Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- %ALLUSERSPROFILE%\start menu\programs\startup\exf27xt8u-readme.txt
Вредоносные функции
Для затруднения выявления своего присутствия в системе
удаляет теневые копии разделов.
Завершает или пытается завершить
следующие пользовательские процессы:
- firefox.exe
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\168.jpeg
- %HOMEPATH%\desktop\testee.cer
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\region-north-karelia.jpeg
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ituneshelpunavailable.html
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\alert.html
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\64bit_notes.htm
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpg
- %HOMEPATH%\desktop\210252809.jpg
- %HOMEPATH%\desktop\2.jpg
- %HOMEPATH%\desktop\2.jpeg
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\tree_view.htm
Изменения в файловой системе
Создает следующие файлы
- C:\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\start menu\programs\mirc\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\start menu\programs\microsoft office\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\start menu\programs\microsoft .net framework sdk v1.1\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\start menu\programs\google chrome\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\start menu\programs\games\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\start menu\programs\administrative tools\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\start menu\programs\accessories\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\documents\my pictures\sample pictures\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\documents\my music\sample playlists\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\documents\my music\sample music\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\documents\my music\my playlists\exf27xt8u-readme.txt
- C:\documents and settings\networkservice\local settings\history\exf27xt8u-readme.txt
- %HOMEPATH%\userdata\ubghkdcj\exf27xt8u-readme.txt
- %HOMEPATH%\userdata\e3unqlkn\exf27xt8u-readme.txt
- %HOMEPATH%\userdata\09upir0l\exf27xt8u-readme.txt
- %HOMEPATH%\start menu\programs\exf27xt8u-readme.txt
- %HOMEPATH%\my documents\my pictures\exf27xt8u-readme.txt
- %HOMEPATH%\my documents\my music\exf27xt8u-readme.txt
- %HOMEPATH%\my documents\downloads\exf27xt8u-readme.txt
- %HOMEPATH%\local settings\<INETFILES>\exf27xt8u-readme.txt
- %TEMP%\exf27xt8u-readme.txt
- %HOMEPATH%\local settings\history\exf27xt8u-readme.txt
- %HOMEPATH%\favorites\links\exf27xt8u-readme.txt
- C:\documents and settings\networkservice\local settings\<INETFILES>\exf27xt8u-readme.txt
- %HOMEPATH%\userdata\inafedwn\exf27xt8u-readme.txt
- C:\documents and settings\networkservice\local settings\temp\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\start menu\programs\qip 2012\exf27xt8u-readme.txt
- %HOMEPATH%\favorites\links\почта.url
- %TEMP%\scoped_dir_2064_18724\exf27xt8u-readme.txt
- %TEMP%\pyl1.tmp\exf27xt8u-readme.txt
- %TEMP%\outlook logging\exf27xt8u-readme.txt
- %TEMP%\opera installer\exf27xt8u-readme.txt
- %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_10.0.30319\exf27xt8u-readme.txt
- %TEMP%\microsoft .net framework 4 setup_4.0.30319\exf27xt8u-readme.txt
- %TEMP%\lilo.1120\exf27xt8u-readme.txt
- %TEMP%\hsperfdata_user\exf27xt8u-readme.txt
- %TEMP%\history\exf27xt8u-readme.txt
- %TEMP%\cookies\exf27xt8u-readme.txt
- %TEMP%\adobe_admlogs\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\start menu\programs\winrar\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\start menu\programs\steam\exf27xt8u-readme.txt
- %TEMP%\7f4987fb1a6e43d69e3e94b29eb75926\exf27xt8u-readme.txt
- %TEMP%\2.9.0.1467 (partner)\exf27xt8u-readme.txt
