Trojan.Encoder.31526

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\ce34.tmp\ce35.tmp\ce36.bat
%HOMEPATH%\downloads\tcmd851ax64.exe.cruel
%HOMEPATH%\downloads\steamsetup.exe.cruel
%HOMEPATH%\downloads\pidgin-2.10.11.exe.cruel
%HOMEPATH%\downloads\opera_ni_stable.exe.cruel
%HOMEPATH%\downloads\mirc741.exe.cruel
%HOMEPATH%\downloads\magent_rfrset.exe.cruel
%HOMEPATH%\downloads\k-lite_codec_pack_1110_mega_dlm.exe.cruel
%HOMEPATH%\downloads\k-lite_codec_pack_1110_mega.exe.cruel
%HOMEPATH%\downloads\jre-8u45-windows-x64.exe.cruel
%HOMEPATH%\downloads\thunderbird setup 31.6.0.exe.cruel
%HOMEPATH%\downloads\icq_rfrset.exe.cruel
%HOMEPATH%\desktop\wrar520.exe.cruel
%HOMEPATH%\desktop\utorrent.exe.cruel
%HOMEPATH%\desktop\total commander 64 bit.lnk.cruel
%HOMEPATH%\desktop\telegram.lnk.cruel
%HOMEPATH%\desktop\skypesetup.exe.cruel
%HOMEPATH%\desktop\qip 2012.lnk.cruel
%HOMEPATH%\desktop\mail.ru agent.lnk.cruel
%HOMEPATH%\desktop\icq.lnk.cruel
%HOMEPATH%\desktop\chromesetup.exe.cruel
%HOMEPATH%\downloads\chromesetup.exe.cruel
%HOMEPATH%\downloads\winamp5666_full_all.exe.cruel

Удаляет следующие файлы

%TEMP%\ce34.tmp\ce35.tmp\ce36.bat

Самоудаляется.

