Trojan.Encoder.34325

Техническая информация

Для обеспечения автозапуска и распространения

Создает следующие файлы на съемном носителе

<Имя диска съемного носителя>:\get_your_files_back.txt

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\about.htm
%HOMEPATH%\desktop\browse.htm
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\contosoroot_1.cer
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\tree_view.htm

Изменения в файловой системе

Создает следующие файлы

C:\get_your_files_back.txt
C:\far2\plugins\arclite\get_your_files_back.txt
C:\far2\plugins\autowrap\get_your_files_back.txt
C:\far2\plugins\brackets\get_your_files_back.txt
C:\far2\plugins\compare\get_your_files_back.txt
C:\far2\plugins\drawline\get_your_files_back.txt
C:\far2\plugins\editcase\get_your_files_back.txt
C:\far2\plugins\emenu\get_your_files_back.txt
C:\far2\pluginsdk\headers.c\get_your_files_back.txt
C:\far2\plugins\farcmds\get_your_files_back.txt
C:\far2\plugins\ftp\lib\get_your_files_back.txt
C:\far2\plugins\ftp\get_your_files_back.txt
C:\far2\plugins\hlfviewer\get_your_files_back.txt
C:\far2\plugins\macroview\get_your_files_back.txt
C:\far2\plugins\network\get_your_files_back.txt
C:\far2\plugins\proclist\get_your_files_back.txt
C:\far2\plugins\tmppanel\get_your_files_back.txt
C:\far2\plugins\filecase\get_your_files_back.txt
C:\far2\plugins\get_your_files_back.txt
C:\far2\plugins\align\get_your_files_back.txt
C:\far2\addons\shell\get_your_files_back.txt
D:\get_your_files_back.txt
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\get_your_files_back.txt
C:\$recycle.bin\get_your_files_back.txt
C:\far2\addons\colors\custom_highlighting\get_your_files_back.txt
C:\far2\addons\colors\default_highlighting\get_your_files_back.txt
C:\far2\addons\colors\get_your_files_back.txt
C:\far2\addons\macros\get_your_files_back.txt
C:\far2\encyclopedia\get_your_files_back.txt
C:\far2\fexcept\get_your_files_back.txt
C:\far2\addons\xlat\russian\get_your_files_back.txt
C:\far2\addons\xlat\get_your_files_back.txt
C:\far2\addons\get_your_files_back.txt
C:\far2\documentation\eng\get_your_files_back.txt
C:\far2\documentation\rus\get_your_files_back.txt
C:\far2\documentation\get_your_files_back.txt
C:\far2\encyclopedia\tap\get_your_files_back.txt
C:\far2\addons\setup\get_your_files_back.txt
C:\far2\pluginsdk\headers.pas\get_your_files_back.txt
C:\far2\pluginsdk\get_your_files_back.txt
C:\far2\get_your_files_back.txt
%HOMEPATH%\favorites\links\get_your_files_back.txt
%HOMEPATH%\favorites\links for united states\get_your_files_back.txt
%HOMEPATH%\favorites\microsoft websites\get_your_files_back.txt
%HOMEPATH%\favorites\msn websites\get_your_files_back.txt
%HOMEPATH%\favorites\windows live\get_your_files_back.txt
%HOMEPATH%\favorites\get_your_files_back.txt
%HOMEPATH%\documents\get_your_files_back.txt
%HOMEPATH%\links\get_your_files_back.txt
%HOMEPATH%\pictures\get_your_files_back.txt
%HOMEPATH%\saved games\get_your_files_back.txt
%HOMEPATH%\searches\get_your_files_back.txt
%HOMEPATH%\videos\get_your_files_back.txt
%HOMEPATH%\voip\get_your_files_back.txt
%HOMEPATH%\get_your_files_back.txt
C:\users\get_your_files_back.txt
%HOMEPATH%\music\get_your_files_back.txt
%HOMEPATH%\desktop\get_your_files_back.txt
%HOMEPATH%\downloads\get_your_files_back.txt
%HOMEPATH%\contacts\get_your_files_back.txt
C:\msocache\get_your_files_back.txt
C:\users\default\desktop\get_your_files_back.txt
C:\perflogs\admin\get_your_files_back.txt
C:\perflogs\get_your_files_back.txt
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\get_your_files_back.txt
C:\recovery\get_your_files_back.txt
<Текущая директория>\get_your_files_back.txt
C:\totalcmd\language\get_your_files_back.txt
C:\totalcmd\get_your_files_back.txt
C:\users\default\documents\get_your_files_back.txt
C:\users\default\get_your_files_back.txt
C:\users\default\downloads\get_your_files_back.txt
C:\users\default\favorites\get_your_files_back.txt
C:\users\default\links\get_your_files_back.txt
C:\users\default\music\get_your_files_back.txt
C:\users\default\pictures\get_your_files_back.txt
C:\users\default\saved games\get_your_files_back.txt
C:\users\default\videos\get_your_files_back.txt
D:\$recycle.bin\get_your_files_back.txt
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\get_your_files_back.txt