Trojan.DownLoader10.24538

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Startup' = '%APPDATA%\Mining\gqq.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%APPDATA%\Mining\coin-miner.exe' /pid=5952
'%APPDATA%\Mining\coin-miner.exe' /pid=2980
'%APPDATA%\Mining\coin-miner.exe' /pid=920
'%APPDATA%\Mining\coin-miner.exe' /pid=4684
'%APPDATA%\Mining\coin-miner.exe' /pid=5652
'%APPDATA%\Mining\coin-miner.exe' /pid=2776
'%APPDATA%\Mining\coin-miner.exe' /pid=3468
'%APPDATA%\Mining\coin-miner.exe' /pid=5512
'%APPDATA%\Mining\coin-miner.exe' /pid=3688
'%APPDATA%\Mining\coin-miner.exe' /pid=856
'%APPDATA%\Mining\coin-miner.exe' /pid=368
'%APPDATA%\Mining\coin-miner.exe' /pid=4804
'%APPDATA%\Mining\coin-miner.exe' /pid=4704
'%APPDATA%\Mining\coin-miner.exe' /pid=5012
'%APPDATA%\Mining\coin-miner.exe' /pid=4080
'%APPDATA%\Mining\coin-miner.exe' /pid=3960
'%APPDATA%\Mining\coin-miner.exe' /pid=4284
'%APPDATA%\Mining\coin-miner.exe' /pid=6084
'%APPDATA%\Mining\coin-miner.exe' /pid=5884
'%APPDATA%\Mining\coin-miner.exe' /pid=728
'%APPDATA%\Mining\coin-miner.exe' /pid=808
'%APPDATA%\Mining\coin-miner.exe' /pid=3448
'%APPDATA%\Mining\coin-miner.exe' /pid=1432
'%APPDATA%\Mining\coin-miner.exe' /pid=5624
'%APPDATA%\Mining\coin-miner.exe' /pid=5232
'%APPDATA%\Mining\coin-miner.exe' /pid=3336
'%APPDATA%\Mining\coin-miner.exe' /pid=3348
'%APPDATA%\Mining\coin-miner.exe' /pid=4712
'%APPDATA%\Mining\coin-miner.exe' /pid=1468
'%APPDATA%\Mining\coin-miner.exe' /pid=5832
'%APPDATA%\Mining\coin-miner.exe' /pid=3188
'%APPDATA%\Mining\coin-miner.exe' /pid=5764
'%APPDATA%\Mining\coin-miner.exe' /pid=4512
'%APPDATA%\Mining\coin-miner.exe' /pid=5864
'%APPDATA%\Mining\coin-miner.exe' /pid=5592
'%APPDATA%\Mining\coin-miner.exe' /pid=5804
'%APPDATA%\Mining\coin-miner.exe' /pid=5252
'%APPDATA%\Mining\coin-miner.exe' /pid=6032
'%APPDATA%\Mining\coin-miner.exe' /pid=5472
'%APPDATA%\Mining\coin-miner.exe' /pid=2840
'%APPDATA%\Mining\coin-miner.exe' /pid=2752
'%APPDATA%\Mining\coin-miner.exe' /pid=5492
'%APPDATA%\Mining\coin-miner.exe' /pid=3196
'%APPDATA%\Mining\coin-miner.exe' /pid=5132
'%APPDATA%\Mining\coin-miner.exe' /pid=3068
'%APPDATA%\Mining\coin-miner.exe' /pid=4204
'%APPDATA%\Mining\coin-miner.exe' /pid=2452
'%APPDATA%\Mining\coin-miner.exe' /pid=3980
'%APPDATA%\Mining\coin-miner.exe' /pid=2848
'%APPDATA%\Mining\coin-miner.exe' /pid=4632
'%APPDATA%\Mining\coin-miner.exe' /pid=4412
'%APPDATA%\Mining\coin-miner.exe' /pid=4932
'%APPDATA%\Mining\coin-miner.exe' /pid=3924
'%APPDATA%\Mining\coin-miner.exe' /pid=5104
'%APPDATA%\Mining\coin-miner.exe' -a sha256 -o http://14################b1woCPo9s8G5Q9uc:x@getwork.mining.eligius.st:8337 -T 83 -l yes -t 1
'%APPDATA%\Mining\coin-miner.exe' /pid=5112
'%APPDATA%\Mining\coin-miner.exe' /pid=3568
'%APPDATA%\Mining\coin-miner.exe' /pid=4404
'%APPDATA%\Mining\coin-miner.exe' /pid=5612
'%APPDATA%\Mining\coin-miner.exe' /pid=5024
'%APPDATA%\Mining\coin-miner.exe' /pid=5204
'%APPDATA%\Mining\coin-miner.exe' /pid=4824
'%APPDATA%\Mining\coin-miner.exe' /pid=3268
'%APPDATA%\Mining\coin-miner.exe' /pid=640
'%APPDATA%\Mining\coin-miner.exe' /pid=4432
'%APPDATA%\Mining\coin-miner.exe' /pid=2880
'%APPDATA%\Mining\coin-miner.exe' /pid=4104
'%APPDATA%\Mining\coin-miner.exe' /pid=956
'%APPDATA%\Mining\coin-miner.exe' /pid=4732
'%APPDATA%\Mining\coin-miner.exe' /pid=4624
'%APPDATA%\Mining\coin-miner.exe' /pid=3368
'%APPDATA%\Mining\coin-miner.exe' /pid=5092
'%APPDATA%\Mining\coin-miner.exe' /pid=5164
'%APPDATA%\Mining\coin-miner.exe' /pid=5312
'%APPDATA%\Mining\coin-miner.exe' /pid=3868
'%APPDATA%\Mining\coin-miner.exe' /pid=3768
'%APPDATA%\Mining\coin-miner.exe' /pid=3044
'%APPDATA%\Mining\coin-miner.exe' /pid=1616
'%APPDATA%\Mining\coin-miner.exe' /pid=5484
'%APPDATA%\Mining\coin-miner.exe' /pid=5572
'%APPDATA%\Mining\coin-miner.exe' /pid=5672
'%APPDATA%\Mining\coin-miner.exe' (загружен из сети Интернет)