Trojan.Encoder.25633

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MSFEEditor' = '"<Полный путь к файлу>" e'

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\000000000.key
%ALLUSERSPROFILE%\Desktop\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Desktop\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Documents\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Documents\My Pictures\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Documents\My Pictures\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Documents\My Pictures\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Desktop\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Documents\My Music\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Documents\My Music\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Documents\My Music\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Documents\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Documents\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\Microsoft\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Application Data\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Application Data\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\@_DECRYPT3_@.tx.txt
C:\Documents and Settings\@_DECRYPT3_@.tx.txt
C:\Documents and Settings\@_DECRYPT2_@.tx
C:\Documents and Settings\@_DECRYPT_@.txt
<Текущая директория>\@_DECRYPT3_@.tx.txt
<Текущая директория>\@_DECRYPT2_@.tx
<Текущая директория>\@_DECRYPT_@.txt
C:\@_DECRYPT3_@.tx.txt
C:\@_DECRYPT2_@.tx
C:\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\@_DECRYPT_@.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\@_DECRYPT3_@.tx.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\@_DECRYPT2_@.tx
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\@_DECRYPT3_@.tx.txt