Technical Information
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\howto-index.html
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\ituneshelpunavailable.html
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\trivial-merge.html
Modifies file system
Creates the following files
- %HOMEPATH%\favorites\links\почта.url
- %HOMEPATH%\favorites\links\яндекс.url
Moves the following files
- from %APPDATA%\.purple\prefs.xml to %APPDATA%\.purple\prefs.xml.brick
- from %APPDATA%\telegram desktop\unins000.exe to %APPDATA%\telegram desktop\unins000.exe.brick
- from %APPDATA%\telegram desktop\updater.exe to %APPDATA%\telegram desktop\updater.exe.brick
- from %APPDATA%\thunderbird\profiles\cr5sc40q.default\blocklist.xml to %APPDATA%\thunderbird\profiles\cr5sc40q.default\blocklist.xml.brick
- from %APPDATA%\thunderbird\profiles\cr5sc40q.default\cert8.db to %APPDATA%\thunderbird\profiles\cr5sc40q.default\cert8.db.brick
- from %APPDATA%\thunderbird\profiles\cr5sc40q.default\key3.db to %APPDATA%\thunderbird\profiles\cr5sc40q.default\key3.db.brick
- from %APPDATA%\thunderbird\profiles\cr5sc40q.default\mailviews.dat to %APPDATA%\thunderbird\profiles\cr5sc40q.default\mailviews.dat.brick
- from %APPDATA%\thunderbird\profiles\cr5sc40q.default\secmod.db to %APPDATA%\thunderbird\profiles\cr5sc40q.default\secmod.db.brick
- from %APPDATA%\thunderbird\profiles\cr5sc40q.default\virtualfolders.dat to %APPDATA%\thunderbird\profiles\cr5sc40q.default\virtualfolders.dat.brick
- from %APPDATA%\winrar\version.dat to %APPDATA%\winrar\version.dat.brick
- from %HOMEPATH%\favorites\links\почта.url to %HOMEPATH%\favorites\links\почта.url.brick
- from %HOMEPATH%\favorites\links\яндекс.url to %HOMEPATH%\favorites\links\яндекс.url.brick
- from %TEMP%\aucheck_parser.txt to %TEMP%\aucheck_parser.txt.brick
- from %TEMP%\dd_clwireg.txt to %TEMP%\dd_clwireg.txt.brick
- from %TEMP%\dd_depcheck_netfx20_exp_35.txt to %TEMP%\dd_depcheck_netfx20_exp_35.txt.brick
- from %TEMP%\dd_depcheck_netfx_exp_35.txt to %TEMP%\dd_depcheck_netfx_exp_35.txt.brick
- from %TEMP%\dd_dotnetfx20error.txt to %TEMP%\dd_dotnetfx20error.txt.brick
- from %TEMP%\dd_dotnetfx20install.txt to %TEMP%\dd_dotnetfx20install.txt.brick
- from %TEMP%\dd_dotnetfx35error.txt to %TEMP%\dd_dotnetfx35error.txt.brick
- from %TEMP%\dd_dotnetfx35install.txt to %TEMP%\dd_dotnetfx35install.txt.brick
- from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.brick
- from %TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt to %TEMP%\dd_dotnetfx45_full_setup_decompression_log.txt.brick
- from %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp452-kb2901907-x86-x64-allos-enu_decompression_log.txt.brick
- from %TEMP%\dd_net_framework20_setup74f9.txt to %TEMP%\dd_net_framework20_setup74f9.txt.brick
- from %TEMP%\dd_net_framework30_setup7762.txt to %TEMP%\dd_net_framework30_setup7762.txt.brick
- from %TEMP%\dd_net_framework35_msi77c4.txt to %TEMP%\dd_net_framework35_msi77c4.txt.brick
- from %TEMP%\dd_wcf_retca4a2a.txt to %TEMP%\dd_wcf_retca4a2a.txt.brick
- from %TEMP%\dd_xps.txt to %TEMP%\dd_xps.txt.brick
- from %APPDATA%\telegram desktop\unins000.dat to %APPDATA%\telegram desktop\unins000.dat.brick
- from %TEMP%\downloader.exe to %TEMP%\downloader.exe.brick
- from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\telegram.exe.brick
- from %APPDATA%\sun\java\au\au.cab to %APPDATA%\sun\java\au\au.cab.brick
- from %APPDATA%\.purple\status.xml to %APPDATA%\.purple\status.xml.brick
