Trojan.Encoder.40716

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

%APPDATA%\microsoft\windows\start menu\programs\startup\desktop.ini

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%APPDATA%\mozilla\firefox\profiles.ini
%HOMEPATH%\desktop\testcertificate.cer
%HOMEPATH%\desktop\sdkfailsafeemulator.cer
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\ituneshelpunavailable.html
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\contosoroot.cer
%HOMEPATH%\desktop\contoso.cer
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\3.jpeg
%HOMEPATH%\desktop\000814251_video_01.avi
%APPDATA%\thunderbird\profiles.ini
%HOMEPATH%\desktop\testee.cer
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx

Изменения в файловой системе

Создает следующие файлы

%HOMEPATH%\e9095e4cd4be4dbb83349e4b6edf0572

Изменяет следующие файлы

%LOCALAPPDATA%\microsoft\windows mail\stationery\softblue.jpg
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\startupcache\scriptcache.bin
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\youtube.crx
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\startupcache\scriptcache-current.bin
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\search.crx
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\gmail.crx
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\startupcache\scriptcache-child.bin
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\startupcache\scriptcache-child-current.bin
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\external_extensions.json
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\offlinecache\index.sqlite
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\bc9a334d14ae8d5cdcf1f5f5128ba1f4cdd083ac
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\2b8fb3a7c1e8990ce64886d66718692d2b2ed2bc
%LOCALAPPDATA%\microsoft\windows sidebar\settings.ini
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\drive.crx
%LOCALAPPDATA%\microsoft\windows media\12.0\wmsdkns.xml
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\default_apps\docs.crx
%LOCALAPPDATA%\microsoft\windows media\12.0\wmsdkns.dtd
%LOCALAPPDATA%\microsoft\windows mail\windowsmail.pat
%LOCALAPPDATA%\microsoft\windows mail\stationery\wrinkled_paper.gif
%LOCALAPPDATA%\microsoft\windows mail\stationery\white_chocolate.jpg
%LOCALAPPDATA%\microsoft\windows mail\stationery\to_do_list.emf
%LOCALAPPDATA%\microsoft\windows mail\stationery\tiki.gif
%LOCALAPPDATA%\microsoft\windows mail\stationery\tanspecks.jpg
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_200_percent.pak
%LOCALAPPDATA%\microsoft\windows mail\stationery\stucco.gif
%LOCALAPPDATA%\microsoft\windows mail\stationery\stars.jpg
%LOCALAPPDATA%\microsoft\windows mail\stationery\stars.htm
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_100_percent.pak
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\extensions\external_extensions.json
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\startupcache\urlcache-current.bin