- %HOMEPATH%\local settings\history\history.ie5\exf27xt8u-readme.txt
- C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\exf27xt8u-readme.txt
- C:\documents and settings\networkservice\local settings\history\history.ie5\exf27xt8u-readme.txt
- C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\exf27xt8u-readme.txt
- C:\documents and settings\localservice\local settings\history\history.ie5\exf27xt8u-readme.txt
- C:\documents and settings\default user\start menu\programs\startup\exf27xt8u-readme.txt
- C:\documents and settings\default user\start menu\programs\accessories\exf27xt8u-readme.txt
- C:\documents and settings\default user\local settings\<INETFILES>\content.ie5\exf27xt8u-readme.txt
- C:\documents and settings\default user\local settings\history\history.ie5\exf27xt8u-readme.txt
- %HOMEPATH%\favorites\links\яндекс.url
- C:\documents and settings\localservice\local settings\<INETFILES>\exf27xt8u-readme.txt
- C:\documents and settings\localservice\local settings\temp\exf27xt8u-readme.txt
- C:\documents and settings\localservice\local settings\history\exf27xt8u-readme.txt
- C:\documents and settings\default user\printhood\exf27xt8u-readme.txt
- C:\documents and settings\default user\nethood\exf27xt8u-readme.txt
- C:\documents and settings\default user\my documents\exf27xt8u-readme.txt
- C:\documents and settings\default user\local settings\exf27xt8u-readme.txt
- C:\documents and settings\default user\favorites\exf27xt8u-readme.txt
- C:\documents and settings\default user\desktop\exf27xt8u-readme.txt
- C:\documents and settings\default user\cookies\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\templates\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\start menu\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\favorites\exf27xt8u-readme.txt
- C:\documents and settings\default user\sendto\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\drm\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\desktop\exf27xt8u-readme.txt
- C:\recycler\s-1-5-21-1229272821-842925246-1060284298-1003\exf27xt8u-readme.txt
- %HOMEPATH%\exf27xt8u-readme.txt
- C:\documents and settings\networkservice\exf27xt8u-readme.txt
- C:\documents and settings\localservice\exf27xt8u-readme.txt
- C:\documents and settings\default user\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\exf27xt8u-readme.txt
- C:\recycler\exf27xt8u-readme.txt
- %ProgramFiles%\exf27xt8u-readme.txt
- <Текущая директория>\exf27xt8u-readme.txt
- C:\documents and settings\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\documents\exf27xt8u-readme.txt
- C:\documents and settings\default user\start menu\exf27xt8u-readme.txt
- C:\documents and settings\default user\recent\exf27xt8u-readme.txt
- C:\documents and settings\default user\templates\exf27xt8u-readme.txt
- C:\documents and settings\default user\start menu\programs\exf27xt8u-readme.txt
- %HOMEPATH%\sendto\exf27xt8u-readme.txt
- C:\documents and settings\default user\local settings\<INETFILES>\exf27xt8u-readme.txt
- C:\documents and settings\default user\local settings\temp\exf27xt8u-readme.txt
- C:\documents and settings\default user\local settings\history\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\start menu\programs\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\documents\my videos\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\documents\my pictures\exf27xt8u-readme.txt
- %ALLUSERSPROFILE%\documents\my music\exf27xt8u-readme.txt
- %HOMEPATH%\voip\exf27xt8u-readme.txt
- %HOMEPATH%\userdata\exf27xt8u-readme.txt
- %HOMEPATH%\templates\exf27xt8u-readme.txt
- %HOMEPATH%\start menu\exf27xt8u-readme.txt
- %HOMEPATH%\recent\exf27xt8u-readme.txt
- C:\documents and settings\localservice\cookies\exf27xt8u-readme.txt
- %HOMEPATH%\printhood\exf27xt8u-readme.txt
- %HOMEPATH%\nethood\exf27xt8u-readme.txt
- %HOMEPATH%\my documents\exf27xt8u-readme.txt
- %HOMEPATH%\local settings\exf27xt8u-readme.txt
- %HOMEPATH%\favorites\exf27xt8u-readme.txt
- %HOMEPATH%\desktop\exf27xt8u-readme.txt
- %HOMEPATH%\cookies\exf27xt8u-readme.txt
- %HOMEPATH%\.oracle_jre_usage\exf27xt8u-readme.txt
- C:\documents and settings\networkservice\local settings\exf27xt8u-readme.txt
- C:\documents and settings\networkservice\cookies\exf27xt8u-readme.txt
- C:\documents and settings\localservice\local settings\exf27xt8u-readme.txt
- %TEMP%\scoped_dir_2812_13253\exf27xt8u-readme.txt
- %TEMP%\scoped_dir_2812_24406\exf27xt8u-readme.txt
Перемещает следующие файлы
- %HOMEPATH%\favorites\links\почта.url в %HOMEPATH%\favorites\links\почта.url.exf27xt8u
- %TEMP%\dotnetfxsdk.log в %TEMP%\dotnetfxsdk.log.exf27xt8u
- %TEMP%\jaureg.log в %TEMP%\jaureg.log.exf27xt8u
- %TEMP%\dd_vcredist_x86_20151215221751_001_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20151215221751_001_vcruntimeadditional_x86.log.exf27xt8u
- %TEMP%\dd_xps.txt в %TEMP%\dd_xps.txt.exf27xt8u
- %TEMP%\javadeployreg.log в %TEMP%\javadeployreg.log.exf27xt8u
- %TEMP%\dd_net_framework30_setup7762.txt в %TEMP%\dd_net_framework30_setup7762.txt.exf27xt8u
- %TEMP%\dd_depcheck_netfx20_exp_35.txt в %TEMP%\dd_depcheck_netfx20_exp_35.txt.exf27xt8u
- %TEMP%\java_install.log в %TEMP%\java_install.log.exf27xt8u
- %TEMP%\jusched.log в %TEMP%\jusched.log.exf27xt8u
- %TEMP%\dd_net_framework35_msi77c4.txt в %TEMP%\dd_net_framework35_msi77c4.txt.exf27xt8u
- %TEMP%\dd_net_framework20_setup74f9.txt в %TEMP%\dd_net_framework20_setup74f9.txt.exf27xt8u
- %TEMP%\setupexe(201511201342324e4).log в %TEMP%\setupexe(201511201342324e4).log.exf27xt8u
- %TEMP%\setupexe(20151215230521214).log в %TEMP%\setupexe(20151215230521214).log.exf27xt8u
- %TEMP%\setupexe(2015121523093290).log в %TEMP%\setupexe(2015121523093290).log.exf27xt8u
- %TEMP%\dd_vcredist_x86_20151215221751.log в %TEMP%\dd_vcredist_x86_20151215221751.log.exf27xt8u
- %TEMP%\dd_vcredist_x86_20151215221751_000_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20151215221751_000_vcruntimeminimum_x86.log.exf27xt8u
- %TEMP%\dotnetfx.log в %TEMP%\dotnetfx.log.exf27xt8u
- %TEMP%\dd_wcf_retca4a2a.txt в %TEMP%\dd_wcf_retca4a2a.txt.exf27xt8u
- %TEMP%\dd_dotnetfx35install.txt в %TEMP%\dd_dotnetfx35install.txt.exf27xt8u
- %TEMP%\adobearm.log в %TEMP%\adobearm.log.exf27xt8u
- %TEMP%\adobearm_notlocked.log в %TEMP%\adobearm_notlocked.log.exf27xt8u
- %TEMP%\adobesfx.log в %TEMP%\adobesfx.log.exf27xt8u
- %TEMP%\aspnetsetup.log в %TEMP%\aspnetsetup.log.exf27xt8u
- %TEMP%\aspnetsetup_00000.log в %TEMP%\aspnetsetup_00000.log.exf27xt8u
- %TEMP%\aucheck_parser.txt в %TEMP%\aucheck_parser.txt.exf27xt8u
- %TEMP%\uxeventlog.txt в %TEMP%\uxeventlog.txt.exf27xt8u
- %TEMP%\java_install_reg.log в %TEMP%\java_install_reg.log.exf27xt8u
- %TEMP%\dd_clwireg.txt в %TEMP%\dd_clwireg.txt.exf27xt8u
- %TEMP%\dd_dotnetfx35error.txt в %TEMP%\dd_dotnetfx35error.txt.exf27xt8u
- %TEMP%\dd_depcheck_netfx_exp_35.txt в %TEMP%\dd_depcheck_netfx_exp_35.txt.exf27xt8u
- %TEMP%\dd_dotnetfx20install.txt в %TEMP%\dd_dotnetfx20install.txt.exf27xt8u
- %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt в %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt.exf27xt8u
- %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt в %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.exf27xt8u
- %TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt в %TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt.exf27xt8u
- %HOMEPATH%\favorites\links\яндекс.url в %HOMEPATH%\favorites\links\яндекс.url.exf27xt8u
- %TEMP%\dd_dotnetfx20error.txt в %TEMP%\dd_dotnetfx20error.txt.exf27xt8u
- %TEMP%\wubi-14.04-rev286.log в %TEMP%\wubi-14.04-rev286.log.exf27xt8u
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Другое
Создает и запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