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Другое

Создает и запускает на исполнение

'<SYSTEM32>\cmd.exe' /c "%TEMP%\CE34.tmp\CE35.tmp\CE36.bat <Полный путь к файлу>"' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c "%TEMP%\CE34.tmp\CE35.tmp\CE36.bat <Полный путь к файлу>"
'<SYSTEM32>\certutil.exe' -encode "Total Commander 64 bit.lnk.Sister" "Total Commander 64 bit.lnk.Cruel"
'<SYSTEM32>\certutil.exe' -encode "tree_view.htm.Sister" "tree_view.htm.Cruel"
'<SYSTEM32>\certutil.exe' -encode "trivial-merge.htm.Sister" "trivial-merge.htm.Cruel"
'<SYSTEM32>\certutil.exe' -encode "uep_form_786_bulletin_1726i602.doc.Sister" "uep_form_786_bulletin_1726i602.doc.Cruel"
'<SYSTEM32>\certutil.exe' -encode "utorrent.exe.Sister" "utorrent.exe.Cruel"
'<SYSTEM32>\certutil.exe' -encode "wrar520.exe.Sister" "wrar520.exe.Cruel"
'<SYSTEM32>\certutil.exe' -encode "icq_rfrset.exe.Sister" "icq_rfrset.exe.Cruel"
'<SYSTEM32>\certutil.exe' -encode "contosoroot.cer.Sister" "contosoroot.cer.Cruel"
'<SYSTEM32>\certutil.exe' -encode "jre-8u45-windows-x64.exe.Sister" "jre-8u45-windows-x64.exe.Cruel"
'<SYSTEM32>\certutil.exe' -encode "K-Lite_Codec_Pack_1110_Mega_dlm.exe.Sister" "K-Lite_Codec_Pack_1110_Mega_dlm.exe.Cruel"
'<SYSTEM32>\certutil.exe' -encode "magent_rfrset.exe.Sister" "magent_rfrset.exe.Cruel"
'<SYSTEM32>\certutil.exe' -encode "mirc741.exe.Sister" "mirc741.exe.Cruel"
'<SYSTEM32>\certutil.exe' -encode "Opera_NI_stable.exe.Sister" "Opera_NI_stable.exe.Cruel"
'<SYSTEM32>\certutil.exe' -encode "pidgin-2.10.11.exe.Sister" "pidgin-2.10.11.exe.Cruel"
'<SYSTEM32>\certutil.exe' -encode "SteamSetup.exe.Sister" "SteamSetup.exe.Cruel"
'<SYSTEM32>\certutil.exe' -encode "tcmd851ax64.exe.Sister" "tcmd851ax64.exe.Cruel"
'<SYSTEM32>\certutil.exe' -encode "split.avi.Sister" "split.avi.Cruel"
'<SYSTEM32>\certutil.exe' -encode "Telegram.lnk.Sister" "Telegram.lnk.Cruel"
'<SYSTEM32>\certutil.exe' -encode "skypesetup.exe.Sister" "skypesetup.exe.Cruel"
'<SYSTEM32>\certutil.exe' -encode "sdszfo.docx.Sister" "sdszfo.docx.Cruel"
'<SYSTEM32>\certutil.exe' -encode "region-north-karelia.jpg.Sister" "region-north-karelia.jpg.Cruel"
'<SYSTEM32>\certutil.exe' -encode "210252809.jpeg.Sister" "210252809.jpeg.Cruel"
'<SYSTEM32>\certutil.exe' -encode "508softwareandos.doc.Sister" "508softwareandos.doc.Cruel"
'<SYSTEM32>\certutil.exe' -encode "adhd_and_obesity.docx.Sister" "adhd_and_obesity.docx.Cruel"
'<SYSTEM32>\certutil.exe' -encode "alert.htm.Sister" "alert.htm.Cruel"
'<SYSTEM32>\certutil.exe' -encode "archer.avi.Sister" "archer.avi.Cruel"
'<SYSTEM32>\certutil.exe' -encode "browse.html.Sister" "browse.html.Cruel"
'<SYSTEM32>\certutil.exe' -encode "chromesetup.exe.Sister" "chromesetup.exe.Cruel"
'<SYSTEM32>\certutil.exe' -encode "Thunderbird Setup 31.6.0.exe.Sister" "Thunderbird Setup 31.6.0.exe.Cruel"
'<SYSTEM32>\certutil.exe' -encode "K-Lite_Codec_Pack_1110_Mega.exe.Sister" "K-Lite_Codec_Pack_1110_Mega.exe.Cruel"
'<SYSTEM32>\certutil.exe' -encode "contoso.cer.Sister" "contoso.cer.Cruel"
'<SYSTEM32>\certutil.exe' -encode "dashBorder_96.bmp.Sister" "dashBorder_96.bmp.Cruel"
'<SYSTEM32>\certutil.exe' -encode "file_p_00000000_1371597592.docx.Sister" "file_p_00000000_1371597592.docx.Cruel"
'<SYSTEM32>\certutil.exe' -encode "ICQ.lnk.Sister" "ICQ.lnk.Cruel"
'<SYSTEM32>\certutil.exe' -encode "join.avi.Sister" "join.avi.Cruel"
'<SYSTEM32>\certutil.exe' -encode "lisp_success.doc.Sister" "lisp_success.doc.Cruel"
'<SYSTEM32>\certutil.exe' -encode "Mail.Ru Agent.lnk.Sister" "Mail.Ru Agent.lnk.Cruel"
'<SYSTEM32>\certutil.exe' -encode "QIP 2012.lnk.Sister" "QIP 2012.lnk.Cruel"
'<SYSTEM32>\certutil.exe' -encode "168.jpeg.Sister" "168.jpeg.Cruel"
'<SYSTEM32>\certutil.exe' -encode "correct.avi.Sister" "correct.avi.Cruel"
'<SYSTEM32>\certutil.exe' -encode "winamp5666_full_all.exe.Sister" "winamp5666_full_all.exe.Cruel"