Trojan.Encoder.35782

Техническая информация

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx

Изменения в файловой системе

Создает следующие файлы

C:\$recycle.bin\get_your_files_back.txt
%HOMEPATH%\saved games\get_your_files_back.txt
%HOMEPATH%\searches\get_your_files_back.txt
%HOMEPATH%\sendto\get_your_files_back.txt
%HOMEPATH%\start menu\get_your_files_back.txt
%HOMEPATH%\templates\get_your_files_back.txt
%HOMEPATH%\videos\get_your_files_back.txt
%HOMEPATH%\voip\get_your_files_back.txt
%HOMEPATH%\favorites\links\get_your_files_back.txt
%HOMEPATH%\favorites\links for united states\get_your_files_back.txt
%HOMEPATH%\favorites\microsoft websites\get_your_files_back.txt
%HOMEPATH%\printhood\get_your_files_back.txt
%HOMEPATH%\recent\get_your_files_back.txt
%HOMEPATH%\favorites\msn websites\get_your_files_back.txt
%HOMEPATH%\documents\my pictures\get_your_files_back.txt
%HOMEPATH%\documents\my videos\get_your_files_back.txt
C:\users\public\desktop\get_your_files_back.txt
C:\users\public\documents\get_your_files_back.txt
C:\users\public\downloads\get_your_files_back.txt
C:\users\public\favorites\get_your_files_back.txt
C:\users\public\libraries\get_your_files_back.txt
C:\users\public\music\get_your_files_back.txt
C:\users\public\pictures\get_your_files_back.txt
C:\users\public\recorded tv\get_your_files_back.txt
%HOMEPATH%\favorites\windows live\get_your_files_back.txt
%HOMEPATH%\documents\my music\get_your_files_back.txt
%HOMEPATH%\pictures\get_your_files_back.txt
%HOMEPATH%\nethood\get_your_files_back.txt
%HOMEPATH%\my documents\get_your_files_back.txt
D:\$recycle.bin\get_your_files_back.txt
C:\far2\get_your_files_back.txt
C:\msocache\get_your_files_back.txt
C:\perflogs\get_your_files_back.txt
C:\recovery\get_your_files_back.txt
C:\totalcmd\get_your_files_back.txt
C:\users\get_your_files_back.txt
<Текущая директория>\get_your_files_back.txt
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\get_your_files_back.txt
%ALLUSERSPROFILE%\get_your_files_back.txt
C:\users\default\get_your_files_back.txt
C:\documents and settings\get_your_files_back.txt
C:\users\default user\get_your_files_back.txt
%HOMEPATH%\get_your_files_back.txt
%HOMEPATH%\application data\get_your_files_back.txt
%HOMEPATH%\contacts\get_your_files_back.txt
%HOMEPATH%\cookies\get_your_files_back.txt
%HOMEPATH%\desktop\get_your_files_back.txt
%HOMEPATH%\documents\get_your_files_back.txt
%HOMEPATH%\downloads\get_your_files_back.txt
%HOMEPATH%\favorites\get_your_files_back.txt
%HOMEPATH%\links\get_your_files_back.txt
%HOMEPATH%\local settings\get_your_files_back.txt
%HOMEPATH%\music\get_your_files_back.txt
C:\users\public\get_your_files_back.txt
C:\users\public\videos\get_your_files_back.txt
C:\users\public\videos\sample videos\get_your_files_back.txt