Trojan.DownLoader9.22232

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Startup' = '%APPDATA%\Mining\Mining.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%APPDATA%\Mining\coin-miner.exe' /pid=5368
'%APPDATA%\Mining\coin-miner.exe' /pid=4928
'%APPDATA%\Mining\coin-miner.exe' /pid=4324
'%APPDATA%\Mining\coin-miner.exe' /pid=5028
'%APPDATA%\Mining\coin-miner.exe' /pid=4728
'%APPDATA%\Mining\coin-miner.exe' /pid=6140
'%APPDATA%\Mining\coin-miner.exe' /pid=5828
'%APPDATA%\Mining\coin-miner.exe' /pid=5328
'%APPDATA%\Mining\coin-miner.exe' /pid=5976
'%APPDATA%\Mining\coin-miner.exe' /pid=3140
'%APPDATA%\Mining\coin-miner.exe' /pid=1488
'%APPDATA%\Mining\coin-miner.exe' /pid=5836
'%APPDATA%\Mining\coin-miner.exe' /pid=2300
'%APPDATA%\Mining\coin-miner.exe' /pid=3120
'%APPDATA%\Mining\coin-miner.exe' /pid=4040
'%APPDATA%\Mining\coin-miner.exe' /pid=4464
'%APPDATA%\Mining\coin-miner.exe' /pid=4160
'%APPDATA%\Mining\coin-miner.exe' /pid=3400
'%APPDATA%\Mining\coin-miner.exe' /pid=5048
'%APPDATA%\Mining\coin-miner.exe' /pid=6080
'%APPDATA%\Mining\coin-miner.exe' /pid=2820
'%APPDATA%\Mining\coin-miner.exe' /pid=4168
'%APPDATA%\Mining\coin-miner.exe' /pid=5880
'%APPDATA%\Mining\coin-miner.exe' /pid=5568
'%APPDATA%\Mining\coin-miner.exe' /pid=1240
'%APPDATA%\Mining\coin-miner.exe' /pid=5944
'%APPDATA%\Mining\coin-miner.exe' /pid=2940
'%APPDATA%\Mining\coin-miner.exe' /pid=5076
'%APPDATA%\Mining\coin-miner.exe' /pid=2700
'%APPDATA%\Mining\coin-miner.exe' /pid=6116
'%APPDATA%\Mining\coin-miner.exe' /pid=4856
'%APPDATA%\Mining\coin-miner.exe' /pid=4668
'%APPDATA%\Mining\coin-miner.exe' /pid=6076
'%APPDATA%\Mining\coin-miner.exe' /pid=2404
'%APPDATA%\Mining\coin-miner.exe' /pid=2572
'%APPDATA%\Mining\coin-miner.exe' /pid=4968
'%APPDATA%\Mining\coin-miner.exe' /pid=4676
'%APPDATA%\Mining\coin-miner.exe' /pid=2840
'%APPDATA%\Mining\coin-miner.exe' /pid=5456
'%APPDATA%\Mining\coin-miner.exe' /pid=4976
'%APPDATA%\Mining\coin-miner.exe' /pid=3660
'%APPDATA%\Mining\coin-miner.exe' /pid=3860
'%APPDATA%\Mining\coin-miner.exe' /pid=6104
'%APPDATA%\Mining\coin-miner.exe' /pid=2720
'%APPDATA%\Mining\coin-miner.exe' /pid=5656
'%APPDATA%\Mining\coin-miner.exe' /pid=5900
'%APPDATA%\Mining\coin-miner.exe' /pid=4472
'%APPDATA%\Mining\coin-miner.exe' -a sha256 -o http://li#############ncure:lijencura@eu.triplemining.com:8344 -T 83 -l yes -t 1
'%APPDATA%\Mining\coin-miner.exe' /pid=6060
'%APPDATA%\Mining\coin-miner.exe' /pid=5676
'%APPDATA%\Mining\coin-miner.exe' /pid=4656
'%APPDATA%\Mining\coin-miner.exe' /pid=2340
'%APPDATA%\Mining\coin-miner.exe' /pid=1392
'%APPDATA%\Mining\coin-miner.exe' /pid=2416
'%APPDATA%\Mining\coin-miner.exe' /pid=4956
'%APPDATA%\Mining\coin-miner.exe' /pid=4552
'%APPDATA%\Mining\coin-miner.exe' /pid=5376
'%APPDATA%\Mining\coin-miner.exe' /pid=1280
'%APPDATA%\Mining\coin-miner.exe' /pid=728
'%APPDATA%\Mining\coin-miner.exe' /pid=5856
'%APPDATA%\Mining\coin-miner.exe' /pid=4776
'%APPDATA%\Mining\coin-miner.exe' /pid=5256
'%APPDATA%\Mining\coin-miner.exe' /pid=5576
'%APPDATA%\Mining\coin-miner.exe' /pid=5248
'%APPDATA%\Mining\coin-miner.exe' /pid=6020
'%APPDATA%\Mining\coin-miner.exe' /pid=3208
'%APPDATA%\Mining\coin-miner.exe' /pid=5348
'%APPDATA%\Mining\coin-miner.exe' /pid=5936
'%APPDATA%\Mining\coin-miner.exe' /pid=2564
'%APPDATA%\Mining\coin-miner.exe' /pid=5648
'%APPDATA%\Mining\coin-miner.exe' /pid=3048
'%APPDATA%\Mining\coin-miner.exe' (загружен из сети Интернет)