Техническая информация
Вредоносные функции
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\mcmss.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\_bz2.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\_ctypes.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\_decimal.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\_hashlib.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\_lzma.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\_socket.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\_ssl.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\_wmi.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\concrt140.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\libcrypto-3.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\libeay32.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\libffi-8.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\libssl-3.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\msvcp140.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\msvcp140_1.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\python3.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\python312.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\qt5core.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\qt5dbus.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\qt5gui.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\qt5multimedia.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\qt5network.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\qt5printsupport.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\qt5qml.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\qt5qmlmodels.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\qt5quick.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\qt5svg.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\qt5websockets.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\qt5widgets.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\select.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\ssleay32.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\unicodedata.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\vcruntime140.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\vcruntime140_1.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\cipher\_salsa20.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\cipher\_raw_aes.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\cipher\_raw_aesni.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\cipher\_raw_cbc.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\cipher\_raw_cfb.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\cipher\_raw_ctr.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\cipher\_raw_ecb.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\cipher\_raw_eksblowfish.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\cipher\_raw_ocb.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\cipher\_raw_ofb.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\hash\_blake2s.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\hash\_md5.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\hash\_sha1.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\hash\_sha224.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\hash\_sha256.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\hash\_sha384.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\hash\_sha512.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\hash\_ghash_clmul.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\hash\_ghash_portable.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\hash\_keccak.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\protocol\_scrypt.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\util\_cpuid_c.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\crypto\util\_strxor.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qtcore.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qtgui.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qtwidgets.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\sip.pyd
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\iconengines\qsvgicon.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\imageformats\qgif.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\imageformats\qicns.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\imageformats\qico.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\imageformats\qjpeg.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\imageformats\qsvg.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\imageformats\qtga.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\imageformats\qtiff.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\imageformats\qwbmp.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\imageformats\qwebp.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\mediaservice\dsengine.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\mediaservice\qtmedia_audioengine.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\mediaservice\wmfengine.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\platforms\qminimal.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\platforms\qoffscreen.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\platforms\qwebgl.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\platforms\qwindows.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\platformthemes\qxdgdesktopportal.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\printsupport\windowsprintersupport.dll
- %TEMP%\onefile_3244_555737_pdd2g5qdvmi\pyqt5\qt-plugins\styles\qwindowsvistastyle.dll
- %HOMEPATH%\documents\anketa.doc.locked
- %HOMEPATH%\documents\avatarka.jpg.locked
- %HOMEPATH%\documents\avatarka.png.locked
- %HOMEPATH%\documents\avatarka2.jpg.locked
- %HOMEPATH%\documents\banner.gif.locked
- %HOMEPATH%\documents\banner.jpg.locked
- %HOMEPATH%\documents\banner.png.locked
- %HOMEPATH%\documents\changelog.txt.locked
- %HOMEPATH%\documents\chernovik.doc.locked
- %HOMEPATH%\documents\chernovik.txt.locked
- %HOMEPATH%\documents\chertezh.gif.locked
- %HOMEPATH%\documents\chertezh.jpg.locked
- %HOMEPATH%\documents\chertezh.png.locked
- %HOMEPATH%\documents\chertezh2.png.locked
- %HOMEPATH%\documents\citaty.txt.locked
- %HOMEPATH%\documents\diagramma.jpg.locked
- %HOMEPATH%\documents\diagramma.png.locked
- %HOMEPATH%\documents\diagramma2.jpg.locked
- %HOMEPATH%\documents\dnevnik.txt.locked
- %HOMEPATH%\documents\fotografia.jpg.locked
- %HOMEPATH%\documents\fotografia.png.locked
- %HOMEPATH%\documents\fotografia2.jpg.locked
- %HOMEPATH%\documents\grafik.gif.locked
- %HOMEPATH%\documents\grafik.jpg.locked
- %HOMEPATH%\documents\grafik.png.locked
- %HOMEPATH%\documents\idei.txt.locked
- %HOMEPATH%\documents\idei2.txt.locked
- %HOMEPATH%\documents\ikonka.jpg.locked
- %HOMEPATH%\documents\ikonka.png.locked
- %HOMEPATH%\documents\ikonka2.png.locked
- %HOMEPATH%\documents\instruktsia.doc.locked
- %HOMEPATH%\documents\instruktsia.txt.locked
- %HOMEPATH%\documents\instruktsia2.txt.locked
- %HOMEPATH%\documents\kartinka.jpg.locked
- %HOMEPATH%\documents\kartinka.png.locked
- %HOMEPATH%\documents\kartinka2.jpg.locked
- %HOMEPATH%\documents\kollazh.jpg.locked
- %HOMEPATH%\documents\kollazh.png.locked
- %HOMEPATH%\documents\kollazh2.jpg.locked
- %HOMEPATH%\documents\kommentarii.txt.locked
- %HOMEPATH%\documents\kommentarii2.txt.locked
- %HOMEPATH%\documents\konspekt.txt.locked
- %HOMEPATH%\documents\konspekt2.txt.locked
- %HOMEPATH%\documents\kontakty.txt.locked
- %HOMEPATH%\documents\kotiki.jpg.locked
- %HOMEPATH%\documents\kotiki.png.locked
- %HOMEPATH%\documents\kotiki2.png.locked
- %HOMEPATH%\documents\logotip.jpg.locked
- %HOMEPATH%\documents\logotip.png.locked
- %HOMEPATH%\documents\logotip2.png.locked
- %HOMEPATH%\documents\memorandum.doc.locked
- %HOMEPATH%\documents\oboi-stola.jpg.locked
- %HOMEPATH%\documents\oboi-stola.png.locked
- %HOMEPATH%\documents\oboi-stola2.jpg.locked
- %HOMEPATH%\documents\otchet.doc.locked
- %HOMEPATH%\documents\panorama.jpg.locked
- %HOMEPATH%\documents\panorama.png.locked
- %HOMEPATH%\documents\panorama2.png.locked
- %HOMEPATH%\documents\pismo.doc.locked
- %HOMEPATH%\documents\plan-raboty.doc.locked
- %HOMEPATH%\documents\portret.jpg.locked
- %HOMEPATH%\documents\portret.png.locked
- %HOMEPATH%\documents\portret2.jpg.locked
- %HOMEPATH%\documents\poster.gif.locked
- %HOMEPATH%\documents\poster.jpg.locked
- %HOMEPATH%\documents\poster.png.locked
- %HOMEPATH%\documents\poyasnenie.doc.locked
- %HOMEPATH%\documents\pretenzia.doc.locked
- %HOMEPATH%\documents\prikaz.doc.locked
- %HOMEPATH%\documents\readme.txt.locked
- %HOMEPATH%\documents\readme2.txt.locked
- %HOMEPATH%\documents\recept.txt.locked
- %HOMEPATH%\documents\recept2.txt.locked
- %HOMEPATH%\documents\reglament.doc.locked
- %HOMEPATH%\documents\screenshot.jpg.locked
- %HOMEPATH%\documents\screenshot.png.locked
- %HOMEPATH%\documents\screenshot2.jpg.locked
- %HOMEPATH%\documents\shema-seti.jpg.locked
- %HOMEPATH%\documents\shema-seti.png.locked
- %HOMEPATH%\documents\shema-seti2.jpg.locked
- %HOMEPATH%\documents\shpargalka.txt.locked
- %HOMEPATH%\documents\shpargalka2.txt.locked
- %HOMEPATH%\documents\skan-dokum.jpg.locked
- %HOMEPATH%\documents\skan-dokum.png.locked
- %HOMEPATH%\documents\skan-dokum2.jpg.locked
- %HOMEPATH%\documents\skrinshot.gif.locked
- %HOMEPATH%\documents\skrinshot.jpg.locked
- %HOMEPATH%\documents\skrinshot.png.locked
- %HOMEPATH%\documents\spisok.txt.locked
- %HOMEPATH%\documents\spisok2.txt.locked
- %HOMEPATH%\documents\spravka.doc.locked
- %HOMEPATH%\documents\ssylki.txt.locked
- %HOMEPATH%\documents\todo-list.txt.locked
- %HOMEPATH%\documents\todo-list2.txt.locked
- %HOMEPATH%\documents\vopros.txt.locked
- %HOMEPATH%\documents\vopros2.txt.locked
- %HOMEPATH%\documents\vyvody.txt.locked
- %HOMEPATH%\documents\zagotovka.txt.locked
- %HOMEPATH%\documents\zakat.gif.locked
- %HOMEPATH%\documents\zakat.jpg.locked
- %HOMEPATH%\documents\zakat.png.locked
- %HOMEPATH%\documents\zametki.txt.locked
- %HOMEPATH%\documents\zametki2.txt.locked
- %HOMEPATH%\documents\zayavka.doc.locked
- %HOMEPATH%\desktop\adhd_and_obesity.docx.locked
- <Текущая директория>\system_cache.dat
Изменяет следующие файлы
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_idx.db
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Сетевая активность
Подключается к
- 'sm##.gmail.com':587
TCP
Другие
- 'sm##.gmail.com':587
UDP
- DNS ASK sm##.gmail.com
Другое
Перезапускает анализируемый образец
