Техническая информация
Вредоносные функции
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ituneshelpunavailable.html
- %HOMEPATH%\desktop\iisstart.html
- %HOMEPATH%\desktop\iisstart.htm
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\tree_view.htm
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\e30e.tmp\e30f.tmp\e310.bat
- %HOMEPATH%\saved games\dotnetzip-jdy3hx4u.tmp
- %HOMEPATH%\searches\dotnetzip-11dyu403.tmp
- %HOMEPATH%\searches\dotnetzip-lxrns0b0.tmp
- %HOMEPATH%\searches\dotnetzip-p0elyqzj.tmp
- %HOMEPATH%\videos\dotnetzip-erbczucf.tmp
- %HOMEPATH%\desktop\dotnetzip-dv3olkhi.tmp
- %HOMEPATH%\desktop\dotnetzip-phh4chgr.tmp
- %HOMEPATH%\desktop\dotnetzip-tguzgpuw.tmp
- %HOMEPATH%\desktop\dotnetzip-b1wjsbsm.tmp
- %HOMEPATH%\desktop\dotnetzip-gzj5zakw.tmp
- %HOMEPATH%\desktop\dotnetzip-sz2dwrnu.tmp
- %HOMEPATH%\desktop\dotnetzip-tkenr0hf.tmp
- %HOMEPATH%\desktop\dotnetzip-m503dpuf.tmp
- %HOMEPATH%\desktop\dotnetzip-nxg1rdks.tmp
- %HOMEPATH%\desktop\dotnetzip-ezrzpp4u.tmp
- %HOMEPATH%\desktop\dotnetzip-b3xtcoai.tmp
- %HOMEPATH%\desktop\dotnetzip-ucqabhgq.tmp
- %HOMEPATH%\desktop\dotnetzip-z2t5vui1.tmp
- %HOMEPATH%\desktop\dotnetzip-qtccb12p.tmp
- %HOMEPATH%\desktop\dotnetzip-arqyvops.tmp
- %HOMEPATH%\desktop\dotnetzip-hz2zzvur.tmp
- %HOMEPATH%\desktop\dotnetzip-0mepqiou.tmp
- %HOMEPATH%\desktop\dotnetzip-tfq5zudk.tmp
- %HOMEPATH%\desktop\dotnetzip-xw01e5jk.tmp
- %HOMEPATH%\desktop\dotnetzip-yincypnx.tmp
- %HOMEPATH%\desktop\dotnetzip-jqzrytr0.tmp
- %HOMEPATH%\desktop\dotnetzip-goencotq.tmp
- %HOMEPATH%\desktop\dotnetzip-ramuu2i2.tmp
- %HOMEPATH%\pictures\dotnetzip-ixhrj3ci.tmp
- %HOMEPATH%\desktop\dotnetzip-xifvxrlq.tmp
- %HOMEPATH%\music\dotnetzip-furqgkr3.tmp
- %HOMEPATH%\favorites\microsoft websites\dotnetzip-tkkxnor5.tmp
- <Текущая директория>\dotnetzip.dll
- <Текущая директория>\enmegacoder.exe
- %HOMEPATH%\contacts\dotnetzip-uxd5ighp.tmp
- %HOMEPATH%\contacts\dotnetzip-jnpigzsi.tmp
- %HOMEPATH%\downloads\dotnetzip-1sjlagba.tmp
- %HOMEPATH%\favorites\dotnetzip-jowzpigr.tmp
- %HOMEPATH%\favorites\links\dotnetzip-whrtrjkp.tmp
- %HOMEPATH%\favorites\links\dotnetzip-sacahnhg.tmp
- %HOMEPATH%\favorites\links for united states\dotnetzip-3hy3f5t2.tmp
- %HOMEPATH%\favorites\links for united states\dotnetzip-mafpaft1.tmp
- %HOMEPATH%\favorites\links for united states\dotnetzip-tfxmdbz0.tmp
- %HOMEPATH%\favorites\microsoft websites\dotnetzip-ytctdyx4.tmp
- %HOMEPATH%\favorites\microsoft websites\dotnetzip-h4m4pdpd.tmp
- %HOMEPATH%\favorites\microsoft websites\dotnetzip-4cfj3u44.tmp
- %HOMEPATH%\links\dotnetzip-ri3b3ayf.tmp
- %HOMEPATH%\favorites\microsoft websites\dotnetzip-3c3lkyzv.tmp
- %HOMEPATH%\favorites\msn websites\dotnetzip-qsaxxhfv.tmp
- %HOMEPATH%\favorites\msn websites\dotnetzip-thi3ihtz.tmp
- %HOMEPATH%\favorites\msn websites\dotnetzip-gvgagxcn.tmp
- %HOMEPATH%\favorites\msn websites\dotnetzip-vd0sff1c.tmp
