Trojan.Encoder.30857

Техническая информация

Для обеспечения автозапуска и распространения

Создает следующие файлы на съемном носителе

<Имя диска съемного носителя>:\correct.avi.lonleyencryptedfile
<Имя диска съемного носителя>:\join.avi.lonleyencryptedfile

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
%HOMEPATH%\desktop\region-north-karelia.jpeg
%HOMEPATH%\desktop\pushkin.jpeg
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\ituneshelpunavailable.html
%HOMEPATH%\desktop\howto-index.html
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\browse.html
%HOMEPATH%\desktop\browse.htm
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\tree_view.htm
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc

Изменения в файловой системе

Создает следующие файлы

D:\$recycle.bin.lonleyencryptedfile
%WINDIR%\syswow64\acledit.dll.lonleyencryptedfile
%WINDIR%\syswow64\acctres.dll.lonleyencryptedfile
C:\far2\fareng.lng.lonleyencryptedfile
C:\far2\fareng.hlf.lonleyencryptedfile
C:\far2\farcze.lng.lonleyencryptedfile
%WINDIR%\explorer.exe.lonleyencryptedfile
%WINDIR%\syswow64\accessibilitycpl.dll.lonleyencryptedfile
C:\far2\far.map.lonleyencryptedfile
%HOMEPATH%\desktop\utorrent.exe.lonleyencryptedfile
C:\far2\far.exe.lonleyencryptedfile
C:\far2\clearpluginscache.cmd.lonleyencryptedfile
%WINDIR%\syswow64\aaclient.dll.lonleyencryptedfile
C:\far2\changelog_eng.lonleyencryptedfile
C:\far2\changelog.lonleyencryptedfile
<Полный путь к файлу>.lonleyencryptedfile
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.lonleyencryptedfile
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\...lonleyencryptedfile
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\..lonleyencryptedfile
%WINDIR%\syswow64\ac3acm.acm.lonleyencryptedfile
%WINDIR%\syswow64\12520850.cpx.lonleyencryptedfile
C:\far2\farger.lng.lonleyencryptedfile
%WINDIR%\flash_sa.exe.lonleyencryptedfile
C:\far2\restoresettings.cmd.lonleyencryptedfile
C:\far2\file_id.diz.lonleyencryptedfile
%WINDIR%\helppane.exe.lonleyencryptedfile
%WINDIR%\syswow64\adaptertroubleshooter.exe.lonleyencryptedfile
%WINDIR%\syswow64\actxprxy.dll.lonleyencryptedfile
C:\far2\farspa.lng.lonleyencryptedfile
C:\far2\farrus.lng.lonleyencryptedfile
%WINDIR%\fveupdate.exe.lonleyencryptedfile
%WINDIR%\syswow64\aclui.dll.lonleyencryptedfile
C:\far2\farhun.hlf.lonleyencryptedfile
C:\far2\farrus.hlf.lonleyencryptedfile
%WINDIR%\syswow64\activeds.tlb.lonleyencryptedfile
%WINDIR%\syswow64\activeds.dll.lonleyencryptedfile
%WINDIR%\syswow64\actioncentercpl.dll.lonleyencryptedfile
C:\far2\farpol.lng.lonleyencryptedfile
%WINDIR%\syswow64\actioncenter.dll.lonleyencryptedfile
C:\far2\farhun.lng.lonleyencryptedfile
%WINDIR%\syswow64\acppage.dll.lonleyencryptedfile
%WINDIR%\fonts.lonleyencryptedfile
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001.lonleyencryptedfile
C:\$recycle.bin\...lonleyencryptedfile
%WINDIR%\enterprise.xml.lonleyencryptedfile
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\...lonleyencryptedfile
C:\documents and settings.lonleyencryptedfile
C:\$recycle.bin.lonleyencryptedfile
%WINDIR%\assembly.lonleyencryptedfile
%HOMEPATH%\desktop\browse.html.lonleyencryptedfile
%HOMEPATH%\desktop\browse.htm.lonleyencryptedfile
%HOMEPATH%\desktop\archer.avi.lonleyencryptedfile
C:\msocache.lonleyencryptedfile
%HOMEPATH%\desktop\about.html.lonleyencryptedfile
%HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.lonleyencryptedfile
%HOMEPATH%\desktop\...lonleyencryptedfile
%HOMEPATH%\desktop\..lonleyencryptedfile
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\..lonleyencryptedfile
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001.lonleyencryptedfile
D:\$recycle.bin\...lonleyencryptedfile
D:\$recycle.bin\..lonleyencryptedfile
D:\system volume information.lonleyencryptedfile
%HOMEPATH%\desktop\64bit_notes.htm.lonleyencryptedfile
C:\pagefile.sys.lonleyencryptedfile
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.lonleyencryptedfile
%ProgramFiles%.lonleyencryptedfile
%WINDIR%\dtcinstall.log.lonleyencryptedfile
%HOMEPATH%\desktop\tcm851ax32.exe.lonleyencryptedfile
%WINDIR%\directx.log.lonleyencryptedfile
%WINDIR%\bootstat.dat.lonleyencryptedfile
%WINDIR%\bitlockerdiscoveryvolumecontents.lonleyencryptedfile
%WINDIR%\bfsvc.exe.lonleyencryptedfile
%WINDIR%\syswow64\12520437.cpx.lonleyencryptedfile
C:\$recycle.bin\..lonleyencryptedfile
%HOMEPATH%\desktop\total commander 64 bit.lnk.lonleyencryptedfile
%HOMEPATH%\desktop\telegram.lnk.lonleyencryptedfile
%HOMEPATH%\desktop\qip 2012.lnk.lonleyencryptedfile
%ProgramFiles(x86)%.lonleyencryptedfile
%HOMEPATH%\desktop\mail.ru agent.lnk.lonleyencryptedfile
%HOMEPATH%\desktop\icq.lnk.lonleyencryptedfile
%HOMEPATH%\desktop\dotnetfx45_full_setup.exe.lonleyencryptedfile
%HOMEPATH%\desktop\desktop.ini.lonleyencryptedfile
C:\users.lonleyencryptedfile
C:\system volume information.lonleyencryptedfile
C:\recovery.lonleyencryptedfile
%PROGRAMDATA%.lonleyencryptedfile
C:\far2\savesettings.cmd.lonleyencryptedfile
C:\far2\addons\descript.ion.lonleyencryptedfile