Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Explorer' = '"<Полный путь к файлу>"'
Создает или изменяет следующие файлы
- %APPDATA%\microsoft\windows\start menu\programs\startup\desktop.ini.encrypted
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Диспетчера задач (Taskmgr)
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\1189.jpeg
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\region-north-karelia.jpeg
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\ituneshelpunavailable.html
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\alert.html
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\dialmap.bmp
- %APPDATA%\mozilla\firefox\profiles.ini
Изменения в файловой системе
Создает следующие файлы
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\containers.json.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\compatibility.ini.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\broadcast-listeners.json.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\alternateservices.txt.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addonstartup.json.lz4.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\addons.json.encrypted
- %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.encrypted
- %APPDATA%\mozilla\firefox\profiles.ini.encrypted
- %APPDATA%\mozilla\firefox\installs.ini.encrypted
- %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail.encrypted
- %APPDATA%\microsoft\windows\sendto\fax recipient.lnk.encrypted
- %APPDATA%\microsoft\windows\sendto\documents.mydocs.encrypted
- %APPDATA%\microsoft\windows\sendto\desktop.ini.encrypted
- %APPDATA%\microsoft\windows\sendto\desktop (create shortcut).desklink.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\content-prefs.sqlite.encrypted
- %APPDATA%\microsoft\windows\sendto\compressed (zipped) folder.zfsendtotarget.encrypted
- %APPDATA%\microsoft\windows\recent\customdestinations\75d15cab93918253.customdestinations-ms.encrypted
- %APPDATA%\microsoft\windows\recent\customdestinations\6824f4a902c78fbd.customdestinations-ms.encrypted
- %APPDATA%\microsoft\windows\recent\customdestinations\5afe4de1b92fc382.customdestinations-ms.encrypted
- %APPDATA%\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms.encrypted
- %APPDATA%\microsoft\windows\recent\customdestinations\1b4dd67f29cb1962.customdestinations-ms.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk.encrypted
- %HOMEPATH%\desktop\wrar520.exe.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk.encrypted
- %HOMEPATH%\desktop\winmine.exe.encrypted
- %HOMEPATH%\desktop\telegram.lnk.encrypted
- %APPDATA%\microsoft\windows\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk.encrypted
- %APPDATA%\microsoft\windows\recent\desktop.ini.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk.encrypted
- %APPDATA%\microsoft\windows\recent\customdestinations\7e4dca80246863e3.customdestinations-ms.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\search.json.mozlz4.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\state.json.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cookies.sqlite-wal.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\session-state.json.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\crashes\store.json.mozlz4.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\bookmarkbackups\bookmarks-2024-09-02_11_de2a2eo29nunltkagq5ija==.jsonlz4.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\xulstore.json.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\webappsstore.sqlite-wal.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\webappsstore.sqlite-shm.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\webappsstore.sqlite.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\trrblacklist.txt.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\times.json.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage.sqlite.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\shield-preference-experiments.json.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessioncheckpoints.json.encrypted
- %APPDATA%\microsoft\windows\libraries\videos.library-ms.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\securitypreloadstate.txt.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\places.sqlite-wal.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\places.sqlite-shm.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\places.sqlite.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\permissions.sqlite.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\parent.lock.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\handlers.json.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\formhistory.sqlite.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\favicons.sqlite-wal.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\favicons.sqlite-shm.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\favicons.sqlite.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extensions.json.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\extension-preferences.json.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cookies.sqlite.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\cookies.sqlite-shm.encrypted
- %APPDATA%\microsoft\windows\libraries\pictures.library-ms.encrypted
- %HOMEPATH%\desktop\dashborder_120.bmp.encrypted
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk.encrypted
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk.encrypted
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk.encrypted
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk.encrypted
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\accessories\run.lnk.encrypted
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk.encrypted
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ini.encrypted
- %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\accessories\notepad.lnk.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\accessories\desktop.ini.encrypted
- %HOMEPATH%\desktop\chromesetup.exe.encrypted
- %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\accessories\command prompt.lnk.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\accessories\windows explorer.lnk.encrypted
- %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk.encrypted
- %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk.encrypted
- %HOMEPATH%\desktop\archer.avi.encrypted
- %HOMEPATH%\desktop\alert.html.encrypted
- %HOMEPATH%\desktop\about.html.encrypted
- %HOMEPATH%\desktop\1189.jpeg.encrypted
- %APPDATA%\microsoft\internet explorer\quick launch\desktop.ini.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\desktop.ini.encrypted
- %HOMEPATH%\music\desktop.ini.encrypted
- %HOMEPATH%\pictures\desktop.ini.encrypted
- %HOMEPATH%\videos\desktop.ini.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\administrative tools\desktop.ini.encrypted
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\f58155b4b1d5a524ca0261c3ee99fb50_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814.encrypted
- %APPDATA%\microsoft\windows\start menu\desktop.ini.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini.encrypted
- %APPDATA%\microsoft\windows\libraries\documents.library-ms.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini.encrypted
- %APPDATA%\microsoft\windows\libraries\desktop.ini.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk.encrypted
- %HOMEPATH%\desktop\skypesetup.exe.encrypted
- %APPDATA%\microsoft\uproof\custom.dic.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\maintenance\help.lnk.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\maintenance\desktop.ini.encrypted
- %APPDATA%\microsoft\templates\~$normal.dotm.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk.encrypted
- %APPDATA%\microsoft\templates\normal.dotm.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk.encrypted
- %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\preferred.encrypted
- %APPDATA%\microsoft\protect\s-1-5-21-3691498038-2086406363-2140527554-1000\01dce7f8-5d1f-4649-b59e-c1c72774584c.encrypted
- %HOMEPATH%\desktop\notepad.exe.encrypted
- %APPDATA%\microsoft\windows\libraries\music.library-ms.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\private character editor.lnk.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\control panel.lnk.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\computer.lnk.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\on-screen keyboard.lnk.encrypted
- %APPDATA%\microsoft\protect\credhist.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\magnify.lnk.encrypted
- %HOMEPATH%\desktop\google chrome.lnk.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\narrator.lnk.encrypted
- %APPDATA%\microsoft\office\recent\templates.lnk.encrypted
- %HOMEPATH%\desktop\dotnetfx45_full_setup.exe.encrypted
- %HOMEPATH%\desktop\dialmap.bmp.encrypted
- %APPDATA%\microsoft\office\mso1033.acl.encrypted
- %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\ease of access.lnk.encrypted
- %HOMEPATH%\desktop\desktop.ini.encrypted
- %HOMEPATH%\desktop\dashborder_192.bmp.encrypted
- %HOMEPATH%\desktop\coffee.bmp.encrypted
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\datareporting\archived\2024-08\1723416117185.71d39899-113e-4a90-b1d6-a0ddeee2b177.new-profile.jsonlz4.encrypted
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Сетевая активность
Подключается к
- 'co###ase.com':443
- 'lo####itcoins.com':443
TCP
Другие
- 'co###ase.com':443
- 'lo####itcoins.com':443
UDP
- DNS ASK lo####itcoins.com
- DNS ASK co###ase.com
Другое
Ищет следующие окна
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
