Trojan.Encoder.25614

Техническая информация

Для обеспечения автозапуска и распространения:

Заражает следующие исполняемые файлы:

C:\Far2\Plugins\arclite\7zCon.sfx
C:\Far2\Plugins\arclite\7zS2con.sfx
C:\Far2\Plugins\arclite\7zS2.sfx
C:\Far2\Plugins\arclite\7z.sfx
C:\Far2\Plugins\arclite\7zSD.sfx
C:\Far2\Plugins\FTP\lib\ftpDirList.fll
C:\Far2\Plugins\FTP\lib\ftpProgress.fll
%CommonProgramFiles%\System\ado\msado25.tlb
%CommonProgramFiles%\System\ado\msado21.tlb
%CommonProgramFiles%\System\ado\msado27.tlb
%CommonProgramFiles%\System\ado\msado20.tlb
%CommonProgramFiles%\System\ado\msado26.tlb
%CommonProgramFiles%\System\Ole DB\sqloledb.rll
%CommonProgramFiles%\System\Ole DB\sqlxmlx.rll

Изменения в файловой системе:

Создает следующие файлы:

%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\7dc80875910261de2fa3b5f12eefc92f_23ef5514-3059-436f-a4a7-4cefaab20eb1
C:\Muldrop\DECRYPT__INFORMATION.iunm_45
C:\Muldrop\DECRYPT__INFORMATION.iunm_34
C:\Muldrop\DECRYPT__INFORMATION.iunm_26
C:\Muldrop\DECRYPT__INFORMATION.iunm_61
C:\Muldrop\DECRYPT__INFORMATION.iunm_9
%ProgramFiles%\DECRYPT__INFORMATION.html
C:\Muldrop\PUBLIC_0
%CommonProgramFiles%\DECRYPT__INFORMATION.html
%CommonProgramFiles%\MSSoap\DECRYPT__INFORMATION.html
%CommonProgramFiles%\MSSoap\Binaries\DECRYPT__INFORMATION.html
%CommonProgramFiles%\MSSoap\Binaries\Resources\DECRYPT__INFORMATION.html
%CommonProgramFiles%\ODBC\DECRYPT__INFORMATION.html
%CommonProgramFiles%\System\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\browser\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\browser\content\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\browser\content\browser\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\browser\skin\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\browser\skin\classic\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\DECRYPT__INFORMATION.html
C:\Muldrop\DECRYPT__INFORMATION.iunm_55
C:\Muldrop\DECRYPT__INFORMATION.iunm_43
C:\Muldrop\DECRYPT__INFORMATION.iunm_14
C:\Muldrop\DECRYPT__INFORMATION.iunm_42
C:\Muldrop\DECRYPT__INFORMATION.iunm_41
C:\Muldrop\DECRYPT__INFORMATION.iunm_18
C:\Muldrop\DECRYPT__INFORMATION.iunm_19
C:\Muldrop\DECRYPT__INFORMATION.iunm_5
C:\Muldrop\DECRYPT__INFORMATION.iunm_58
C:\Muldrop\DECRYPT__INFORMATION.iunm_16
C:\Muldrop\DECRYPT__INFORMATION.iunm_46
C:\Muldrop\DECRYPT__INFORMATION.iunm_47
C:\Muldrop\DECRYPT__INFORMATION.iunm_11
C:\Muldrop\DECRYPT__INFORMATION.iunm_52
C:\Muldrop\DECRYPT__INFORMATION.iunm_7
C:\Muldrop\DECRYPT__INFORMATION.iunm_48
C:\Muldrop\DECRYPT__INFORMATION.iunm_53
C:\Muldrop\DECRYPT__INFORMATION.iunm_33
C:\Muldrop\DECRYPT__INFORMATION.iunm_56
C:\Muldrop\DECRYPT__INFORMATION.iunm_27
C:\Muldrop\DECRYPT__INFORMATION.iunm_57
C:\Muldrop\DECRYPT__INFORMATION.iunm_21
C:\Muldrop\DECRYPT__INFORMATION.iunm_8
C:\Muldrop\DECRYPT__INFORMATION.iunm_20
C:\Muldrop\DECRYPT__INFORMATION.iunm_29
C:\Muldrop\DECRYPT__INFORMATION.iunm_22
C:\Muldrop\DECRYPT__INFORMATION.iunm_3
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\defaults\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\defaults\profile\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\extensions\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\modules\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\modules\services-sync\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\res\DECRYPT__INFORMATION.html
C:\Far2\Plugins\WinSCP\packages\DECRYPT__INFORMATION.html
%ProgramFiles%\Internet Explorer\DECRYPT__INFORMATION.html
%ProgramFiles%\microsoft frontpage\DECRYPT__INFORMATION.html
%ProgramFiles%\microsoft frontpage\version3.0\DECRYPT__INFORMATION.html
