Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'empty'
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Диспетчера задач (Taskmgr)
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\wp.bmp
- %LOCALAPPDATA%\google\chrome\user data\default\web applications\_crx_aohghmighlieiainnegkcijnfilokake\документы google.ico
Перемещает следующие файлы
- %LOCALAPPDATA%\google\chrome\user data\default\web applications\_crx_aohghmighlieiainnegkcijnfilokake\документы google.ico в %LOCALAPPDATA%\google\chrome\user data\default\web applications\_crx_aohghmighlieiainnegkcijnfilokake\документы google.ico.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\dotnetfxsdk.log в %TEMP%\dotnetfxsdk.log.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %APPDATA%\adobe\acrobat\dc\tmdocs.sav в %APPDATA%\adobe\acrobat\dc\tmdocs.sav.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %APPDATA%\adobe\acrobat\dc\tmgrpprm.sav в %APPDATA%\adobe\acrobat\dc\tmgrpprm.sav.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %APPDATA%\icqm\icq\database\citylist_en.csv в %APPDATA%\icqm\icq\database\citylist_en.csv.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %APPDATA%\icqm\icq\database\citylist_kz.csv в %APPDATA%\icqm\icq\database\citylist_kz.csv.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %APPDATA%\icqm\icq\database\citylist_ru.csv в %APPDATA%\icqm\icq\database\citylist_ru.csv.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %APPDATA%\icqm\icq\database\citylist_tr.csv в %APPDATA%\icqm\icq\database\citylist_tr.csv.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %APPDATA%\icqm\icq\database\citylist_ua.csv в %APPDATA%\icqm\icq\database\citylist_ua.csv.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif в %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif в %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif в %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif в %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif в %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif в %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif в %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif в %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif в %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif в %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\dotnetfx.log в %TEMP%\dotnetfx.log.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %APPDATA%\icqm\icq\database\citylist_uz.csv в %APPDATA%\icqm\icq\database\citylist_uz.csv.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\dd_wcf_ca_smci_20200611_031101_060.txt в %TEMP%\dd_wcf_ca_smci_20200611_031101_060.txt.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt в %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\adobearm.log в %TEMP%\adobearm.log.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\adobearm_notlocked.log в %TEMP%\adobearm_notlocked.log.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\adobesfx.log в %TEMP%\adobesfx.log.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\aspnetsetup.log в %TEMP%\aspnetsetup.log.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\aspnetsetup_00000.log в %TEMP%\aspnetsetup_00000.log.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\aspnetsetup_00001.log в %TEMP%\aspnetsetup_00001.log.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\aspnetsetup_00002.log в %TEMP%\aspnetsetup_00002.log.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\aspnetsetup_00003.log в %TEMP%\aspnetsetup_00003.log.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\dd_ndp471-kb4033342-x86-x64-allos-enu_decompression_log.txt в %TEMP%\dd_ndp471-kb4033342-x86-x64-allos-enu_decompression_log.txt.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\dd_wcf_ca_smci_20151217_052908_497.txt в %TEMP%\dd_wcf_ca_smci_20151217_052908_497.txt.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\dd_setuputility.txt в %TEMP%\dd_setuputility.txt.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\dd_vcredist_amd64_20151216210341.log в %TEMP%\dd_vcredist_amd64_20151216210341.log.