Trojan.DownLoader9.19841

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Startup' = '%APPDATA%\Mining\miner.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%APPDATA%\Mining\coin-miner.exe' /pid=6880
'%APPDATA%\Mining\coin-miner.exe' /pid=7108
'%APPDATA%\Mining\coin-miner.exe' /pid=6868
'%APPDATA%\Mining\coin-miner.exe' /pid=6500
'%APPDATA%\Mining\coin-miner.exe' /pid=6764
'%APPDATA%\Mining\coin-miner.exe' /pid=7388
'%APPDATA%\Mining\coin-miner.exe' /pid=7380
'%APPDATA%\Mining\coin-miner.exe' /pid=7308
'%APPDATA%\Mining\coin-miner.exe' /pid=7428
'%APPDATA%\Mining\coin-miner.exe' /pid=7228
'%APPDATA%\Mining\coin-miner.exe' /pid=7068
'%APPDATA%\Mining\coin-miner.exe' /pid=6648
'%APPDATA%\Mining\coin-miner.exe' /pid=3828
'%APPDATA%\Mining\coin-miner.exe' /pid=1924
'%APPDATA%\Mining\coin-miner.exe' /pid=4780
'%APPDATA%\Mining\coin-miner.exe' /pid=6448
'%APPDATA%\Mining\coin-miner.exe' /pid=5572
'%APPDATA%\Mining\coin-miner.exe' /pid=6180
'%APPDATA%\Mining\coin-miner.exe' /pid=4668
'%APPDATA%\Mining\coin-miner.exe' /pid=1484
'%APPDATA%\Mining\coin-miner.exe' /pid=3976
'%APPDATA%\Mining\coin-miner.exe' /pid=3644
'%APPDATA%\Mining\coin-miner.exe' /pid=4972
'%APPDATA%\Mining\coin-miner.exe' /pid=3044
'%APPDATA%\Mining\coin-miner.exe' /pid=6224
'%APPDATA%\Mining\coin-miner.exe' /pid=6468
'%APPDATA%\Mining\coin-miner.exe' /pid=2756
'%APPDATA%\Mining\coin-miner.exe' /pid=5560
'%APPDATA%\Mining\coin-miner.exe' /pid=5792
'%APPDATA%\Mining\coin-miner.exe' /pid=2844
'%APPDATA%\Mining\coin-miner.exe' /pid=4752
'%APPDATA%\Mining\coin-miner.exe' /pid=5780
'%APPDATA%\Mining\coin-miner.exe' /pid=7780
'%APPDATA%\Mining\coin-miner.exe' /pid=8000
'%APPDATA%\Mining\coin-miner.exe' /pid=8124
'%APPDATA%\Mining\coin-miner.exe' /pid=7608
'%APPDATA%\Mining\coin-miner.exe' /pid=7828
'%APPDATA%\Mining\coin-miner.exe' /pid=8140
'%APPDATA%\Mining\coin-miner.exe' /pid=6348
'%APPDATA%\Mining\coin-miner.exe' /pid=6264
'%APPDATA%\Mining\coin-miner.exe' /pid=6268
'%APPDATA%\Mining\coin-miner.exe' /pid=8184
'%APPDATA%\Mining\coin-miner.exe' /pid=6664
'%APPDATA%\Mining\coin-miner.exe' /pid=6504
'%APPDATA%\Mining\coin-miner.exe' /pid=4700
'%APPDATA%\Mining\coin-miner.exe' /pid=6164
'%APPDATA%\Mining\coin-miner.exe' /pid=4880
'%APPDATA%\Mining\coin-miner.exe' /pid=7060
'%APPDATA%\Mining\coin-miner.exe' /pid=7104
'%APPDATA%\Mining\coin-miner.exe' /pid=6984
'%APPDATA%\Mining\coin-miner.exe' /pid=6444
'%APPDATA%\Mining\coin-miner.exe' /pid=6824
'%APPDATA%\Mining\coin-miner.exe' /pid=3232
'%APPDATA%\Mining\coin-miner.exe' /pid=5580
'%APPDATA%\Mining\coin-miner.exe' /pid=3712
'%APPDATA%\Mining\coin-miner.exe' -a sha256 -o http://14################WMusaGx8DbXLr3mQ:x@getwork.mining.eligius.st:8337 -T 83 -l yes -t 1
'%APPDATA%\Mining\coin-miner.exe' /pid=5980
'%APPDATA%\Mining\coin-miner.exe' /pid=6204
'%APPDATA%\Mining\coin-miner.exe' /pid=5280
'%APPDATA%\Mining\coin-miner.exe' /pid=6324
'%APPDATA%\Mining\coin-miner.exe' /pid=6384
'%APPDATA%\Mining\coin-miner.exe' /pid=5480
'%APPDATA%\Mining\coin-miner.exe' /pid=7284
'%APPDATA%\Mining\coin-miner.exe' /pid=5680
'%APPDATA%\Mining\coin-miner.exe' /pid=6184
'%APPDATA%\Mining\coin-miner.exe' /pid=4316
'%APPDATA%\Mining\coin-miner.exe' /pid=5900
'%APPDATA%\Mining\coin-miner.exe' /pid=2808
'%APPDATA%\Mining\coin-miner.exe' /pid=5080
'%APPDATA%\Mining\coin-miner.exe' /pid=4596
'%APPDATA%\Mining\coin-miner.exe' /pid=5180
'%APPDATA%\Mining\coin-miner.exe' /pid=6304
'%APPDATA%\Mining\coin-miner.exe' /pid=6404
'%APPDATA%\Mining\coin-miner.exe' /pid=7560
'%APPDATA%\Mining\coin-miner.exe' /pid=7604
'%APPDATA%\Mining\coin-miner.exe' /pid=7484
'%APPDATA%\Mining\coin-miner.exe' /pid=7280
'%APPDATA%\Mining\coin-miner.exe' /pid=7424
'%APPDATA%\Mining\coin-miner.exe' /pid=7984
'%APPDATA%\Mining\coin-miner.exe' /pid=8100
'%APPDATA%\Mining\coin-miner.exe' /pid=7944
'%APPDATA%\Mining\coin-miner.exe' /pid=7680
'%APPDATA%\Mining\coin-miner.exe' /pid=7824
'%APPDATA%\Mining\coin-miner.exe' (загружен из сети Интернет)