Tool.BtcMine.150

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Visual C++ Redistributable 2010 - x64' = '%APPDATA%\vc_redist(x64).exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%APPDATA%\mine.exe' 1

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\mine[2].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\mine[2].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mine[3].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\mine[3].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\mine[3].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\mine[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\mine[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\mine[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\mine[2].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mine[2].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\mine[5].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mine[5].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\mine[5].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mine[6].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\mine[5].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mine[4].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\mine[3].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\mine[4].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\mine[4].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\mine[4].php
%APPDATA%\mine\ssleay32.dll
%APPDATA%\mine\libssh2.dll
%APPDATA%\mine\zlib1.dll
%APPDATA%\mine\bitstreams\COPYING_fpgaminer
%APPDATA%\mine\poclbm130302Intel(R) HD Graphics 4000gv1w256l4.bin
%APPDATA%\mine\libcurl-4.dll
%APPDATA%\mine.exe
%APPDATA%\mine\libeay32.dll
%APPDATA%\mine\librtmp.dll
%APPDATA%\mine\libidn-11.dll
%APPDATA%\mine\MCast.class
%APPDATA%\mine\API.class
%APPDATA%\mine\bitstreams\fpgaminer_top_fixed7_197MHz.ncd
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mine[1].php
%APPDATA%\mine\svchost.exe
%APPDATA%\mine\diakgcn121016.cl
%APPDATA%\mine\diablo130302.cl
%APPDATA%\mine\phatk121016.cl
%APPDATA%\mine\scrypt130511.cl
%APPDATA%\mine\poclbm130302.cl

Удаляет следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\mine[2].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\mine[2].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\mine[2].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\mine[3].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mine[3].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\mine[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mine[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\mine[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mine[2].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\mine[1].php

Самоперемещается: