Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Support

Ihre Anfragen

Rufen Sie uns an

+7 (495) 789-45-86

Profil

Trojan.BtcMine.3360

Added to the Dr.Web virus database: 2019-09-11

Virus description added:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '敮啪汍桙䝷' = '㩃停潲牧浡慄慴䵜捩潲潳瑦坜湩潤獷卜慴瑲䴠湥屵牐杯慲獭卜慴瑲灵瑜票祎奂攮數'
  • [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '祢杴䉉楤剌' = '㩣坜湩潤獷卜獹整㍭尲獰剆扇⹑硥e'
  • [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '奪啵佅摴奉' = '㩃停潲牧浡慄慴䵜捩潲潳瑦坜湩潤獷卜慴瑲䴠湥屵牐杯慲獭卜慴瑲灵䕜坧呖佚攮數'
  • [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '慣橏䝸捅獃' = '㩣坜湩潤獷卜獹整㍭尲䥃䝍卯⹂硥e'
  • [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '穂塚䍬楷瑇' = '㩃停潲牧浡慄慴䵜捩潲潳瑦坜湩潤獷卜慴瑲䴠湥屵牐杯慲獭卜慴瑲灵硜买兦啨攮數'
  • [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '瑓䭔瑢奎湭' = '㩣坜湩潤獷卜獹整㍭尲瑃捡充⹧硥e'
  • [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '䕖捤䩶捬䕍' = '㩃停潲牧浡慄慴䵜捩潲潳瑦坜湩潤獷卜慴瑲䴠湥屵牐杯慲獭卜慴瑲灵䱜睌䭁瑏攮數'
  • [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '桁湐填摙捴' = '㩣坜湩潤獷卜獹整㍭尲灣敓䙚⹶硥e'
  • [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '瑅捧摆扭䉹' = '㩃停潲牧浡慄慴䵜捩潲潳瑦坜湩潤獷卜慴瑲䴠湥屵牐杯慲獭卜慴瑲灵奜歙䙏䵺攮數'
  • [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '婋䝭敶䵥塗' = '㩣坜湩潤獷卜獹整㍭尲䡓硳剂⹃硥e'
  • [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '瑧祐䉂捺穆' = '㩣坜湩潤獷卜獹整㍭尲摘䱎䍳⹨硥e'
  • [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '潭湑扱桯瑤' = '㩃停潲牧浡慄慴䵜捩潲潳瑦坜湩潤獷卜慴瑲䴠湥屵牐杯慲獭卜慴瑲灵睜橒坸䥴攮數'
  • [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '䩪剱䝏䕫偊' = '㩃停潲牧浡慄慴䵜捩潲潳瑦坜湩潤獷卜慴瑲䴠湥屵牐杯慲獭卜慴瑲灵潜䉧潴呗攮數'
  • [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '晫䥏睈剈汷' = '㩣坜湩潤獷卜獹整㍭尲䍳癍器⹍硥e'
  • [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '䭈兇奲兩䱱' = '㩣坜湩潤獷卜獹整㍭尲䵦畗煤⹴硥e'
  • [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '牆䝃䵎硙煄' = '㩣坜湩潤獷卜獹整㍭尲硱晵女⹮硥e'
  • [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '䑂塕䅄剒摐' = '㩃停潲牧浡慄慴䵜捩潲潳瑦坜湩潤獷卜慴瑲䴠湥屵牐杯慲獭卜慴瑲灵作䕒湕潑攮數'
Modifies file system
Creates the following files
  • %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\thynyby.exe
  • <SYSTEM32>\psfrgbq.exe
  • %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\egwvtzo.exe
  • <SYSTEM32>\cimgosb.exe
  • %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\xpnfqhu.exe
  • <SYSTEM32>\ctaceqg.exe
  • %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\llwakot.exe
  • <SYSTEM32>\cpsezfv.exe
  • %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\yykofzm.exe
  • <SYSTEM32>\shsxbrc.exe
  • <SYSTEM32>\xdnlsch.exe
  • %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\wrjxwti.exe
  • %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\ogbtowt.exe
  • <SYSTEM32>\scmvhvm.exe
  • <SYSTEM32>\fmwudqt.exe
  • <SYSTEM32>\qxufsyn.exe
  • %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\oreunqo.exe
Network activity
UDP
  • DNS ASK w.###kin.host
  • DNS ASK co####ad.github.com
  • DNS ASK ra#.####ubusercontent.com
  • DNS ASK ap###rror.com

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android