Trojan.Encoder.32387

Техническая информация

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\toolbar.bmp
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\weeklysheet1215.doc

Изменения в файловой системе

Создает следующие файлы

%LOCALAPPDATA%\google\chrome\user data\default\web applications\_crx_aohghmighlieiainnegkcijnfilokake\документы google.ico

Перемещает следующие файлы

%LOCALAPPDATA%\google\chrome\user data\default\web applications\_crx_aohghmighlieiainnegkcijnfilokake\документы google.ico в %LOCALAPPDATA%\google\chrome\user data\default\web applications\_crx_aohghmighlieiainnegkcijnfilokake\документы google.icochaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\javadeployreg.log в %TEMP%\javadeployreg.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\jusched.log в %TEMP%\jusched.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\msi1cfbe.log в %TEMP%\msi1cfbe.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\msic204f.log в %TEMP%\msic204f.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\msid38c.log в %TEMP%\msid38c.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\msie45bf.log в %TEMP%\msie45bf.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\msieb217.log в %TEMP%\msieb217.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\opera_crashreporter.log в %TEMP%\opera_crashreporter.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\dotnetfx.log в %TEMP%\dotnetfx.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\dotnetfxsdk.log в %TEMP%\dotnetfxsdk.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\setupexe(20151124155624744).log в %TEMP%\setupexe(20151124155624744).logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\wmsetup.log в %TEMP%\wmsetup.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\adobe_admlogs\adobe_adm.log в %TEMP%\adobe_admlogs\adobe_adm.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\adobe_admlogs\adobe_gde.log в %TEMP%\adobe_admlogs\adobe_gde.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\opera installer\opera_installer_20150506170826.log в %TEMP%\opera installer\opera_installer_20150506170826.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\opera installer\opera_installer_20150506170843.log в %TEMP%\opera installer\opera_installer_20150506170843.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\opera installer\opera_installer_20150506170857.log в %TEMP%\opera installer\opera_installer_20150506170857.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\webinstaller\qnzuposrqouvfisa\variant.js в %TEMP%\webinstaller\qnzuposrqouvfisa\variant.jschaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\webinstaller\qnzuposrqouvfisa\data.txt в %TEMP%\webinstaller\qnzuposrqouvfisa\data.txtchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\setupexe(201603101200226dc).log в %TEMP%\setupexe(201603101200226dc).logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\setupexe(20160310140634718).log в %TEMP%\setupexe(20160310140634718).logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\dd_vcredist_x86_20151216210157_001_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20151216210157_001_vcruntimeadditional_x86.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\dd_vcredist_x86_20151216210157_000_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20151216210157_000_vcruntimeminimum_x86.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\dd_vcredist_x86_20151216210157.log в %TEMP%\dd_vcredist_x86_20151216210157.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\jawshtml.html в %TEMP%\jawshtml.htmlchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20150506_155226438.html в %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20150506_155226438.htmlchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\microsoft .net framework 4.5 setup_20150506_155317844.html в %TEMP%\microsoft .net framework 4.5 setup_20150506_155317844.htmlchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\microsoft .net framework 4.5.2 setup_20151216_212237215.html в %TEMP%\microsoft .net framework 4.5.2 setup_20151216_212237215.htmlchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\user.bmp в %TEMP%\user.bmpchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\wallpaper.bmp в %TEMP%\wallpaper.bmpchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt в %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txtchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\dd_setuputility.txt в %TEMP%\dd_setuputility.txtchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\dd_wcf_ca_smci_20151217_052858_840.txt в %TEMP%\dd_wcf_ca_smci_20151217_052858_840.txtchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\mirc741.exe в %TEMP%\mirc741.exechaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\dd_wcf_ca_smci_20151217_052908_497.txt в %TEMP%\dd_wcf_ca_smci_20151217_052908_497.txtchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\adobearm.log в %TEMP%\adobearm.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\adobearm_notlocked.log в %TEMP%\adobearm_notlocked.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\adobesfx.log в %TEMP%\adobesfx.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\aspnetsetup.log в %TEMP%\aspnetsetup.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\aspnetsetup_00000.log в %TEMP%\aspnetsetup_00000.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\aspnetsetup_00001.log в %TEMP%\aspnetsetup_00001.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\dd_vcredist_amd64_20151216210341.log в %TEMP%\dd_vcredist_amd64_20151216210341.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\dd_vcredist_amd64_20151216210341_000_vcruntimeminimum_x64.log в %TEMP%\dd_vcredist_amd64_20151216210341_000_vcruntimeminimum_x64.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\dd_vcredist_amd64_20151216210341_001_vcruntimeadditional_x64.log в %TEMP%\dd_vcredist_amd64_20151216210341_001_vcruntimeadditional_x64.logchaos@gmail.com.3tp2pdrjuansgk1c
%TEMP%\microsoft .net framework 4.5.2 setup_20151216_212237215-msi_netfx_full_gdr_x64.msi.txt в %TEMP%\microsoft .net framework 4.5.2 setup_20151216_212237215-msi_netfx_full_gdr_x64.msi.txtchaos@gmail.com.3tp2pdrjuansgk1c
%APPDATA%\adobe\acrobat\dc\security\addressbook.acrodata в %APPDATA%\adobe\acrobat\dc\security\addressbook.acrodatachaos@gmail.com.3tp2pdrjuansgk1c
%APPDATA%\icqm\icq.exe в %APPDATA%\icqm\icq.exechaos@gmail.com.3tp2pdrjuansgk1c