Trojan.DownLoader10.8593

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Startup' = '%APPDATA%\AudioSoftware\AudioSoftware.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=3260
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4664
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=3560
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=308
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4484
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=3808
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=3160
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4944
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=3540
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=2980
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=2960
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4732
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=5812
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4492
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4592
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=3380
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=3780
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=6092
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=5432
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=3180
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=5092
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4160
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4108
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=3708
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=2564
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=3060
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=5632
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=3680
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=5892
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=5484
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=5424
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=2548
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=5792
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=5932
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=5044
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4764
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4464
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=3860
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=2688
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=3748
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4632
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=5064
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=6012
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=3460
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=2676
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4712
'%APPDATA%\AudioSoftware\coin-miner.exe' -a sha256 -o http://18################itoHAFSTTUeGAciS:x@getwork.mining.eligius.st:8337 -T 83 -l yes
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=5392
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=1144
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=5652
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4412
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=3648
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4040
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4584
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=2644
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=236
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4984
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4544
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=3940
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=6032
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4048
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4612
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=5552
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=5032
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=5524
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=3280
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4692
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=4912
'%APPDATA%\AudioSoftware\coin-miner.exe' /pid=6004
'%APPDATA%\AudioSoftware\coin-miner.exe' (загружен из сети Интернет)