Trojan.DownLoader10.1408

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Startup' = '%APPDATA%\Mining\Far Cry 3.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%APPDATA%\Mining\coin-miner.exe' /pid=4832
'%APPDATA%\Mining\coin-miner.exe' /pid=4952
'%APPDATA%\Mining\coin-miner.exe' /pid=4368
'%APPDATA%\Mining\coin-miner.exe' /pid=2744
'%APPDATA%\Mining\coin-miner.exe' /pid=5024
'%APPDATA%\Mining\coin-miner.exe' /pid=5092
'%APPDATA%\Mining\coin-miner.exe' /pid=3520
'%APPDATA%\Mining\coin-miner.exe' /pid=3804
'%APPDATA%\Mining\coin-miner.exe' /pid=4468
'%APPDATA%\Mining\coin-miner.exe' /pid=5632
'%APPDATA%\Mining\coin-miner.exe' /pid=5612
'%APPDATA%\Mining\coin-miner.exe' /pid=4280
'%APPDATA%\Mining\coin-miner.exe' /pid=5264
'%APPDATA%\Mining\coin-miner.exe' /pid=2772
'%APPDATA%\Mining\coin-miner.exe' /pid=6012
'%APPDATA%\Mining\coin-miner.exe' /pid=5424
'%APPDATA%\Mining\coin-miner.exe' /pid=5344
'%APPDATA%\Mining\coin-miner.exe' /pid=4180
'%APPDATA%\Mining\coin-miner.exe' /pid=5272
'%APPDATA%\Mining\coin-miner.exe' /pid=5352
'%APPDATA%\Mining\coin-miner.exe' /pid=5364
'%APPDATA%\Mining\coin-miner.exe' /pid=5832
'%APPDATA%\Mining\coin-miner.exe' /pid=728
'%APPDATA%\Mining\coin-miner.exe' /pid=2560
'%APPDATA%\Mining\coin-miner.exe' /pid=5724
'%APPDATA%\Mining\coin-miner.exe' /pid=5124
'%APPDATA%\Mining\coin-miner.exe' /pid=800
'%APPDATA%\Mining\coin-miner.exe' /pid=4684
'%APPDATA%\Mining\coin-miner.exe' /pid=5744
'%APPDATA%\Mining\coin-miner.exe' /pid=5332
'%APPDATA%\Mining\coin-miner.exe' /pid=4100
'%APPDATA%\Mining\coin-miner.exe' /pid=3624
'%APPDATA%\Mining\coin-miner.exe' /pid=5232
'%APPDATA%\Mining\coin-miner.exe' /pid=5172
'%APPDATA%\Mining\coin-miner.exe' /pid=2520
'%APPDATA%\Mining\coin-miner.exe' /pid=5004
'%APPDATA%\Mining\coin-miner.exe' /pid=5532
'%APPDATA%\Mining\coin-miner.exe' /pid=1496
'%APPDATA%\Mining\coin-miner.exe' /pid=3020
'%APPDATA%\Mining\coin-miner.exe' /pid=2920
'%APPDATA%\Mining\coin-miner.exe' /pid=4904
'%APPDATA%\Mining\coin-miner.exe' /pid=4752
'%APPDATA%\Mining\coin-miner.exe' /pid=4600
'%APPDATA%\Mining\coin-miner.exe' /pid=3128
'%APPDATA%\Mining\coin-miner.exe' /pid=3220
'%APPDATA%\Mining\coin-miner.exe' /pid=5104
'%APPDATA%\Mining\coin-miner.exe' /pid=6004
'%APPDATA%\Mining\coin-miner.exe' -a sha256 -o http://1N###############NuRC3gaJ4XkHUbhhk:x@getwork.mining.eligius.st :8337 -T 83 -l yes -t 1
'%APPDATA%\Mining\coin-miner.exe' /pid=5112
'%APPDATA%\Mining\coin-miner.exe' /pid=4548
'%APPDATA%\Mining\coin-miner.exe' /pid=5152
'%APPDATA%\Mining\coin-miner.exe' /pid=988
'%APPDATA%\Mining\coin-miner.exe' /pid=4108
'%APPDATA%\Mining\coin-miner.exe' /pid=5432
'%APPDATA%\Mining\coin-miner.exe' /pid=4044
'%APPDATA%\Mining\coin-miner.exe' /pid=4528
'%APPDATA%\Mining\coin-miner.exe' /pid=4268
'%APPDATA%\Mining\coin-miner.exe' /pid=4852
'%APPDATA%\Mining\coin-miner.exe' /pid=3300
'%APPDATA%\Mining\coin-miner.exe' /pid=4620
'%APPDATA%\Mining\coin-miner.exe' /pid=5032
'%APPDATA%\Mining\coin-miner.exe' /pid=3544
'%APPDATA%\Mining\coin-miner.exe' /pid=5244
'%APPDATA%\Mining\coin-miner.exe' /pid=5932
'%APPDATA%\Mining\coin-miner.exe' /pid=2572
'%APPDATA%\Mining\coin-miner.exe' /pid=5544
'%APPDATA%\Mining\coin-miner.exe' /pid=3140
'%APPDATA%\Mining\coin-miner.exe' /pid=4628
'%APPDATA%\Mining\coin-miner.exe' /pid=6032
'%APPDATA%\Mining\coin-miner.exe' /pid=5984
'%APPDATA%\Mining\coin-miner.exe' (загружен из сети Интернет)