Trojan.DownLoader9.34656

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Startup' = '%APPDATA%\Mining\aa.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%APPDATA%\Mining\coin-miner.exe' /pid=5056
'%APPDATA%\Mining\coin-miner.exe' /pid=3604
'%APPDATA%\Mining\coin-miner.exe' /pid=3324
'%APPDATA%\Mining\coin-miner.exe' /pid=2576
'%APPDATA%\Mining\coin-miner.exe' /pid=4836
'%APPDATA%\Mining\coin-miner.exe' /pid=5416
'%APPDATA%\Mining\coin-miner.exe' /pid=2644
'%APPDATA%\Mining\coin-miner.exe' /pid=3004
'%APPDATA%\Mining\coin-miner.exe' /pid=5116
'%APPDATA%\Mining\coin-miner.exe' /pid=728
'%APPDATA%\Mining\coin-miner.exe' /pid=5344
'%APPDATA%\Mining\coin-miner.exe' /pid=5516
'%APPDATA%\Mining\coin-miner.exe' /pid=4944
'%APPDATA%\Mining\coin-miner.exe' /pid=3644
'%APPDATA%\Mining\coin-miner.exe' /pid=4400
'%APPDATA%\Mining\coin-miner.exe' /pid=2928
'%APPDATA%\Mining\coin-miner.exe' /pid=5724
'%APPDATA%\Mining\coin-miner.exe' /pid=256
'%APPDATA%\Mining\coin-miner.exe' /pid=5884
'%APPDATA%\Mining\coin-miner.exe' /pid=2532
'%APPDATA%\Mining\coin-miner.exe' /pid=2688
'%APPDATA%\Mining\coin-miner.exe' /pid=3104
'%APPDATA%\Mining\coin-miner.exe' /pid=6004
'%APPDATA%\Mining\coin-miner.exe' /pid=5004
'%APPDATA%\Mining\coin-miner.exe' /pid=5504
'%APPDATA%\Mining\coin-miner.exe' /pid=5756
'%APPDATA%\Mining\coin-miner.exe' /pid=3444
'%APPDATA%\Mining\coin-miner.exe' /pid=4420
'%APPDATA%\Mining\coin-miner.exe' /pid=3544
'%APPDATA%\Mining\coin-miner.exe' /pid=4300
'%APPDATA%\Mining\coin-miner.exe' /pid=5796
'%APPDATA%\Mining\coin-miner.exe' /pid=6024
'%APPDATA%\Mining\coin-miner.exe' /pid=2904
'%APPDATA%\Mining\coin-miner.exe' /pid=840
'%APPDATA%\Mining\coin-miner.exe' /pid=6104
'%APPDATA%\Mining\coin-miner.exe' /pid=4004
'%APPDATA%\Mining\coin-miner.exe' /pid=5336
'%APPDATA%\Mining\coin-miner.exe' /pid=3624
'%APPDATA%\Mining\coin-miner.exe' /pid=764
'%APPDATA%\Mining\coin-miner.exe' /pid=5904
'%APPDATA%\Mining\coin-miner.exe' /pid=3724
'%APPDATA%\Mining\coin-miner.exe' /pid=5436
'%APPDATA%\Mining\coin-miner.exe' /pid=5536
'%APPDATA%\Mining\coin-miner.exe' /pid=3224
'%APPDATA%\Mining\coin-miner.exe' /pid=5556
'%APPDATA%\Mining\coin-miner.exe' /pid=4024
'%APPDATA%\Mining\coin-miner.exe' /pid=2804
'%APPDATA%\Mining\coin-miner.exe' /pid=5424
'%APPDATA%\Mining\coin-miner.exe' -a sha256 -o http://sa############celight:light@mint.bitminter.com:8332 -T 83 -l yes -t 1
'%APPDATA%\Mining\coin-miner.exe' /pid=5736
'%APPDATA%\Mining\coin-miner.exe' /pid=4220
'%APPDATA%\Mining\coin-miner.exe' /pid=3812
'%APPDATA%\Mining\coin-miner.exe' /pid=5324
'%APPDATA%\Mining\coin-miner.exe' /pid=4524
'%APPDATA%\Mining\coin-miner.exe' /pid=4636
'%APPDATA%\Mining\coin-miner.exe' /pid=5156
'%APPDATA%\Mining\coin-miner.exe' /pid=4956
'%APPDATA%\Mining\coin-miner.exe' /pid=3824
'%APPDATA%\Mining\coin-miner.exe' /pid=800
'%APPDATA%\Mining\coin-miner.exe' /pid=2760
'%APPDATA%\Mining\coin-miner.exe' /pid=5616
'%APPDATA%\Mining\coin-miner.exe' /pid=3504
'%APPDATA%\Mining\coin-miner.exe' /pid=5036
'%APPDATA%\Mining\coin-miner.exe' /pid=4904
'%APPDATA%\Mining\coin-miner.exe' /pid=5816
'%APPDATA%\Mining\coin-miner.exe' /pid=5916
'%APPDATA%\Mining\coin-miner.exe' /pid=2200
'%APPDATA%\Mining\coin-miner.exe' /pid=6036
'%APPDATA%\Mining\coin-miner.exe' /pid=3144
'%APPDATA%\Mining\coin-miner.exe' /pid=3852
'%APPDATA%\Mining\coin-miner.exe' /pid=5024
'%APPDATA%\Mining\coin-miner.exe' /pid=4824
'%APPDATA%\Mining\coin-miner.exe' (загружен из сети Интернет)