Trojan.Encoder.41662

Техническая информация

Вредоносные функции

Читает файлы, отвечающие за хранение паролей сторонними программами

%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\parnas_01.jpeg
%HOMEPATH%\desktop\region-north-karelia.jpeg
%HOMEPATH%\desktop\weeklysheet1215.doc

Изменения в файловой системе

Создает следующие файлы

%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.aes
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\32.png.aes
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\48.png.aes
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\128.png.aes
%LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.aes
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\alternateservices.txt.aes
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt.aes
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\securitypreloadstate.txt.aes
C:\users\public\pictures\sample pictures\koala.jpg.aes
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt.aes
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\alternateservices.txt.aes
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt.aes
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\securitypreloadstate.txt.aes
%APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sitesecurityservicestate.txt.aes
%HOMEPATH%\desktop\february_catalogue__2015.doc.aes
%HOMEPATH%\desktop\fi51.doc.aes
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx.aes
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\128.png.aes
%LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\16.png.aes
%LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\128.png.aes
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\128.png.aes
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_16.png.aes
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.aes
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.aes
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.aes
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.aes
C:\users\public\pictures\sample pictures\chrysanthemum.jpg.aes
C:\users\public\pictures\sample pictures\desert.jpg.aes
C:\users\public\pictures\sample pictures\hydrangeas.jpg.aes
%HOMEPATH%\desktop\holycrosschurchinstructions.docx.aes
%APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\trrblacklist.txt.aes
C:\users\public\pictures\sample pictures\jellyfish.jpg.aes
C:\users\public\pictures\sample pictures\penguins.jpg.aes
C:\users\public\pictures\sample pictures\tulips.jpg.aes
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\secondarytile.png.aes
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\logo.png.aes
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\smalllogo.png.aes
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\splash-620x300.png.aes
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_128.png.aes
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.aes
C:\users\public\pictures\sample pictures\lighthouse.jpg.aes
%HOMEPATH%\desktop\nwfieldnotes1966.docx.aes