Trojan.DownLoader9.34425

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Startup' = '%APPDATA%\Mining\MicrosoftUpdater.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%APPDATA%\Mining\coin-miner.exe' /pid=3272
'%APPDATA%\Mining\coin-miner.exe' /pid=2748
'%APPDATA%\Mining\coin-miner.exe' /pid=4896
'%APPDATA%\Mining\coin-miner.exe' /pid=3200
'%APPDATA%\Mining\coin-miner.exe' /pid=5236
'%APPDATA%\Mining\coin-miner.exe' /pid=4648
'%APPDATA%\Mining\coin-miner.exe' /pid=3904
'%APPDATA%\Mining\coin-miner.exe' /pid=2132
'%APPDATA%\Mining\coin-miner.exe' /pid=2960
'%APPDATA%\Mining\coin-miner.exe' /pid=1472
'%APPDATA%\Mining\coin-miner.exe' /pid=5428
'%APPDATA%\Mining\coin-miner.exe' /pid=5796
'%APPDATA%\Mining\coin-miner.exe' /pid=5776
'%APPDATA%\Mining\coin-miner.exe' /pid=5628
'%APPDATA%\Mining\coin-miner.exe' /pid=5528
'%APPDATA%\Mining\coin-miner.exe' /pid=4612
'%APPDATA%\Mining\coin-miner.exe' /pid=5668
'%APPDATA%\Mining\coin-miner.exe' /pid=4412
'%APPDATA%\Mining\coin-miner.exe' /pid=5248
'%APPDATA%\Mining\coin-miner.exe' /pid=5376
'%APPDATA%\Mining\coin-miner.exe' /pid=3464
'%APPDATA%\Mining\coin-miner.exe' /pid=2980
'%APPDATA%\Mining\coin-miner.exe' /pid=4228
'%APPDATA%\Mining\coin-miner.exe' /pid=2652
'%APPDATA%\Mining\coin-miner.exe' /pid=5328
'%APPDATA%\Mining\coin-miner.exe' /pid=5748
'%APPDATA%\Mining\coin-miner.exe' /pid=4168
'%APPDATA%\Mining\coin-miner.exe' /pid=5416
'%APPDATA%\Mining\coin-miner.exe' /pid=5396
'%APPDATA%\Mining\coin-miner.exe' /pid=4432
'%APPDATA%\Mining\coin-miner.exe' /pid=2148
'%APPDATA%\Mining\coin-miner.exe' /pid=4936
'%APPDATA%\Mining\coin-miner.exe' /pid=2560
'%APPDATA%\Mining\coin-miner.exe' /pid=5868
'%APPDATA%\Mining\coin-miner.exe' /pid=5468
'%APPDATA%\Mining\coin-miner.exe' /pid=6072
'%APPDATA%\Mining\coin-miner.exe' /pid=5116
'%APPDATA%\Mining\coin-miner.exe' /pid=5976
'%APPDATA%\Mining\coin-miner.exe' /pid=3832
'%APPDATA%\Mining\coin-miner.exe' /pid=5516
'%APPDATA%\Mining\coin-miner.exe' /pid=5168
'%APPDATA%\Mining\coin-miner.exe' /pid=4240
'%APPDATA%\Mining\coin-miner.exe' /pid=1900
'%APPDATA%\Mining\coin-miner.exe' /pid=2632
'%APPDATA%\Mining\coin-miner.exe' /pid=5448
'%APPDATA%\Mining\coin-miner.exe' /pid=5148
'%APPDATA%\Mining\coin-miner.exe' /pid=6080
'%APPDATA%\Mining\coin-miner.exe' /pid=5016
'%APPDATA%\Mining\coin-miner.exe' /pid=4512
'%APPDATA%\Mining\coin-miner.exe' -a sha256 -o http://ca##############l.com_GPU:flamereaper@pit.deepbit.net:8332 -T 83 -l yes -t 1
'%APPDATA%\Mining\coin-miner.exe' /pid=5216
'%APPDATA%\Mining\coin-miner.exe' /pid=4148
'%APPDATA%\Mining\coin-miner.exe' /pid=5256
'%APPDATA%\Mining\coin-miner.exe' /pid=3444
'%APPDATA%\Mining\coin-miner.exe' /pid=3372
'%APPDATA%\Mining\coin-miner.exe' /pid=2204
'%APPDATA%\Mining\coin-miner.exe' /pid=5436
'%APPDATA%\Mining\coin-miner.exe' /pid=6020
'%APPDATA%\Mining\coin-miner.exe' /pid=4260
'%APPDATA%\Mining\coin-miner.exe' /pid=1648
'%APPDATA%\Mining\coin-miner.exe' /pid=756
'%APPDATA%\Mining\coin-miner.exe' /pid=5696
'%APPDATA%\Mining\coin-miner.exe' /pid=4320
'%APPDATA%\Mining\coin-miner.exe' /pid=2140
'%APPDATA%\Mining\coin-miner.exe' /pid=5496
'%APPDATA%\Mining\coin-miner.exe' /pid=6032
'%APPDATA%\Mining\coin-miner.exe' /pid=3232
'%APPDATA%\Mining\coin-miner.exe' /pid=5548
'%APPDATA%\Mining\coin-miner.exe' /pid=5648
'%APPDATA%\Mining\coin-miner.exe' /pid=4392
'%APPDATA%\Mining\coin-miner.exe' /pid=2872
'%APPDATA%\Mining\coin-miner.exe' /pid=324
'%APPDATA%\Mining\coin-miner.exe' /pid=4308
'%APPDATA%\Mining\coin-miner.exe' /pid=3384
'%APPDATA%\Mining\coin-miner.exe' (загружен из сети Интернет)