Trojan.Encoder.37826

Техническая информация

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\sdszfo.docx

Изменения в файловой системе

Создает следующие файлы

%TEMP%\_mei6802\crypto.cipher._aes.pyd
%TEMP%\bde218d454bde84dd9a616540ea48a.encrypted
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\2c981fce502baffe993350cfbc2bfb.encrypted
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\6a3d8d23afa4fdc1c7866be5396988.encrypted
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\f659997ea6836055bd74f84813530a.encrypted
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\9261e13101f1abcd402a8cf3388270.encrypted
%APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\25bb538a39b6b8d209212bfbb02a6d.encrypted
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\55357f97c00ca273569950e2132839.encrypted
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\84e8cd1682c972f9a3922321e0b78d.encrypted
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\611552ad9d2213061242611a70a429.encrypted
%TEMP%\91f53e0e6e8d9bb404cdccd0888333.encrypted
%TEMP%\79326a7946b02b9ceb382581c4c917.encrypted
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\cd0b5b13292edc86c870376b6318ae.encrypted
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\906403dbbacd148eb434b1c880d1f0.encrypted
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\dec830fe44506642f8ff2a3edaba9d.encrypted
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\4ba3f15bb1af683d6df6f4efc7ac56.encrypted
%APPDATA%\thunderbird\profiles\npsdfqy3.default-release\99835ccd860e4af9b4c134a6436cdf.encrypted
%HOMEPATH%\desktop\b694d65365b272b6e97971e0ce1bad.encrypted
%HOMEPATH%\desktop\1f4889e8600b019535b9ba79345c22.encrypted
%HOMEPATH%\desktop\eb42b367307781d6ec9835abe56026.encrypted
%HOMEPATH%\desktop\1543321251fbd239023c554935ec70.encrypted
<Текущая директория>\encrypted.txt
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\e36e8db36fae224a9ac8e93d792fc1.encrypted
%APPDATA%\mozilla\firefox\profiles\yfwt7ezn.default-release-1\gmp-widevinecdm\4.10.1582.2\ebedcea59abc9b15a520903e4a420b.encrypted
%TEMP%\88b6cae6e2f0cba4dd11411ee14d12.encrypted
%TEMP%\d318c3e4bd8c37f9e29066a02e131c.encrypted
%TEMP%\fcd1a44daab0cfe1208f9d087df0fb.encrypted
%TEMP%\_mei6802\crypto.random.osrng.winrandom.pyd
%TEMP%\_mei6802\crypto.util._counter.pyd
%TEMP%\_mei6802\microsoft.vc90.crt.manifest
%TEMP%\_mei6802\_ctypes.pyd
%TEMP%\_mei6802\_hashlib.pyd
%TEMP%\_mei6802\bz2.pyd
%TEMP%\_mei6802\msvcm90.dll
%TEMP%\_mei6802\msvcp90.dll
%TEMP%\_mei6802\msvcr90.dll
%TEMP%\_mei6802\python27.dll
%TEMP%\_mei6802\crypto.hash._sha256.pyd
%TEMP%\_mei6802\ransomware.exe.manifest
%TEMP%\_mei6802\unicodedata.pyd
%TEMP%\_mei6802\image.jpg\image.jpg
%LOCALAPPDATA%\microsoft\internet explorer\7bef23e7c43521689b9195b66ca5cd.encrypted
%TEMP%\23365040f4dc091d6051fbd6a8fdd4.encrypted
%TEMP%\d5115a601a3591c76c10179171cd07.encrypted
%TEMP%\1f45c4f7a6c38cbb29dc2c58738972.encrypted
%TEMP%\7ef0d4017d9c6f41c97728b21030f8.encrypted
%TEMP%\ff321576b33f692f033c540b0c12ff.encrypted
%TEMP%\50dc8bccd277d5e731417bd421b3b5.encrypted
%TEMP%\6d090eac0b4bfb61024c47f19445a7.encrypted
%TEMP%\_mei6802\select.pyd
<Текущая директория>\read_me_to_decrypt.txt
<Текущая директория>\to_decrypt.py