Trojan.Encoder.38405

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Ransomware' = '<Полный путь к файлу>'

Изменения в файловой системе

Перемещает следующие файлы

%TEMP%\7f4987fb1a6e43d69e3e94b29eb75926\seed.txt в %TEMP%\7f4987fb1a6e43d69e3e94b29eb75926\seed.txt.@crypted
%TEMP%\pyl1.tmp\translations\ne\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\ne\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\nb\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\nb\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\my\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\my\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\mt\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\mt\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\ms\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\ms\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\mr\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\mr\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\mo\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\mo\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\ml\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\ml\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\mk\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\mk\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\lv\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\lv\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\lt\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\lt\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\ku\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\ku\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\ko\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\ko\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\fr\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\fr\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\kn\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\kn\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\kab\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\kab\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\ka\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\ka\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\jv\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\jv\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\ja\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\ja\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\it\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\it\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\is\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\is\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\id\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\id\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\hu\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\hu\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\hr\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\hr\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\hi\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\hi\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\he\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\he\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\gu\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\gu\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\gl\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\gl\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\kk\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\kk\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\fy\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\fy\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\nl\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\nl\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\th\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\th\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\winboot\wubildr.mbr в %TEMP%\pyl1.tmp\winboot\wubildr.mbr.@crypted
%TEMP%\pyl1.tmp\winboot\wubildr.cfg в %TEMP%\pyl1.tmp\winboot\wubildr.cfg.@crypted
%TEMP%\pyl1.tmp\winboot\wubildr-bootstrap.cfg в %TEMP%\pyl1.tmp\winboot\wubildr-bootstrap.cfg.@crypted
%TEMP%\pyl1.tmp\translations\zh_tw\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\zh_tw\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\zh_hk\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\zh_hk\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\zh_cn\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\zh_cn\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\wae\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\wae\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\vi\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\vi\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\uz\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\uz\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\ur\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\ur\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\uk\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\uk\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\ug\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\ug\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\tw\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\tw\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\oc\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\oc\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\nn\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\nn\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\te\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\te\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\ta\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\ta\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\sv\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\sv\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\sr\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\sr\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\sq\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\sq\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\sl\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\sl\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\sk\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\sk\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\shn\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\shn\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\ru\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\ru\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\ro\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\ro\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\pt_br\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\pt_br\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\pt\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\pt\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\pl\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\pl\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\tr\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\tr\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\fi\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\fi\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\fa\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\fa\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\eu\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\eu\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\data\images\ubuntu.ico в %TEMP%\pyl1.tmp\data\images\ubuntu.ico.@crypted
%TEMP%\pyl1.tmp\data\images\ubuntu studio.ico в %TEMP%\pyl1.tmp\data\images\ubuntu studio.ico.@crypted
%TEMP%\pyl1.tmp\data\images\mythbuntu.ico в %TEMP%\pyl1.tmp\data\images\mythbuntu.ico.@crypted
%TEMP%\pyl1.tmp\data\images\lubuntu.ico в %TEMP%\pyl1.tmp\data\images\lubuntu.ico.@crypted
%TEMP%\pyl1.tmp\data\images\kubuntu.ico в %TEMP%\pyl1.tmp\data\images\kubuntu.ico.@crypted
%TEMP%\pyl1.tmp\data\images\edubuntu.ico в %TEMP%\pyl1.tmp\data\images\edubuntu.ico.@crypted
%TEMP%\pyl1.tmp\data\grub.install.cfg в %TEMP%\pyl1.tmp\data\grub.install.cfg.@crypted
%TEMP%\pyl1.tmp\data\custom-installation\hooks\success-command.sh в %TEMP%\pyl1.tmp\data\custom-installation\hooks\success-command.sh.@crypted
%TEMP%\pyl1.tmp\data\custom-installation\hooks\failure-command.sh в %TEMP%\pyl1.tmp\data\custom-installation\hooks\failure-command.sh.@crypted
%TEMP%\pyl1.tmp\data\custom-installation\hooks\early-command.sh в %TEMP%\pyl1.tmp\data\custom-installation\hooks\early-command.sh.@crypted
%TEMP%\pyl1.tmp\data\custom-installation\hooks\casper-premount.sh в %TEMP%\pyl1.tmp\data\custom-installation\hooks\casper-premount.sh.@crypted
%TEMP%\dd_xps.txt в %TEMP%\dd_xps.txt.@crypted
%TEMP%\pyl1.tmp\data\menu.install в %TEMP%\pyl1.tmp\data\menu.install.@crypted
%TEMP%\dd_wcf_retca4a2a.txt в %TEMP%\dd_wcf_retca4a2a.txt.@crypted
%TEMP%\dd_net_framework30_setup7762.txt в %TEMP%\dd_net_framework30_setup7762.txt.@crypted
%TEMP%\dd_net_framework20_setup74f9.txt в %TEMP%\dd_net_framework20_setup74f9.txt.@crypted
%TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt в %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt.@crypted
%TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt в %TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt.@crypted
%TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt в %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.@crypted
%TEMP%\dd_dotnetfx35install.txt в %TEMP%\dd_dotnetfx35install.txt.@crypted
%TEMP%\dd_dotnetfx35error.txt в %TEMP%\dd_dotnetfx35error.txt.@crypted
%TEMP%\dd_dotnetfx20install.txt в %TEMP%\dd_dotnetfx20install.txt.@crypted
%TEMP%\dd_dotnetfx20error.txt в %TEMP%\dd_dotnetfx20error.txt.@crypted
%TEMP%\dd_depcheck_netfx_exp_35.txt в %TEMP%\dd_depcheck_netfx_exp_35.txt.@crypted
%TEMP%\dd_depcheck_netfx20_exp_35.txt в %TEMP%\dd_depcheck_netfx20_exp_35.txt.@crypted
%TEMP%\dd_clwireg.txt в %TEMP%\dd_clwireg.txt.@crypted
%TEMP%\aucheck_parser.txt в %TEMP%\aucheck_parser.txt.@crypted
%TEMP%\dd_net_framework35_msi77c4.txt в %TEMP%\dd_net_framework35_msi77c4.txt.@crypted
%TEMP%\pyl1.tmp\data\menu.winboot в %TEMP%\pyl1.tmp\data\menu.winboot.@crypted
%TEMP%\pyl1.tmp\data\images\wubi.ico в %TEMP%\pyl1.tmp\data\images\wubi.ico.@crypted
%TEMP%\pyl1.tmp\data\preseed.cdboot в %TEMP%\pyl1.tmp\data\preseed.cdboot.@crypted
%TEMP%\pyl1.tmp\translations\et\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\et\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\ca\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\ca\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\es\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\es\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\eo\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\eo\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\en_gb\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\en_gb\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\en_ca\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\en_ca\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\en_au\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\en_au\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\en\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\en\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\el\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\el\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\de\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\de\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\da\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\da\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\cy\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\cy\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\csb\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\csb\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\cs\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\cs\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\crh\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\crh\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\bs\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\bs\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\data\preseed.disk в %TEMP%\pyl1.tmp\data\preseed.disk.@crypted
%TEMP%\pyl1.tmp\translations\br\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\br\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\bo\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\bo\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\bg\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\bg\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\ast\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\ast\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\as\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\as\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\ar\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\ar\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\translations\af\lc_messages\wubi.mo в %TEMP%\pyl1.tmp\translations\af\lc_messages\wubi.mo.@crypted
%TEMP%\pyl1.tmp\data\wubildr.cfg в %TEMP%\pyl1.tmp\data\wubildr.cfg.@crypted
%TEMP%\pyl1.tmp\data\wubildr-disk.cfg в %TEMP%\pyl1.tmp\data\wubildr-disk.cfg.@crypted
%TEMP%\pyl1.tmp\data\wubildr-bootstrap.cfg в %TEMP%\pyl1.tmp\data\wubildr-bootstrap.cfg.@crypted
%TEMP%\pyl1.tmp\data\trustedkeys.gpg в %TEMP%\pyl1.tmp\data\trustedkeys.gpg.@crypted
%TEMP%\pyl1.tmp\data\preseed.mythbuntu в %TEMP%\pyl1.tmp\data\preseed.mythbuntu.@crypted
%TEMP%\pyl1.tmp\data\preseed.lupin в %TEMP%\pyl1.tmp\data\preseed.lupin.@crypted
%TEMP%\pyl1.tmp\winboot\wubildr.tar в %TEMP%\pyl1.tmp\winboot\wubildr.tar.@crypted
%TEMP%\uxeventlog.txt в %TEMP%\uxeventlog.txt.@crypted