- %HOMEPATH%\favorites\msn websites\dotnetzip-13cnpbj2.tmp
- %HOMEPATH%\favorites\msn websites\dotnetzip-eazemn3h.tmp
- %HOMEPATH%\favorites\windows live\dotnetzip-ncak0nfc.tmp
- %HOMEPATH%\favorites\windows live\dotnetzip-j31j3ksl.tmp
- %HOMEPATH%\favorites\windows live\dotnetzip-tcj12wxm.tmp
- %HOMEPATH%\favorites\windows live\dotnetzip-tdyaxpzl.tmp
- %HOMEPATH%\links\dotnetzip-34y0jgqo.tmp
- %HOMEPATH%\links\dotnetzip-ba41np0j.tmp
- %HOMEPATH%\links\dotnetzip-gr2e5t2x.tmp
- %HOMEPATH%\desktop\readme.txt
Перемещает следующие файлы
- %HOMEPATH%\contacts\dotnetzip-uxd5ighp.tmp в %HOMEPATH%\contacts\desktop.ini.enmega
- %HOMEPATH%\links\dotnetzip-ri3b3ayf.tmp в %HOMEPATH%\links\downloads.lnk.enmega
- %HOMEPATH%\links\dotnetzip-gr2e5t2x.tmp в %HOMEPATH%\links\recentplaces.lnk.enmega
- %HOMEPATH%\music\dotnetzip-furqgkr3.tmp в %HOMEPATH%\music\desktop.ini.enmega
- %HOMEPATH%\pictures\dotnetzip-ixhrj3ci.tmp в %HOMEPATH%\pictures\desktop.ini.enmega
- %HOMEPATH%\saved games\dotnetzip-jdy3hx4u.tmp в %HOMEPATH%\saved games\desktop.ini.enmega
- %HOMEPATH%\searches\dotnetzip-11dyu403.tmp в %HOMEPATH%\searches\desktop.ini.enmega
- %HOMEPATH%\searches\dotnetzip-lxrns0b0.tmp в %HOMEPATH%\searches\everywhere.search-ms.enmega
- %HOMEPATH%\searches\dotnetzip-p0elyqzj.tmp в %HOMEPATH%\searches\indexed locations.search-ms.enmega
- %HOMEPATH%\favorites\microsoft websites\dotnetzip-tkkxnor5.tmp в %HOMEPATH%\favorites\microsoft websites\microsoft at home.url.enmega
- %HOMEPATH%\videos\dotnetzip-erbczucf.tmp в %HOMEPATH%\videos\desktop.ini.enmega
- %HOMEPATH%\desktop\dotnetzip-phh4chgr.tmp в %HOMEPATH%\desktop\archer.avi.enmega
- %HOMEPATH%\desktop\dotnetzip-tguzgpuw.tmp в %HOMEPATH%\desktop\browse.htm.enmega
- %HOMEPATH%\desktop\dotnetzip-b1wjsbsm.tmp в %HOMEPATH%\desktop\browse.html.enmega
- %HOMEPATH%\desktop\dotnetzip-gzj5zakw.tmp в %HOMEPATH%\desktop\delete.avi.enmega
- %HOMEPATH%\desktop\dotnetzip-sz2dwrnu.tmp в %HOMEPATH%\desktop\desktop.ini.enmega
- %HOMEPATH%\desktop\dotnetzip-m503dpuf.tmp в %HOMEPATH%\desktop\dotnetfx45_full_setup.exe.enmega
- %HOMEPATH%\desktop\dotnetzip-xifvxrlq.tmp в %HOMEPATH%\desktop\google chrome.lnk.enmega
- %HOMEPATH%\desktop\dotnetzip-arqyvops.tmp в %HOMEPATH%\desktop\jre-7u75-windows-i586-iftw.exe.enmega
- %HOMEPATH%\links\dotnetzip-34y0jgqo.tmp в %HOMEPATH%\links\desktop.ini.enmega
- %HOMEPATH%\links\dotnetzip-ba41np0j.tmp в %HOMEPATH%\links\desktop.lnk.enmega
- %HOMEPATH%\favorites\windows live\dotnetzip-tdyaxpzl.tmp в %HOMEPATH%\favorites\windows live\windows live spaces.url.enmega
- %HOMEPATH%\favorites\windows live\dotnetzip-tcj12wxm.tmp в %HOMEPATH%\favorites\windows live\windows live mail.url.enmega
- %HOMEPATH%\favorites\windows live\dotnetzip-j31j3ksl.tmp в %HOMEPATH%\favorites\windows live\windows live gallery.url.enmega
- %HOMEPATH%\downloads\dotnetzip-1sjlagba.tmp в %HOMEPATH%\downloads\desktop.ini.enmega