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\dd_vcredist_amd64_20151216210341_000_vcruntimeminimum_x64.log в %TEMP%\dd_vcredist_amd64_20151216210341_000_vcruntimeminimum_x64.log.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\dd_vcredist_amd64_20151216210341_001_vcruntimeadditional_x64.log в %TEMP%\dd_vcredist_amd64_20151216210341_001_vcruntimeadditional_x64.log.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\dd_vcredist_x86_20151216210157.log в %TEMP%\dd_vcredist_x86_20151216210157.log.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\dd_vcredist_x86_20151216210157_000_vcruntimeminimum_x86.log в %TEMP%\dd_vcredist_x86_20151216210157_000_vcruntimeminimum_x86.log.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\dd_vcredist_x86_20151216210157_001_vcruntimeadditional_x86.log в %TEMP%\dd_vcredist_x86_20151216210157_001_vcruntimeadditional_x86.log.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\dd_wcf_ca_smci_20151217_052858_840.txt в %TEMP%\dd_wcf_ca_smci_20151217_052858_840.txt.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %TEMP%\dd_wcf_ca_smci_20200611_031056_919.txt в %TEMP%\dd_wcf_ca_smci_20200611_031056_919.txt.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
- %APPDATA%\icqm\icq\smiles\skin.txt в %APPDATA%\icqm\icq\smiles\skin.txt.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0
Изменяет следующие файлы
- %ALLUSERSPROFILE%\microsoft\ilscache\ilrcache.xml
- C:\users\public\pictures\sample pictures\tulips.jpg
- C:\users\public\pictures\sample pictures\penguins.jpg
- C:\users\public\pictures\sample pictures\lighthouse.jpg
- C:\users\public\pictures\sample pictures\koala.jpg
- C:\users\public\pictures\sample pictures\jellyfish.jpg
- C:\users\public\pictures\sample pictures\hydrangeas.jpg
- C:\users\public\pictures\sample pictures\desert.jpg
- C:\users\public\pictures\sample pictures\chrysanthemum.jpg
- %ALLUSERSPROFILE%\sun\java\java update\jaureglist.xml
- %ALLUSERSPROFILE%\mozilla\logs\maintenanceservice-uninstall.log
- %ALLUSERSPROFILE%\mozilla\logs\maintenanceservice-install.log
- %ALLUSERSPROFILE%\microsoft toolkit\settings.xml
- %ALLUSERSPROFILE%\microsoft\user account pictures\user.dat
- %ALLUSERSPROFILE%\microsoft\user account pictures\user.bmp
- %ALLUSERSPROFILE%\microsoft\user account pictures\guest.bmp
- %ALLUSERSPROFILE%\microsoft\rac\statedata\racwmieventdata.dat
- %ALLUSERSPROFILE%\microsoft\rac\statedata\racwmidatabookmarks.dat
- %ALLUSERSPROFILE%\microsoft\rac\statedata\racmetadata.dat
- %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\cache\cache.dat
- %ALLUSERSPROFILE%\microsoft\officesoftwareprotectionplatform\tokens.dat
- %ALLUSERSPROFILE%\microsoft\office\sharepointteamsite.ico
- %ALLUSERSPROFILE%\microsoft\office\sharepointportalsite.ico
- %ALLUSERSPROFILE%\microsoft\office\mysite.ico
- %ALLUSERSPROFILE%\microsoft\office\mysharepoints.ico
- %ALLUSERSPROFILE%\microsoft\office\documentrepository.ico
- %ALLUSERSPROFILE%\microsoft\office\assetlibrary.ico
- %ALLUSERSPROFILE%\microsoft\ilscache\imcrcache.xml
- %LOCALAPPDATA%\google\chrome\user data\chrome_shutdown_ms.txt
- %LOCALAPPDATA%\google\chrome\user data\default\google profile.ico
Изменяет множество файлов.
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Другое
Создает и запускает на исполнение
- '<SYSTEM32>\cmd.exe' /k takeown /f <SYSTEM32> && icacls <SYSTEM32> /grant %username%:F && takeown /f <DRIVERS> && icacls <DRIVERS> /grant %username%:F && takeown /f <SYSTEM32>\LogonUI.exe && icacls <SYSTEM32>\Logon...' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /k takeown /f <SYSTEM32> && icacls <SYSTEM32> /grant %username%:F && takeown /f <DRIVERS> && icacls <DRIVERS> /grant %username%:F && takeown /f <SYSTEM32>\LogonUI.exe && icacls <SYSTEM32>\Logon...
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>
- '<SYSTEM32>\icacls.exe' <SYSTEM32> /grant user:F
- '<SYSTEM32>\takeown.exe' /f <DRIVERS>
- '<SYSTEM32>\icacls.exe' <DRIVERS> /grant user:F
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>\LogonUI.exe
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\LogonUI.exe /grant user:F
- '<SYSTEM32>\takeown.exe' /f C:\bootmgr