- from %APPDATA%\icq-profile\installerlang.xml to %APPDATA%\icq-profile\installerlang.xml.brick
- from %APPDATA%\microsoft\dbgclr\7.1\objbrow.dat to %APPDATA%\microsoft\dbgclr\7.1\objbrow.dat.brick
- from %APPDATA%\microsoft\internet explorer\brndlog.txt to %APPDATA%\microsoft\internet explorer\brndlog.txt.brick
- from %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk to %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk.brick
- from %APPDATA%\microsoft\internet explorer\quick launch\icq.lnk to %APPDATA%\microsoft\internet explorer\quick launch\icq.lnk.brick
- from %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk to %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk.brick
- from %APPDATA%\microsoft\internet explorer\quick launch\microsoft office outlook.lnk to %APPDATA%\microsoft\internet explorer\quick launch\microsoft office outlook.lnk.brick
- from %APPDATA%\microsoft\internet explorer\quick launch\mozilla firefox.lnk to %APPDATA%\microsoft\internet explorer\quick launch\mozilla firefox.lnk.brick
- from %APPDATA%\microsoft\internet explorer\quick launch\mozilla thunderbird.lnk to %APPDATA%\microsoft\internet explorer\quick launch\mozilla thunderbird.lnk.brick
- from %APPDATA%\microsoft\internet explorer\quick launch\opera.lnk to %APPDATA%\microsoft\internet explorer\quick launch\opera.lnk.brick
- from %APPDATA%\microsoft\internet explorer\quick launch\qip 2012.lnk to %APPDATA%\microsoft\internet explorer\quick launch\qip 2012.lnk.brick
- from %APPDATA%\microsoft\internet explorer\quick launch\telegram.lnk to %APPDATA%\microsoft\internet explorer\quick launch\telegram.lnk.brick
- from %APPDATA%\microsoft\internet explorer\quick launch\windows media player.lnk to %APPDATA%\microsoft\internet explorer\quick launch\windows media player.lnk.brick
- from %APPDATA%\microsoft\msdn\7.0\objbrow.dat to %APPDATA%\microsoft\msdn\7.0\objbrow.dat.brick
- from %APPDATA%\microsoft\outlook\outcmd.dat to %APPDATA%\microsoft\outlook\outcmd.dat.brick
- from %APPDATA%\microsoft\outlook\outlook.xml to %APPDATA%\microsoft\outlook\outlook.xml.brick
- from %APPDATA%\microsoft\publisher\pubcmd12.dat to %APPDATA%\microsoft\publisher\pubcmd12.dat.brick
- from %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\blocklist.xml to %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\blocklist.xml.brick
- from %APPDATA%\opera software\opera stable\favorites.db to %APPDATA%\opera software\opera stable\favorites.db.brick
- from %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt to %APPDATA%\opera software\opera stable\opera_shutdown_ms.txt.brick
- from %APPDATA%\opera software\opera stable\thumbnails.db to %APPDATA%\opera software\opera stable\thumbnails.db.brick
- from %APPDATA%\opera software\opera stable\dictionaries\dictionaries.xml to %APPDATA%\opera software\opera stable\dictionaries\dictionaries.xml.brick
- from %APPDATA%\qipguard\chrome.dll to %APPDATA%\qipguard\chrome.dll.brick
- from %APPDATA%\qipguard\qipguard.exe to %APPDATA%\qipguard\qipguard.exe.brick
- from %APPDATA%\qipguard\qipguard_upd.exe to %APPDATA%\qipguard\qipguard_upd.exe.brick
- from %APPDATA%\qipguard\sqlite3.dll to %APPDATA%\qipguard\sqlite3.dll.brick
- from %APPDATA%\telegram desktop\log.txt to %APPDATA%\telegram desktop\log.txt.brick
- from %TEMP%\mirc743.exe to %TEMP%\mirc743.exe.brick
Moves itself
- from <Full path to file> to C:\user\systems\local.exe
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
