Technical Information
Malicious functions:
Creates and executes the following:
- '%HOMEPATH%\My Documents\my32.exe' (downloaded from the Internet)
Executes the following:
- '%HOMEPATH%\My Documents\my32.exe' -o stratum+tcp://get.bi-chi.com:5555 -u 42nJ6KYdJ5Pb7UZBfygmGJgkU9dUoeDVi16Y5g139B1TP6FceZjgFkoNwSJRbH6HpfAfWgDiZPqQNVB5JuGGgUGU6jwY5YE -p x
Modifies file system:
Creates the following files:
- %HOMEPATH%\My Documents\my32.exe
Network activity:
Connects to:
- '12#.#49.76.25':80
TCP:
HTTP GET requests:
- http://12#.#49.76.25/32.exe
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'my32.exe'
