Win32/Filecoder [Threat Name] go to Threat

Win32/Filecoder.NAG [Threat Variant Name]

Category	trojan
Size	388463 B
Aliases	PWS-Zbot.gen.adc.trojan (McAfee)
	Trojan.Gen (Symantec)
	Variant.Symmi.352 (BitDefender)

Win32/Filecoder.NAG is a trojan that encrypts files on local drives.

When executed, the trojan copies itself into the following location:

The trojan creates the following files:

In order to be executed on every system start, the trojan sets the following Registry entry:

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
- "ChpPrintUpdate" = "%appdata%\sowldrv.exe"

The following Registry entries are created:

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
- "id" = %data%
- "ip" = %data%

Win32/Filecoder.NAG is a trojan that encrypts files on local drives.

The trojan searches for files with the following file extensions:

The trojan encrypts the file content.

An additional ".arest" extension is appended.

The encryption uses the AES algorithm.

The password is stored on the attacker server.

It tries to connect to remote machine to port:

The trojan contains a list of (1) IP addresses. The TCP protocol is used.

The trojan displays the following dialog boxes:

When the user enters correct password the trojan will decrypt encrypted files and remove itself from affected copmputer.

The trojan terminates any program that creates a window containing any of the following strings in its name: