Trojan.Encoder.41351

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Hexamethy decryptor' = '<Полный путь к файлу>'

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\1189.jpeg
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\sdkfailsafeemulator.cer
%HOMEPATH%\desktop\howto-index.html
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\contoso_1.cer
%HOMEPATH%\desktop\browse.html
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\adadsi.html
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\about.htm
%HOMEPATH%\desktop\3.jpeg
%HOMEPATH%\desktop\2.jpeg
%HOMEPATH%\desktop\toolbar.bmp
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc

Изменения в файловой системе

Создает следующие файлы

%TEMP%\backgroundimage.jpg
%HOMEPATH%\videos\desktop.ini.temp
%HOMEPATH%\music\desktop.ini.temp
%HOMEPATH%\pictures\desktop.ini.temp
%HOMEPATH%\documents\desktop.ini.temp
%HOMEPATH%\desktop\telegram.lnk.temp
%HOMEPATH%\desktop\skypesetup.exe.temp
%HOMEPATH%\desktop\notepad.exe.temp
%HOMEPATH%\desktop\jre-7u75-windows-i586-iftw.exe.temp
%HOMEPATH%\desktop\google chrome.lnk.temp
%HOMEPATH%\desktop\desktop.ini.temp
%HOMEPATH%\desktop\calc.exe.temp
%HOMEPATH%\desktop\applicantform_en.doc.temp
%HOMEPATH%\desktop\api-hashmap.html.temp
%HOMEPATH%\desktop\alert.htm.temp
%HOMEPATH%\desktop\adadsi.html.temp
%HOMEPATH%\desktop\about.html.temp
%HOMEPATH%\desktop\about.htm.temp
%HOMEPATH%\desktop\3.jpeg.temp
%HOMEPATH%\desktop\2.jpeg.temp
%HOMEPATH%\desktop\1189.jpeg.temp
%HOMEPATH%\downloads\desktop.ini.temp
%HOMEPATH%\desktop\hexamethy decryptor.exe
%HOMEPATH%\desktop\rapidoverwriter.exe

Перемещает следующие файлы

%HOMEPATH%\downloads\desktop.ini.temp в %HOMEPATH%\downloads\desktop.ini.hxamthy
%HOMEPATH%\pictures\desktop.ini.temp в %HOMEPATH%\pictures\desktop.ini.hxamthy
%HOMEPATH%\documents\desktop.ini.temp в %HOMEPATH%\documents\desktop.ini.hxamthy
%HOMEPATH%\desktop\telegram.lnk.temp в %HOMEPATH%\desktop\telegram.lnk.hxamthy
%HOMEPATH%\desktop\skypesetup.exe.temp в %HOMEPATH%\desktop\skypesetup.exe.hxamthy
%HOMEPATH%\desktop\notepad.exe.temp в %HOMEPATH%\desktop\notepad.exe.hxamthy
%HOMEPATH%\desktop\jre-7u75-windows-i586-iftw.exe.temp в %HOMEPATH%\desktop\jre-7u75-windows-i586-iftw.exe.hxamthy
%HOMEPATH%\desktop\google chrome.lnk.temp в %HOMEPATH%\desktop\google chrome.lnk.hxamthy
%HOMEPATH%\desktop\desktop.ini.temp в %HOMEPATH%\desktop\desktop.ini.hxamthy
%HOMEPATH%\music\desktop.ini.temp в %HOMEPATH%\music\desktop.ini.hxamthy
%HOMEPATH%\desktop\calc.exe.temp в %HOMEPATH%\desktop\calc.exe.hxamthy
%HOMEPATH%\desktop\api-hashmap.html.temp в %HOMEPATH%\desktop\api-hashmap.html.hxamthy
%HOMEPATH%\desktop\alert.htm.temp в %HOMEPATH%\desktop\alert.htm.hxamthy
%HOMEPATH%\desktop\adadsi.html.temp в %HOMEPATH%\desktop\adadsi.html.hxamthy
%HOMEPATH%\desktop\about.html.temp в %HOMEPATH%\desktop\about.html.hxamthy
%HOMEPATH%\desktop\about.htm.temp в %HOMEPATH%\desktop\about.htm.hxamthy
%HOMEPATH%\desktop\3.jpeg.temp в %HOMEPATH%\desktop\3.jpeg.hxamthy
%HOMEPATH%\desktop\2.jpeg.temp в %HOMEPATH%\desktop\2.jpeg.hxamthy
%HOMEPATH%\desktop\1189.jpeg.temp в %HOMEPATH%\desktop\1189.jpeg.hxamthy
%HOMEPATH%\desktop\applicantform_en.doc.temp в %HOMEPATH%\desktop\applicantform_en.doc.hxamthy
%HOMEPATH%\videos\desktop.ini.temp в %HOMEPATH%\videos\desktop.ini.hxamthy