Trojan.Encoder.35660

Техническая информация

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\168.jpeg
%HOMEPATH%\desktop\toolbar.bmp
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\coffee.bmp
%HOMEPATH%\desktop\browse.htm
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\adadsi.html
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\4f0bf7ff71f28.jpeg
%HOMEPATH%\desktop\210252809.jpeg
%HOMEPATH%\desktop\tree_view.htm
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc

Изменения в файловой системе

Создает следующие файлы

C:\users\public\pictures\sample pictures\chrysanthemum.jpg.vanitas
%LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cookie\cookies-journal.vanitas
%LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cookie\cookies.vanitas
%LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\index.vanitas
%LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\data_3.vanitas
%LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\data_2.vanitas
%LOCALAPPDATA%\adobe\color\profiles\wscrgb.icc.vanitas
%LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\data_1.vanitas
%LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\chromedwritefontcache.vanitas
%LOCALAPPDATA%\adobe\acrobat\dc\cache\acrofnt15.lst.vanitas
%LOCALAPPDATA%\adobe\acrobat\dc\usercache.bin.vanitas
%LOCALAPPDATA%\adobe\acrobat\dc\shareddataevents.vanitas
%LOCALAPPDATA%\adobe\acrobat\dc\adobesysfnt15.lst.vanitas
%LOCALAPPDATA%\adobe\acrobat\dc\adobecmapfnt15.lst.vanitas
%LOCALAPPDATA%\adobe\acrocef\dc\acrobat\cache\data_0.vanitas
%HOMEPATH%\downloads\icq_rfrset.exe.vanitas
%LOCALAPPDATA%\adobe\color\profiles\wsrgb.icc.vanitas
%LOCALAPPDATA%\google\chrome\user data\safe browsing uws list.vanitas
%LOCALAPPDATA%\google\chrome\user data\safe browsing ip blacklist.vanitas
%LOCALAPPDATA%\google\chrome\user data\safe browsing inclusion whitelist.vanitas
%LOCALAPPDATA%\google\chrome\user data\safe browsing extension blacklist.vanitas
%LOCALAPPDATA%\google\chrome\user data\safe browsing download whitelist.vanitas
%LOCALAPPDATA%\google\chrome\user data\safe browsing download.vanitas
%HOMEPATH%\downloads\winamp5666_full_all.exe.vanitas
%LOCALAPPDATA%\adobe\color\acecache11.lst.vanitas
%LOCALAPPDATA%\google\chrome\user data\safe browsing cookies.vanitas
%LOCALAPPDATA%\google\chrome\user data\safe browsing bloom prefix set.vanitas
%LOCALAPPDATA%\google\chrome\user data\safe browsing bloom.vanitas
%LOCALAPPDATA%\google\chrome\user data\local state.vanitas
%LOCALAPPDATA%\google\chrome\user data\first run.vanitas
%LOCALAPPDATA%\google\chrome\user data\chrome_shutdown_ms.txt.vanitas
%LOCALAPPDATA%\google\chrome\user data\safe browsing cookies-journal.vanitas
%LOCALAPPDATA%\applicationhistory\ngen.exe.2c05686e.ini.vanitas
%HOMEPATH%\downloads\thunderbird setup 31.6.0.exe.vanitas
%HOMEPATH%\downloads\tcmd851ax64.exe.vanitas
%HOMEPATH%\downloads\steamsetup.exe.vanitas
C:\users\public\pictures\sample pictures\tulips.jpg.vanitas
C:\users\public\pictures\sample pictures\desert.jpg.vanitas
C:\users\public\pictures\sample pictures\hydrangeas.jpg.vanitas
C:\users\public\pictures\sample pictures\jellyfish.jpg.vanitas
C:\users\public\pictures\sample pictures\koala.jpg.vanitas
C:\users\public\pictures\sample pictures\lighthouse.jpg.vanitas
%LOCALAPPDATA%\google\chrome\user data\safe browsing uws list prefix set.vanitas
C:\users\public\pictures\sample pictures\penguins.jpg.vanitas
C:\users\public\music\sample music\sleep away.mp3.vanitas
C:\users\public\music\sample music\albumartsmall.jpg.vanitas
C:\users\public\music\sample music\albumart_{5fa05d35-a682-4af6-96f7-0773e42d4d16}_large.jpg.vanitas
C:\users\public\music\sample music\albumart_{5fa05d35-a682-4af6-96f7-0773e42d4d16}_small.jpg.vanitas
C:\users\public\music\sample music\folder.jpg.vanitas
C:\users\public\music\sample music\kalimba.mp3.vanitas
C:\users\public\videos\sample videos\wildlife.wmv.vanitas
%LOCALAPPDATA%\google\chrome\user data\safe browsing csd whitelist.vanitas
%HOMEPATH%\desktop\168.jpeg.vanitas
%HOMEPATH%\desktop\508softwareandos.doc.vanitas
%HOMEPATH%\desktop\210252809.jpeg.vanitas
%HOMEPATH%\downloads\pidgin-2.10.11.exe.vanitas
%HOMEPATH%\downloads\opera_ni_stable.exe.vanitas
%HOMEPATH%\downloads\mirc741.exe.vanitas
%HOMEPATH%\downloads\magent_rfrset.exe.vanitas
%HOMEPATH%\downloads\k-lite_codec_pack_1110_mega_dlm.exe.vanitas
%HOMEPATH%\desktop\4f0bf7ff71f28.jpeg.vanitas
%HOMEPATH%\downloads\k-lite_codec_pack_1110_mega.exe.vanitas
C:\users\public\music\sample music\maid with the flaxen hair.mp3.vanitas
%HOMEPATH%\downloads\chromesetup.exe.vanitas
%HOMEPATH%\desktop\jre-7u75-windows-i586-iftw.exe.vanitas
%HOMEPATH%\desktop\dotnetfx45_full_setup.exe.vanitas
%HOMEPATH%\desktop\chromesetup.exe.vanitas
%HOMEPATH%\desktop\calc.exe.vanitas
%HOMEPATH%\downloads\jre-8u45-windows-x64.exe.vanitas
%LOCALAPPDATA%\google\chrome\user data\default\chromedwritefontcache.vanitas