Изменяет следующие файлы

C:\documents and settings\default user\templates\amipro.sam.@crypted
%HOMEPATH%\cookies\user@mon.softkey[2].txt.@crypted
%HOMEPATH%\cookies\user@microsoft[1].txt.@crypted
%HOMEPATH%\cookies\user@mail[1].txt.@crypted
%HOMEPATH%\cookies\user@help.softkey[3].txt.@crypted
%HOMEPATH%\cookies\user@help.softkey[2].txt.@crypted
%HOMEPATH%\cookies\user@d.castplatform[2].txt.@crypted
%HOMEPATH%\cookies\user@c.msn[1].txt.@crypted
%HOMEPATH%\cookies\user@c.bing[1].txt.@crypted
%HOMEPATH%\cookies\user@bluekai[2].txt.@crypted
%HOMEPATH%\cookies\user@bing[1].txt.@crypted
%HOMEPATH%\cookies\user@atdmt[1].txt.@crypted
%HOMEPATH%\cookies\user@adobe[1].txt.@crypted
%HOMEPATH%\cookies\user@adnxs[1].txt.@crypted
%HOMEPATH%\cookies\user@7ba[1].txt.@crypted
%HOMEPATH%\cookies\user@326944[1].txt.@crypted
%HOMEPATH%\.oracle_jre_usage\90737d32e3aba45.timestamp.@crypted
C:\documents and settings\default user\templates\wordpfct.wpg.@crypted
C:\documents and settings\default user\templates\wordpfct.wpd.@crypted
C:\documents and settings\default user\templates\winword2.doc.@crypted
C:\documents and settings\default user\templates\winword.doc.@crypted
C:\documents and settings\default user\templates\sndrec.wav.@crypted
C:\documents and settings\default user\templates\quattro.wb2.@crypted
C:\documents and settings\default user\templates\presenta.shw.@crypted
C:\documents and settings\default user\templates\powerpnt.ppt.@crypted
C:\documents and settings\default user\templates\lotus.wk4.@crypted
C:\documents and settings\default user\templates\excel4.xls.@crypted
C:\documents and settings\default user\templates\excel.xls.@crypted
%HOMEPATH%\cookies\user@msn[1].txt.@crypted
%HOMEPATH%\cookies\user@openstat[1].txt.@crypted

Изменяет множество файлов.

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней