Trojan.DownLoader9.43401

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Audio' = '%APPDATA%\Audio\CreativeSound.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5848
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=4288
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=3412
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=2860
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=1736
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=1148
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=2684
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5828
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=3876
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=3272
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=2940
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5068
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5608
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5488
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=1472
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5048
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=4896
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=4868
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=1488
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5456
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5116
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=4448
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=3924
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=3172
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5796
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=4948
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=4668
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=4648
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=3340
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=3080
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=6076
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=2856
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5168
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5268
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5896
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=1308
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=4568
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=3392
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=3796
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=2832
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=4816
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5196
'%APPDATA%\Audio\CreativeSpeaker.exe' -a sha256 -g no -o stratum.mining.eligius.st:3334 -u 18G7T7y49swTUSXLRUtirUF9UD2FyiKNhP -p x -t 2
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=768
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5276
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=2724
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=4064
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=3816
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5616
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=3996
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5736
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=4264
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=304
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5928
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=4016
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5396
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5508
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5596
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=4516
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=2524
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=4416
'%APPDATA%\Audio\CreativeSpeaker.exe' /pid=5588
'<SYSTEM32>\cmd.exe' (загружен из сети Интернет)
'%APPDATA%\Audio\CreativeSpeaker.exe' (загружен из сети Интернет)