Backdoor Andromeda – svchost.exe – 8eb4071bd2a883e651740fdee4e5efbb

Backdoor Andromeda
Also known as: Trojan Generic, Worm Gamarue
SHA256: 5312290ecb959ad9359288264905fc9f9ae972496a73fa74f501ccc686b0110d
SHA1: beeb1f5eeecd39aac873dfad0172ed08409640e7
MD5: 8eb4071bd2a883e651740fdee4e5efbb
File size: 246222 bytes

Created files:

%AllUsersProfile%\svchost.exe – Backdoor Andromeda

Backdoor Andromeda created autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched: %AllUsersProfile%\svchost.exe