Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\UsersControl.lnk
Malicious functions:
Creates and executes the following:
- 'C:\ProgramData\system32\CrashHandlerService.exe'
- 'C:\ProgramData\system32\UsersControl.exe'
Modifies file system:
Creates the following files:
- C:\ProgramData\system32\CrashHandlerService.exe
- C:\ProgramData\system32\UsersControl.exe
- C:\ProgramData\system32\config.json
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
Sets the 'hidden' attribute to the following files:
- C:\ProgramData\system32\UsersControl.exe
- C:\ProgramData\system32\CrashHandlerService.exe
- C:\ProgramData\system32\config.json
Deletes the following files:
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
Network activity:
Connects to:
- 'xm#.###l.minergate.com':45560
UDP:
- DNS ASK xm#.###l.minergate.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
