Техническая информация
Вредоносные функции
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\000814251_video_01.avi
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\weeklysheet1215.doc
Изменения в файловой системе
Перемещает следующие файлы
- %APPDATA%\microsoft\templates\normal.dotm в %APPDATA%\microsoft\templates\normal.dotm.blackrouter
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js.blackrouter
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\abook.sqlite.blackrouter
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\blist.sqlite.blackrouter
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\cookies.sqlite.blackrouter
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\enigmail.sqlite.blackrouter
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\favicons.sqlite.blackrouter
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\formhistory.sqlite.blackrouter
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\global-messages-db.sqlite.blackrouter
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\history.sqlite.blackrouter
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\openpgp.sqlite.blackrouter
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\permissions.sqlite.blackrouter
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\places.sqlite.blackrouter
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage.sqlite.blackrouter
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\webappsstore.sqlite.blackrouter
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\alternateservices.txt в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\alternateservices.txt.blackrouter
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\pkcs11.txt.blackrouter
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\securitypreloadstate.txt в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\securitypreloadstate.txt.blackrouter
- %APPDATA%\telegram desktop\updater.exe в %APPDATA%\telegram desktop\updater.exe.blackrouter
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sitesecurityservicestate.txt в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\sitesecurityservicestate.txt.blackrouter
- %APPDATA%\telegram desktop\unins000.exe в %APPDATA%\telegram desktop\unins000.exe.blackrouter
- %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js в %APPDATA%\mozilla\firefox\profiles\q0evdndb.default\user.js.blackrouter
- %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail в %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail.blackrouter
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js.blackrouter
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\user.js.blackrouter
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\formhistory.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\formhistory.sqlite.blackrouter
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\alternateservices.txt в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\alternateservices.txt.blackrouter
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\pkcs11.txt.blackrouter
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\securitypreloadstate.txt в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\securitypreloadstate.txt.blackrouter
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sitesecurityservicestate.txt.blackrouter
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\trrblacklist.txt в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\trrblacklist.txt.blackrouter
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.baklz4 в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\sessionstore-backups\recovery.baklz4.blackrouter
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql... в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\default\moz-extension+++d6b3ddfc-c8d2-4cb7-a730-29f01af6f4b1^usercontextid=4294967295\idb\3647222921wleabceoxlt-eengsairo.sql...
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.blackrouter
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.sqlite.blackrouter
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.blackrouter
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.blackrouter
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.blackrouter
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite в %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.blackrouter
- %APPDATA%\telegram desktop\telegram.exe в %APPDATA%\telegram desktop\telegram.exe.blackrouter
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite в %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.blackrouter
Изменяет следующие файлы
- %HOMEPATH%\desktop\000814251_video_01.avi
- %APPDATA%\microsoft\templates\normal.dotm
- %LOCALAPPDATA%low\microsoft\internet explorer\services\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico
- %LOCALAPPDATA%\microsoft\windows mail\stationery\wrinkled_paper.gif
- %LOCALAPPDATA%\microsoft\windows mail\stationery\tiki.gif
- %LOCALAPPDATA%\microsoft\windows mail\stationery\stucco.gif
- %LOCALAPPDATA%\microsoft\windows mail\stationery\connectivity.gif
- %LOCALAPPDATA%\microsoft\windows mail\stationery\cave_drawings.gif
- %LOCALAPPDATA%\microsoft\windows mail\backup\new\edb00001.log
- %LOCALAPPDATA%\microsoft\windows mail\edb00001.log
- %LOCALAPPDATA%\microsoft\windows mail\edb.log
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bg0n0zou\favicon[1].ico
- %LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt
- %LOCALAPPDATA%\microsoft\internet explorer\brndlog.bak
- %LOCALAPPDATA%\google\chrome\user data\default\session storage\000003.log
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js
- %LOCALAPPDATA%\google\chrome\user data\default\extension state\000003.log
- %LOCALAPPDATA%\google\chrome\user data\default\extension rules\000003.log
- %LOCALAPPDATA%\google\chrome\user data\default\google profile.ico
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest
- %LOCALAPPDATA%\google\chrome\application\debug.log
- %HOMEPATH%\desktop\weeklysheet1215.doc
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\dashborder_192.bmp
- %APPDATA%\microsoft\windows\sendto\mail recipient.mapimail
- %APPDATA%\mozilla\firefox\profiles\apc2n9d1.default-release\prefs.js
Изменяет множество файлов.
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
