Trojan.Encoder.32760

Техническая информация

Вредоносные функции

Завершает или пытается завершить

следующие системные процессы:

%WINDIR%\explorer.exe

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\weeklysheet1215.doc

Изменения в файловой системе

Создает следующие файлы

C:\far2\documentation\eng\arc_support.txt.nibiru
%APPDATA%\icqm\icq\sounds\start.wav.nibiru
%APPDATA%\icqm\icq\sounds\ring.mp3.nibiru
%APPDATA%\icqm\icq\sounds\otprav.wav.nibiru
%APPDATA%\icqm\icq\sounds\otprav.mp3.nibiru
%APPDATA%\icqm\icq\sounds\no_answer.wav.nibiru
%APPDATA%\icqm\icq\sounds\message.mp3.nibiru
%APPDATA%\icqm\icq\sounds\letter.wav.nibiru
%APPDATA%\icqm\icq\sounds\error.wav.nibiru
%APPDATA%\icqm\icq\sounds\conference.mp3.nibiru
%APPDATA%\telegram desktop\log.txt.nibiru
%APPDATA%\icqm\icq\sounds\call_in.wav.nibiru
%APPDATA%\icqm\icq\sounds\auth.mp3.nibiru
%APPDATA%\icqm\icq\smiles\skin.txt.nibiru
%TEMP%\webinstaller\qnzuposrqouvfisa\data.txt.nibiru
%LOCALAPPDATA%\google\chrome\user data\chrome_shutdown_ms.txt.nibiru
%APPDATA%\opera software\opera stable\opera_shutdown_ms.txt.nibiru
%APPDATA%\mra\update\ver.txt.nibiru
%APPDATA%\icq-profile\update\ver.txt.nibiru
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.nibiru
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5c82.tmp.appcompat.txt.nibiru
%APPDATA%\icqm\icq\sounds\busy.mp3.nibiru
%APPDATA%\winamp\demo.mp3.nibiru
%APPDATA%\icqm\icq\sounds\test_sound.wav.nibiru
%APPDATA%\microsoft\windows\cookies\user@demdex[2].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@www.msn[3].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@www.msn[2].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@www.bing[1].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@sportiv[2].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@scorecardresearch[3].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@scorecardresearch[2].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@onlinestores.metaservices.microsoft[1].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@msn[2].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@msn[1].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@246059135.log.optimizely[1].txt.nibiru
%APPDATA%\icqm\icq\sounds\voiceend.wav.nibiru
%APPDATA%\microsoft\windows\cookies\user@c.msn[2].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@c.msn[1].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@c.bing[2].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@c.bing[1].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@bing[2].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@bing[1].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@adobe[3].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@adobe[1].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@adnxs[1].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@mozilla[2].txt.nibiru
%TEMP%\microsoft .net framework 4.7.1 setup_20200610_200621826-msi_netfx_full_x64.msi.txt.nibiru
%TEMP%\microsoft .net framework 4.5.2 setup_20151216_212237215-msi_netfx_full_gdr_x64.msi.txt.nibiru
%TEMP%\dd_wcf_ca_smci_20200611_031101_060.txt.nibiru
%HOMEPATH%\desktop\cveuropeo.doc.nibiru
%HOMEPATH%\desktop\correct.avi.nibiru
%HOMEPATH%\desktop\archer.avi.nibiru
%HOMEPATH%\desktop\508softwareandos.doc.nibiru
C:\far2\plugins\ftp\notes_rus.txt.nibiru
C:\far2\plugins\ftp\notes.txt.nibiru
C:\far2\plugins\ftp\ftpcmds_rus.txt.nibiru
C:\far2\plugins\ftp\ftpcmds.txt.nibiru
%HOMEPATH%\desktop\issi2013_template_for_posters.docx.nibiru
C:\far2\documentation\rus\techinfo.txt.nibiru
C:\far2\documentation\rus\plugins_install.txt.nibiru
C:\far2\documentation\rus\far_faq.txt.nibiru
C:\far2\documentation\rus\bug_report.txt.nibiru
C:\far2\documentation\rus\arc_support.txt.nibiru
C:\far2\documentation\eng\techinfo.txt.nibiru
C:\far2\documentation\eng\plugins_review.txt.nibiru
C:\far2\documentation\eng\plugins_install.txt.nibiru
C:\far2\documentation\eng\far_faq.txt.nibiru
C:\far2\documentation\eng\bug_report.txt.nibiru
C:\far2\documentation\rus\plugins_review.txt.nibiru
%HOMEPATH%\desktop\join.avi.nibiru
%HOMEPATH%\desktop\delete.avi.nibiru
%HOMEPATH%\desktop\nwfieldnotes1966.docx.nibiru
%TEMP%\dd_wcf_ca_smci_20200611_031056_919.txt.nibiru
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 09.wma.nibiru
%TEMP%\dd_wcf_ca_smci_20151217_052908_497.txt.nibiru
%TEMP%\dd_wcf_ca_smci_20151217_052858_840.txt.nibiru
%TEMP%\dd_setuputility.txt.nibiru
%TEMP%\dd_ndp471-kb4033342-x86-x64-allos-enu_decompression_log.txt.nibiru
%TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt.nibiru
C:\users\public\music\sample music\sleep away.mp3.nibiru
C:\users\public\music\sample music\maid with the flaxen hair.mp3.nibiru
C:\users\public\music\sample music\kalimba.mp3.nibiru
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 10.wma.nibiru
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 08.wma.nibiru
%HOMEPATH%\desktop\sdszfo.docx.nibiru
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 07.wma.nibiru
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 06.wma.nibiru
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 05.wma.nibiru
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 04.wma.nibiru
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 03.wma.nibiru
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 02.wma.nibiru
%ALLUSERSPROFILE%\microsoft\windows\ringtones\ringtone 01.wma.nibiru
%HOMEPATH%\desktop\weeklysheet1215.doc.nibiru
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx.nibiru
%APPDATA%\microsoft\windows\cookies\user@yandex[1].txt.nibiru
%APPDATA%\microsoft\windows\cookies\user@yandex[2].txt.nibiru