Trojan.DownLoader10.41150

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'AdobeSystems' = '%APPDATA%\AdobeSystems\Loader.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=3060
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=4084
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=4748
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=5476
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=4828
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=5576
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=4536
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=4636
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=5988
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=5896
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=4576
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=2520
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=4268
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=728
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=5668
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=4176
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=4248
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=3804
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=5488
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=5876
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=5228
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=6008
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=4052
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=5468
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=6108
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=500
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=5016
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=4656
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=2664
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=3180
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=760
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=2868
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' -a scrypt -g no -o http://19#.##.60.92:8337 -u Continuum.machine -p x -t 8
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=2800
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=4556
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=2652
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=4956
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=5268
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=3148
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=4836
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=4356
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=3380
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=6096
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=272
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=3984
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=3480
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' /pid=5596
'<SYSTEM32>\cmd.exe' (загружен из сети Интернет)
'%APPDATA%\AdobeSystems\Adobe_Flash_Player_2.6.1.exe' (загружен из сети Интернет)