Trojan.Encoder.32175

Техническая информация

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\pushkin.jpeg
%HOMEPATH%\desktop\parnas_01.jpeg
%HOMEPATH%\desktop\ituneshelpunavailable.htm
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\advice_process.htm
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\64bit_notes.htm
%HOMEPATH%\desktop\2.jpeg
%HOMEPATH%\desktop\testee.cer
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx

Ищет следующие окна с целью

обнаружения утилит для анализа:

ClassName: 'ollydbg', WindowName: ''
ClassName: 'TDeDeMainForm', WindowName: ''
ClassName: 'TIdaWindow', WindowName: ''
ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'

Изменения в файловой системе

Создает следующие файлы

<Текущая директория>\extradll.dll
%HOMEPATH%\desktop\ГЇВµГВіВІВ№В¶ВЎ.exe

Удаляет следующие файлы

%HOMEPATH%\desktop\ГЇВµГВіВІВ№В¶ВЎ.exe

Изменяет множество файлов пользовательских данных (Trojan.Encoder).

Другое

Ищет следующие окна

ClassName: '1212121' WindowName: ''
ClassName: '' WindowName: 'mIRC.lnk'
ClassName: '' WindowName: 'Mozilla Thunderbird.lnk'
ClassName: '' WindowName: 'parnas_01.jpeg'
ClassName: '' WindowName: 'Pidgin.lnk'
ClassName: '' WindowName: 'pushkin.jpeg'
ClassName: '' WindowName: 'QIP 2012.lnk'
ClassName: '' WindowName: 'SDKSamplePrivDeveloper.cer'
ClassName: '' WindowName: 'tcm851ax32.exe'
ClassName: '' WindowName: 'Telegram.lnk'
ClassName: '' WindowName: 'testEE.cer'
ClassName: '' WindowName: 'winmine.exe'
ClassName: '' WindowName: 'System Volume Information'
ClassName: '' WindowName: 'ГЏВµГЌВіВІВ№В¶ВЎ.exe'
ClassName: '' WindowName: '$Recycle.Bin'
ClassName: '' WindowName: 'autoexec.bat'
ClassName: '' WindowName: 'config.sys'
ClassName: '' WindowName: 'Documents and Settings'
ClassName: '' WindowName: 'MSOCache'
ClassName: '' WindowName: 'pagefile.sys'
ClassName: '' WindowName: 'Program Files'
ClassName: '' WindowName: 'ProgramData'
ClassName: '' WindowName: 'Recovery'
ClassName: '' WindowName: 'iTunesHelpUnavailable.htm'
ClassName: '' WindowName: 'thlps_keeper_mayer_1965.docx'
ClassName: '' WindowName: 'issi2013_template_for_posters.docx'
ClassName: '' WindowName: '64bit_notes.htm'
ClassName: 'icu_dbg' WindowName: ''
ClassName: 'pe--diy' WindowName: ''
ClassName: 'odbydyk' WindowName: ''
ClassName: '' WindowName: 'Import REConstructor v1.6 FINAL (C) 2001-2003 MackT/uCF'
ClassName: 'kk1' WindowName: ''
ClassName: 'Eew75' WindowName: ''
ClassName: 'Shadow' WindowName: ''
ClassName: 'WinDbgFrameClass' WindowName: ''
ClassName: '' WindowName: '000814251_video_01.avi'
ClassName: '' WindowName: '2.jpeg'
ClassName: '' WindowName: 'about.html'
ClassName: '' WindowName: 'hanni_umami_chapter.doc'
ClassName: '' WindowName: 'advice_process.htm'
ClassName: '' WindowName: 'coffee.bmp'
ClassName: '' WindowName: 'contoso.cer'
ClassName: '' WindowName: 'contosoroot.cer'
ClassName: '' WindowName: 'correct.avi'
ClassName: '' WindowName: 'default.bmp'
ClassName: '' WindowName: 'delete.avi'
ClassName: '' WindowName: 'desktop.ini'
ClassName: '' WindowName: 'dotnetfx45_full_setup.exe'
ClassName: '' WindowName: 'Garden.htm'
ClassName: '' WindowName: 'ICQ.lnk'
ClassName: '' WindowName: '<Имя файла>.exe'