- %HOMEPATH%\favorites\dotnetzip-jowzpigr.tmp в %HOMEPATH%\favorites\desktop.ini.enmega
- %HOMEPATH%\favorites\links\dotnetzip-whrtrjkp.tmp в %HOMEPATH%\favorites\links\desktop.ini.enmega
- %HOMEPATH%\favorites\links\dotnetzip-sacahnhg.tmp в %HOMEPATH%\favorites\links\web slice gallery.url.enmega
- %HOMEPATH%\favorites\links for united states\dotnetzip-3hy3f5t2.tmp в %HOMEPATH%\favorites\links for united states\desktop.ini.enmega
- %HOMEPATH%\favorites\links for united states\dotnetzip-mafpaft1.tmp в %HOMEPATH%\favorites\links for united states\gobiernousa.gov.url.enmega
- %HOMEPATH%\favorites\links for united states\dotnetzip-tfxmdbz0.tmp в %HOMEPATH%\favorites\links for united states\usa.gov.url.enmega
- %HOMEPATH%\favorites\microsoft websites\dotnetzip-ytctdyx4.tmp в %HOMEPATH%\favorites\microsoft websites\ie add-on site.url.enmega
- %HOMEPATH%\desktop\dotnetzip-xw01e5jk.tmp в %HOMEPATH%\desktop\telegram.lnk.enmega
- %HOMEPATH%\desktop\dotnetzip-dv3olkhi.tmp в %HOMEPATH%\desktop\applicantform_en.doc.enmega
- %HOMEPATH%\favorites\microsoft websites\dotnetzip-h4m4pdpd.tmp в %HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url.enmega
- %HOMEPATH%\favorites\microsoft websites\dotnetzip-3c3lkyzv.tmp в %HOMEPATH%\favorites\microsoft websites\microsoft store.url.enmega
- %HOMEPATH%\favorites\msn websites\dotnetzip-qsaxxhfv.tmp в %HOMEPATH%\favorites\msn websites\msn autos.url.enmega
- %HOMEPATH%\favorites\msn websites\dotnetzip-thi3ihtz.tmp в %HOMEPATH%\favorites\msn websites\msn entertainment.url.enmega
- %HOMEPATH%\favorites\msn websites\dotnetzip-gvgagxcn.tmp в %HOMEPATH%\favorites\msn websites\msn money.url.enmega
- %HOMEPATH%\favorites\msn websites\dotnetzip-vd0sff1c.tmp в %HOMEPATH%\favorites\msn websites\msn sports.url.enmega
- %HOMEPATH%\favorites\msn websites\dotnetzip-13cnpbj2.tmp в %HOMEPATH%\favorites\msn websites\msn.url.enmega
- %HOMEPATH%\favorites\msn websites\dotnetzip-eazemn3h.tmp в %HOMEPATH%\favorites\msn websites\msnbc news.url.enmega
- %HOMEPATH%\favorites\windows live\dotnetzip-ncak0nfc.tmp в %HOMEPATH%\favorites\windows live\get windows live.url.enmega
- %HOMEPATH%\contacts\dotnetzip-jnpigzsi.tmp в %HOMEPATH%\contacts\user.contact.enmega
- %HOMEPATH%\favorites\microsoft websites\dotnetzip-4cfj3u44.tmp в %HOMEPATH%\favorites\microsoft websites\microsoft at work.url.enmega
- %HOMEPATH%\desktop\dotnetzip-ezrzpp4u.tmp в %HOMEPATH%\desktop\utorrent.exe.enmega
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Другое
Создает и запускает на исполнение
- '<Текущая директория>\enmegacoder.exe'
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\E30E.tmp\E30F.tmp\E310.bat <Полный путь к файлу>"' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\E30E.tmp\E30F.tmp\E310.bat <Полный путь к файлу>"
- '%WINDIR%\notepad.exe' %HOMEPATH%\Desktop\README.TXT
