDGFMKA\­shell\­open\­command]
    • "(Default)" = "%system%\­UKIKJULZ.exe"
    • "(Default)" = "%system%\­UKIKJULZ.exe,0"
Payload information

Win32/Filecoder.J is a trojan that encrypts files on local drives.

The trojan searches local drives for files with the following file extensions:

  • .jpg
  • .jpeg
  • .psd
  • .cdr
  • .dwg
  • .max
  • .mov
  • .m2v
  • .3gp
  • .doc
  • .docx
  • .xls
  • .xlsx
  • .pptp
  • .ptx
  • .rar
  • .zip
  • .mdb
  • .mp3
  • .cer
  • .p12
  • .pfx
  • .kwm
  • .pwm
  • .txt
  • .pdf
  • .avi
  • .flv

When the trojan finds a file matching the search criteria, it creates its duplicate.

The file name and extension of the newly created file is derived from the original one.

An additional .crypted extension is appended.

The trojan encrypts the file content.

The trojan then deletes found files.

Other information

The trojan displays the following dialog boxes:

The encrypted files can be returned to their original state using the following password:

  • Ft4w5Ys1S

When the correct password is entered the trojan removes itself from the computer.

Please enable Javascript to ensure correct displaying of this content and refresh this page.