Trojan.DownLoader9.47635

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '%APPDATA%\Host Process\vsvchost.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%APPDATA%\Host Process\svchost.exe' /pid=4112
'%APPDATA%\Host Process\svchost.exe' /pid=4292
'%APPDATA%\Host Process\svchost.exe' /pid=4812
'%APPDATA%\Host Process\svchost.exe' /pid=4792
'%APPDATA%\Host Process\svchost.exe' /pid=4592
'%APPDATA%\Host Process\svchost.exe' /pid=4384
'%APPDATA%\Host Process\svchost.exe' /pid=3744
'%APPDATA%\Host Process\svchost.exe' /pid=3592
'%APPDATA%\Host Process\svchost.exe' /pid=3844
'%APPDATA%\Host Process\svchost.exe' /pid=5544
'%APPDATA%\Host Process\svchost.exe' /pid=4532
'%APPDATA%\Host Process\svchost.exe' /pid=128
'%APPDATA%\Host Process\svchost.exe' /pid=4864
'%APPDATA%\Host Process\svchost.exe' /pid=4932
'%APPDATA%\Host Process\svchost.exe' /pid=5012
'%APPDATA%\Host Process\svchost.exe' /pid=5892
'%APPDATA%\Host Process\svchost.exe' /pid=5844
'%APPDATA%\Host Process\svchost.exe' /pid=5812
'%APPDATA%\Host Process\svchost.exe' /pid=4344
'%APPDATA%\Host Process\svchost.exe' /pid=728
'%APPDATA%\Host Process\svchost.exe' /pid=5764
'%APPDATA%\Host Process\svchost.exe' /pid=6104
'%APPDATA%\Host Process\svchost.exe' /pid=1392
'%APPDATA%\Host Process\svchost.exe' /pid=2940
'%APPDATA%\Host Process\svchost.exe' /pid=5084
'%APPDATA%\Host Process\svchost.exe' /pid=5164
'%APPDATA%\Host Process\svchost.exe' /pid=3440
'%APPDATA%\Host Process\svchost.exe' /pid=5584
'%APPDATA%\Host Process\svchost.exe' /pid=4212
'%APPDATA%\Host Process\svchost.exe' /pid=3508
'%APPDATA%\Host Process\svchost.exe' /pid=5592
'%APPDATA%\Host Process\svchost.exe' /pid=5572
'%APPDATA%\Host Process\svchost.exe' /pid=4092
'%APPDATA%\Host Process\svchost.exe' /pid=1732
'%APPDATA%\Host Process\svchost.exe' /pid=4484
'%APPDATA%\Host Process\svchost.exe' /pid=3200
'%APPDATA%\Host Process\svchost.exe' /pid=6064
'%APPDATA%\Host Process\svchost.exe' /pid=3100
'%APPDATA%\Host Process\svchost.exe' /pid=3120
'%APPDATA%\Host Process\svchost.exe' /pid=2640
'%APPDATA%\Host Process\svchost.exe' /pid=3624
'%APPDATA%\Host Process\svchost.exe' /pid=2508
'%APPDATA%\Host Process\svchost.exe' /pid=5064
'%APPDATA%\Host Process\svchost.exe' /pid=5984
'%APPDATA%\Host Process\svchost.exe' /pid=232
'%APPDATA%\Host Process\svchost.exe' /pid=5264
'%APPDATA%\Host Process\svchost.exe' /pid=4564
'%APPDATA%\Host Process\svchost.exe' /pid=804
'%APPDATA%\Host Process\svchost.exe' /pid=5912
'%APPDATA%\Host Process\svchost.exe' -a sha256 -o http://sk############aol.com:imirish90@pool.50btc.com:8332 -T 90 -l yes -t 2
'%APPDATA%\Host Process\svchost.exe' /pid=2080
'%APPDATA%\Host Process\svchost.exe' /pid=5692
'%APPDATA%\Host Process\svchost.exe' /pid=4512
'%APPDATA%\Host Process\svchost.exe' /pid=4312
'%APPDATA%\Host Process\svchost.exe' /pid=5392
'%APPDATA%\Host Process\svchost.exe' /pid=4912
'%APPDATA%\Host Process\svchost.exe' /pid=3832
'%APPDATA%\Host Process\svchost.exe' /pid=5072
'%APPDATA%\Host Process\svchost.exe' /pid=5672
'%APPDATA%\Host Process\svchost.exe' /pid=4692
'%APPDATA%\Host Process\svchost.exe' /pid=352
'%APPDATA%\Host Process\svchost.exe' /pid=3420
'%APPDATA%\Host Process\svchost.exe' /pid=5484
'%APPDATA%\Host Process\svchost.exe' /pid=3724
'%APPDATA%\Host Process\svchost.exe' /pid=2520
'%APPDATA%\Host Process\svchost.exe' /pid=4832
'%APPDATA%\Host Process\svchost.exe' /pid=2708
'%APPDATA%\Host Process\svchost.exe' /pid=6012
'%APPDATA%\Host Process\svchost.exe' /pid=5944
'%APPDATA%\Host Process\svchost.exe' /pid=6084
'%APPDATA%\Host Process\svchost.exe' /pid=5992
'%APPDATA%\Host Process\svchost.exe' /pid=5192
'%APPDATA%\Host Process\svchost.exe' /pid=3732
'%APPDATA%\Host Process\svchost.exe' /pid=4612
'%APPDATA%\Host Process\svchost.exe' (загружен из сети Интернет)