Trojan.Encoder.41196

Техническая информация

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\trivial-merge.html
%HOMEPATH%\desktop\tileimage.bmp
%HOMEPATH%\desktop\testee.cer
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\region-north-karelia.jpg
%HOMEPATH%\desktop\pmd.cer
%HOMEPATH%\desktop\ituneshelpunavailable.html
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\dialmap.bmp
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\contoso_1.cer
%HOMEPATH%\desktop\browse.htm
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\210252809.jpg
%HOMEPATH%\desktop\garden.htm
%HOMEPATH%\desktop\weeklysheet1215.doc

Изменения в файловой системе

Создает следующие файлы

%APPDATA%\[ziplock]ziplock_log.txt
%HOMEPATH%\desktop\dotnetzip-z254u3ey.tmp
%HOMEPATH%\desktop\dotnetzip-f5rnexmw.tmp
%HOMEPATH%\desktop\dotnetzip-nktgwv2s.tmp
%HOMEPATH%\desktop\dotnetzip-5qvnybxs.tmp
%HOMEPATH%\desktop\dotnetzip-nixks25k.tmp
%HOMEPATH%\desktop\dotnetzip-5al4v5da.tmp
%HOMEPATH%\desktop\dotnetzip-sxnmr4c2.tmp
%HOMEPATH%\desktop\dotnetzip-yqyki4wm.tmp
%HOMEPATH%\desktop\dotnetzip-hvxowytd.tmp
%HOMEPATH%\desktop\dotnetzip-um31pe1f.tmp
%HOMEPATH%\desktop\dotnetzip-ieahbxqe.tmp
%HOMEPATH%\desktop\dotnetzip-hb43wwyj.tmp
%HOMEPATH%\desktop\dotnetzip-f3pnadim.tmp
%HOMEPATH%\desktop\dotnetzip-p0zzsmmf.tmp
%HOMEPATH%\desktop\dotnetzip-c5tlmwna.tmp
%HOMEPATH%\desktop\dotnetzip-4xcdybxo.tmp
%HOMEPATH%\desktop\dotnetzip-hhz43sn5.tmp
%HOMEPATH%\desktop\dotnetzip-lhu0kuih.tmp
%HOMEPATH%\desktop\dotnetzip-v53r3pdd.tmp
%HOMEPATH%\desktop\dotnetzip-2s2qgz2o.tmp
%HOMEPATH%\desktop\dotnetzip-5h4olfpz.tmp
%HOMEPATH%\desktop\dotnetzip-nr5frgx1.tmp
%HOMEPATH%\desktop\dotnetzip-41k22xr1.tmp
%HOMEPATH%\desktop\dotnetzip-oixjmcuk.tmp
%HOMEPATH%\downloads\[ziplock]instructions.txt
%HOMEPATH%\pictures\[ziplock]instructions.txt
%HOMEPATH%\music\[ziplock]instructions.txt
%HOMEPATH%\documents\[ziplock]instructions.txt
%HOMEPATH%\documents\my videos\[ziplock]instructions.txt
%HOMEPATH%\documents\my pictures\[ziplock]instructions.txt
%HOMEPATH%\documents\my music\[ziplock]instructions.txt
%HOMEPATH%\desktop\dotnetzip-4cbg5qmi.tmp
%HOMEPATH%\desktop\[ziplock]instructions.txt

Перемещает следующие файлы

%HOMEPATH%\desktop\dotnetzip-yqyki4wm.tmp в %HOMEPATH%\desktop\000814251_video_01.avi.zip
%HOMEPATH%\desktop\trivial-merge.html.zip в %HOMEPATH%\desktop\[ziplock]trivial-merge.html.zip
%HOMEPATH%\desktop\tileimage.bmp.zip в %HOMEPATH%\desktop\[ziplock]tileimage.bmp.zip
%HOMEPATH%\desktop\testee.cer.zip в %HOMEPATH%\desktop\[ziplock]testee.cer.zip
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer.zip в %HOMEPATH%\desktop\[ziplock]sdksampleprivdeveloper.cer.zip
%HOMEPATH%\desktop\region-north-karelia.jpg.zip в %HOMEPATH%\desktop\[ziplock]region-north-karelia.jpg.zip
%HOMEPATH%\desktop\pmd.cer.zip в %HOMEPATH%\desktop\[ziplock]pmd.cer.zip
%HOMEPATH%\desktop\ituneshelpunavailable.html.zip в %HOMEPATH%\desktop\[ziplock]ituneshelpunavailable.html.zip
%HOMEPATH%\desktop\issi2013_template_for_posters.docx.zip в %HOMEPATH%\desktop\[ziplock]issi2013_template_for_posters.docx.zip
%HOMEPATH%\desktop\hanni_umami_chapter.doc.zip в %HOMEPATH%\desktop\[ziplock]hanni_umami_chapter.doc.zip
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx.zip в %HOMEPATH%\desktop\[ziplock]hadac_newsletter_july_2010_final.docx.zip
%HOMEPATH%\desktop\glidescope_review_rev_010.docx.zip в %HOMEPATH%\desktop\[ziplock]glidescope_review_rev_010.docx.zip
%HOMEPATH%\desktop\garden.htm.zip в %HOMEPATH%\desktop\[ziplock]garden.htm.zip
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc.zip в %HOMEPATH%\desktop\[ziplock]uep_form_786_bulletin_1726i602.doc.zip
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx.zip в %HOMEPATH%\desktop\[ziplock]file_p_00000000_1371597592.docx.zip
%HOMEPATH%\desktop\default.bmp.zip в %HOMEPATH%\desktop\[ziplock]default.bmp.zip
%HOMEPATH%\desktop\dashborder_96.bmp.zip в %HOMEPATH%\desktop\[ziplock]dashborder_96.bmp.zip
%HOMEPATH%\desktop\dashborder_144.bmp.zip в %HOMEPATH%\desktop\[ziplock]dashborder_144.bmp.zip
%HOMEPATH%\desktop\dashborder_120.bmp.zip в %HOMEPATH%\desktop\[ziplock]dashborder_120.bmp.zip
%HOMEPATH%\desktop\contoso_1.cer.zip в %HOMEPATH%\desktop\[ziplock]contoso_1.cer.zip
%HOMEPATH%\desktop\browse.htm.zip в %HOMEPATH%\desktop\[ziplock]browse.htm.zip
%HOMEPATH%\desktop\dotnetzip-5h4olfpz.tmp в %HOMEPATH%\desktop\browse.htm.zip
%HOMEPATH%\desktop\applicantform_en.doc.zip в %HOMEPATH%\desktop\[ziplock]applicantform_en.doc.zip
%HOMEPATH%\desktop\dotnetzip-nr5frgx1.tmp в %HOMEPATH%\desktop\applicantform_en.doc.zip
%HOMEPATH%\desktop\210252809.jpg.zip в %HOMEPATH%\desktop\[ziplock]210252809.jpg.zip
%HOMEPATH%\desktop\dotnetzip-41k22xr1.tmp в %HOMEPATH%\desktop\210252809.jpg.zip
%HOMEPATH%\desktop\000814251_video_01.avi.zip в %HOMEPATH%\desktop\[ziplock]000814251_video_01.avi.zip
%HOMEPATH%\desktop\dialmap.bmp.zip в %HOMEPATH%\desktop\[ziplock]dialmap.bmp.zip
%HOMEPATH%\desktop\weeklysheet1215.doc.zip в %HOMEPATH%\desktop\[ziplock]weeklysheet1215.doc.zip