%ProgramFiles%\Movie Maker\DECRYPT__INFORMATION.html
%ProgramFiles%\Movie Maker\MUI\DECRYPT__INFORMATION.html
%ProgramFiles%\Movie Maker\Shared\DECRYPT__INFORMATION.html
%ProgramFiles%\MSN\DECRYPT__INFORMATION.html
%ProgramFiles%\MSN\MSNCoreFiles\DECRYPT__INFORMATION.html
%ProgramFiles%\MSN\MSNCoreFiles\Install\DECRYPT__INFORMATION.html
%ProgramFiles%\xerox\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\en-US\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\DECRYPT__INFORMATION.html
%CommonProgramFiles%\System\ado\msado21.tlb.new
%CommonProgramFiles%\System\ado\msado20.tlb.new
%CommonProgramFiles%\System\ado\msado27.tlb.new
%CommonProgramFiles%\System\ado\msado25.tlb.new
%CommonProgramFiles%\System\ado\msado26.tlb.new
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global-platform\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\pippki\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\pippki\content\DECRYPT__INFORMATION.html
<SYSTEM32>\dllcache\msado21.tlb.new
<SYSTEM32>\dllcache\msado20.tlb.new
<SYSTEM32>\dllcache\msado27.tlb.new
%ProgramFiles%\FireFox\chrome\toolkit\DECRYPT__INFORMATION.html
<SYSTEM32>\dllcache\msado25.tlb.new
<SYSTEM32>\dllcache\msado26.tlb.new
%ProgramFiles%\FireFox\chrome\toolkit\content\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\toolkit\content\global\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\toolkit\skin\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\en-US\locale\DECRYPT__INFORMATION.html
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\DECRYPT__INFORMATION.html
C:\Muldrop\DECRYPT__INFORMATION.iunm_32
C:\Muldrop\DECRYPT__INFORMATION.iunm_37
C:\Muldrop\DECRYPT__INFORMATION.iunm_30
C:\Documents and Settings\NetworkService\DECRYPT__INFORMATION.html
C:\Documents and Settings\NetworkService\Local Settings\DECRYPT__INFORMATION.html
C:\Documents and Settings\NetworkService\Local Settings\History\DECRYPT__INFORMATION.html
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\DECRYPT__INFORMATION.html
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\DECRYPT__INFORMATION.html
%HOMEPATH%\DECRYPT__INFORMATION.html
%APPDATA%\DECRYPT__INFORMATION.html
%APPDATA%\Identities\DECRYPT__INFORMATION.html
%HOMEPATH%\Favorites\DECRYPT__INFORMATION.html
%HOMEPATH%\Local Settings\DECRYPT__INFORMATION.html
<LS_APPDATA>\DECRYPT__INFORMATION.html
<LS_APPDATA>\Identities\DECRYPT__INFORMATION.html
%HOMEPATH%\Local Settings\History\DECRYPT__INFORMATION.html
%HOMEPATH%\Local Settings\History\History.IE5\DECRYPT__INFORMATION.html
%HOMEPATH%\Local Settings\<INETFILES>\DECRYPT__INFORMATION.html
%HOMEPATH%\My Documents\DECRYPT__INFORMATION.html
%HOMEPATH%\Start Menu\DECRYPT__INFORMATION.html
%HOMEPATH%\Start Menu\Programs\DECRYPT__INFORMATION.html
%HOMEPATH%\Start Menu\Programs\Accessories\DECRYPT__INFORMATION.html
C:\Far2\DECRYPT__INFORMATION.html
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\DECRYPT__INFORMATION.html
C:\Far2\Addons\DECRYPT__INFORMATION.html
C:\Documents and Settings\LocalService\Local Settings\History\DECRYPT__INFORMATION.html
C:\Documents and Settings\LocalService\DECRYPT__INFORMATION.html
C:\Documents and Settings\Default User\PUBLIC
C:\Documents and Settings\Default User\UNIQUE__ID_DO_NOT__REMOVE
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_23ef5514-3059-436f-a4a7-4cefaab20eb1
C:\DECRYPT__INFORMATION.html
C:\Documents and Settings\DECRYPT__INFORMATION.html
%ALLUSERSPROFILE%\DECRYPT__INFORMATION.html
%ALLUSERSPROFILE%\Documents\DECRYPT__INFORMATION.html
%ALLUSERSPROFILE%\Documents\My Music\DECRYPT__INFORMATION.html
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\DECRYPT__INFORMATION.html
%ALLUSERSPROFILE%\Documents\My Pictures\DECRYPT__INFORMATION.html
%ALLUSERSPROFILE%\Start Menu\DECRYPT__INFORMATION.html
%ALLUSERSPROFILE%\Start Menu\Programs\DECRYPT__INFORMATION.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\DECRYPT__INFORMATION.html
C:\Documents and Settings\Default User\DECRYPT__INFORMATION.html
C:\Documents and Settings\Default User\Local Settings\DECRYPT__INFORMATION.html
C:\Documents and Settings\Default User\Local Settings\History\DECRYPT__INFORMATION.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\DECRYPT__INFORMATION.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\DECRYPT__INFORMATION.html
C:\Documents and Settings\Default User\Start Menu\DECRYPT__INFORMATION.html
C:\Documents and Settings\Default User\Start Menu\Programs\DECRYPT__INFORMATION.html
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\DECRYPT__INFORMATION.html
C:\Documents and Settings\LocalService\Local Settings\DECRYPT__INFORMATION.html
C:\Far2\Addons\Colors\DECRYPT__INFORMATION.html
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\DECRYPT__INFORMATION.html
C:\Far2\Addons\XLat\DECRYPT__INFORMATION.html
C:\Muldrop\DECRYPT__INFORMATION.iunm_24
C:\Muldrop\DECRYPT__INFORMATION.iunm_35
C:\Muldrop\DECRYPT__INFORMATION.iunm_4
C:\Muldrop\DECRYPT__INFORMATION.iunm_38
C:\Muldrop\DECRYPT__INFORMATION.iunm_10
C:\Muldrop\DECRYPT__INFORMATION.iunm_12
C:\Muldrop\DECRYPT__INFORMATION.iunm_2
C:\Muldrop\DECRYPT__INFORMATION.iunm_28
C:\Muldrop\DECRYPT__INFORMATION.iunm_36
C:\Muldrop\DECRYPT__INFORMATION.iunm_59
C:\Muldrop\DECRYPT__INFORMATION.iunm_13
C:\Muldrop\DECRYPT__INFORMATION.iunm_6
C:\Muldrop\DECRYPT__INFORMATION.iunm_64
C:\Muldrop\DECRYPT__INFORMATION.iunm_60
C:\Muldrop\DECRYPT__INFORMATION.iunm_49
C:\Muldrop\DECRYPT__INFORMATION.iunm_54
C:\Muldrop\DECRYPT__INFORMATION.iunm_23
C:\Muldrop\DECRYPT__INFORMATION.iunm_62
C:\Muldrop\DECRYPT__INFORMATION.iunm_44
C:\Muldrop\DECRYPT__INFORMATION.iunm_63
C:\Muldrop\DECRYPT__INFORMATION.iunm_15
C:\Muldrop\DECRYPT__INFORMATION.iunm_17
C:\Muldrop\DECRYPT__INFORMATION.iunm_51
C:\Muldrop\DECRYPT__INFORMATION.iunm_50
C:\Muldrop\DECRYPT__INFORMATION.iunm_31
C:\Far2\Documentation\DECRYPT__INFORMATION.html
C:\Far2\Plugins\Colorer\DECRYPT__INFORMATION.html
C:\Far2\Plugins\Colorer\hrc\DECRYPT__INFORMATION.html
C:\Far2\Plugins\Colorer\hrc\auto\DECRYPT__INFORMATION.html
C:\Far2\Plugins\Colorer\hrd\DECRYPT__INFORMATION.html
C:\Far2\Plugins\Colorer\hrd\console\DECRYPT__INFORMATION.html
C:\Far2\Plugins\ExtSearch\DECRYPT__INFORMATION.html
C:\Far2\Plugins\ExtSearch\sources\DECRYPT__INFORMATION.html
C:\Far2\Plugins\FTP\DECRYPT__INFORMATION.html
C:\Far2\Plugins\WinSCP\DECRYPT__INFORMATION.html
C:\RECYCLER\DECRYPT__INFORMATION.html
%ProgramFiles%\Internet Explorer\MUI\DECRYPT__INFORMATION.html
C:\Far2\Plugins\WinSCP\filezilla\DECRYPT__INFORMATION.html
C:\Far2\PluginSDK\DECRYPT__INFORMATION.html
C:\Muldrop\08f575673ddf10d72090304839888f02_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0
C:\Muldrop\7ed80875910261ef2gb3c5g12ffgd92g_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_0
C:\Muldrop\7ed80875910261ef2gb3c5g12ffgd92g_23fg5514-3059-436g-b4b7-4dfgbbc20fc1_1
C:\Muldrop\DECRYPT__INFORMATION.iunm_1
C:\Muldrop\DECRYPT__INFORMATION.iunm_0
C:\Muldrop\DECRYPT__INFORMATION.iunm_39
C:\Muldrop\DECRYPT__INFORMATION.iunm_40
C:\Muldrop\DECRYPT__INFORMATION.iunm_25
C:\Far2\Plugins\DECRYPT__INFORMATION.html
C:\Far2\Plugins\WinSCP\putty\DECRYPT__INFORMATION.html
<STUBS_DIR>\DECRYPT__INFORMATION.html

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней