Trojan.Encoder.10746

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\PIk480md.lnk
%HOMEPATH%\Start Menu\Programs\Startup\PIk480md.lnk

Вредоносные функции:

Создает и запускает на исполнение:

'%APPDATA%\vM3AawkkZw1C\PIk480md.exe' i01G51gibG0fbUxu

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\WHATHA~1.RTF" > "C:\Far2\Documentation\eng\WhatHappenedWithMyFiles.rtf"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\WHATHA~1.RTF" > "C:\Far2\Documentation\rus\WhatHappenedWithMyFiles.rtf"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\WHATHA~1.RTF" > "C:\Far2\Plugins\7-Zip\WhatHappenedWithMyFiles.rtf"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\WHATHA~1.RTF" > "C:\Far2\Addons\WhatHappenedWithMyFiles.rtf"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\vM3AawkkZw1C\PIk480md.exe" > "%TEMP%\DQ0NZ8SV.exe" && "%TEMP%\DQ0NZ8SV.exe" "%APPDATA%\vM3AawkkZw1C\" "i01G51gibG0fbUxu" "FILESEXTLIST" "5000" "%APPDATA%\vM3AawkkZw1C\i01G51g...
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\vM3AawkkZw1C\PIk480md.exe" > "%TEMP%\OsKo5nO0.exe" && "%TEMP%\OsKo5nO0.exe" "%APPDATA%\vM3AawkkZw1C\" "i01G51gibG0fbUxu" "CIP_STARTED" "5000"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\WHATHA~1.RTF" > "%HOMEPATH%\Templates\WhatHappenedWithMyFiles.rtf"
'<SYSTEM32>\cmd.exe' /C CACLS "Z:\.live" /E /G %USERNAME%:F /C & ATTRIB -R -A -H "Z:\.live"
'<SYSTEM32>\cacls.exe' "Z:\.live" /E /G %USERNAME%:F /C
'%TEMP%\9frCxEOC.exe' "%APPDATA%\vM3AawkkZw1C\" "i01G51gibG0fbUxu" "START" "5000"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\WHATHA~1.RTF" > "<STUBS_DIR>\WhatHappenedWithMyFiles.rtf"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\WHATHA~1.RTF" > "C:\Far2\Plugins\Colorer\hrc\WhatHappenedWithMyFiles.rtf"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\WHATHA~1.RTF" > "C:\Far2\Plugins\ExtSearch\doc\WhatHappenedWithMyFiles.rtf"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\WHATHA~1.RTF" > "C:\Far2\Plugins\FTP\WhatHappenedWithMyFiles.rtf"
'%APPDATA%\vM3AawkkZw1C\PIk480md.exe' i01G51gibG0fbUxu
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\vM3AawkkZw1C\PIk480md.exe" > "%TEMP%\Y3LQ9Rxg.exe" && "%TEMP%\Y3LQ9Rxg.exe" "%APPDATA%\vM3AawkkZw1C\" "i01G51gibG0fbUxu" "WIN_5.1_32|ADMIN_YES|INT_0" "5000"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\vM3AawkkZw1C\PIk480md.exe" > "%APPDATA%\Microsoft\fSSwY9yY.exe" && "%APPDATA%\Microsoft\fSSwY9yY.exe" "%APPDATA%\vM3AawkkZw1C\PIk480md.exe" "<LS_APPDATA>\Microsoft\zZxPlK0k.e...
'<SYSTEM32>\cmd.exe' /C "%APPDATA%\vM3AawkkZw1C\4pWrtZue.cmd"
'<SYSTEM32>\cmd.exe' /C type "<Полный путь к файлу>" > "%APPDATA%\VM3AAW~1\PIk480md.exe"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\vM3AawkkZw1C\PIk480md.exe" > "%TEMP%\9frCxEOC.exe" && "%TEMP%\9frCxEOC.exe" "%APPDATA%\vM3AawkkZw1C\" "i01G51gibG0fbUxu" "START" "5000"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\vM3AawkkZw1C\PIk480md.exe" > "%TEMP%\czqpkuVA.exe" && "%TEMP%\czqpkuVA.exe" "%APPDATA%\vM3AawkkZw1C\" "i01G51gibG0fbUxu" "MASTER_STARTED" "5000"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\vM3AawkkZw1C\PIk480md.exe" > "%TEMP%\JuA9xnjl.exe" && "%TEMP%\JuA9xnjl.exe" "%APPDATA%\vM3AawkkZw1C\" "i01G51gibG0fbUxu" "LOCAL_01F5D55C9196AAB1" "5000"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\vM3AawkkZw1C\PIk480md.exe" > "%TEMP%\DG31YJ34.exe" && "%TEMP%\DG31YJ34.exe" "%APPDATA%\vM3AawkkZw1C\" "i01G51gibG0fbUxu" "SCAN_STARTED" "5000"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\vM3AawkkZw1C\PIk480md.exe" > "%TEMP%\SaIWcvZ4.exe" && "%TEMP%\SaIWcvZ4.exe" "%APPDATA%\vM3AawkkZw1C\" "i01G51gibG0fbUxu" "195_LESS_1GB" "5000"
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\vM3AawkkZw1C\PIk480md.exe" > "%TEMP%\1l0fCIGS.exe" && "%TEMP%\1l0fCIGS.exe" "%APPDATA%\vM3AawkkZw1C\" "i01G51gibG0fbUxu" "CLRSHC" "5000"
'<SYSTEM32>\ping.exe' -n 3 localhost
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\vM3AawkkZw1C\PIk480md.exe" > "<LS_APPDATA>\Microsoft\zZxPlK0k.exe" && "<LS_APPDATA>\Microsoft\zZxPlK0k.exe" "%APPDATA%\vM3AawkkZw1C\PIk480md.exe" "%APPDATA%\Microsoft\fSSwY9y...
'<SYSTEM32>\cmd.exe' /C type "%APPDATA%\vM3AawkkZw1C\PIk480md.exe" > "%TEMP%\U7io3aX6.exe" && "%TEMP%\U7io3aX6.exe" "%APPDATA%\vM3AawkkZw1C\" "i01G51gibG0fbUxu" "WRITE_STUP" "5000"