Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\svchost.exe
Malicious functions:
Creates and executes the following:
- '%TEMP%\afolder\expl0rer.exe' -o stratum+tcp://mine.moneropool.com:80 -u 46Lhz9YFVfsSoSqw31iW4w6qqUciUD6WNbVfMxuiNRXUczeZn8LGwvY267GVBPKXPE49fQgDKFPrAAZGe945CvG2KV41mgJ -p x
- '%APPDATA%\csrss.exe'
Executes the following:
- '<SYSTEM32>\attrib.exe' +h %TEMP%\ytmp
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\ytmp\t26855.bat" "%APPDATA%\csrss.exe" "
Modifies file system:
Creates the following files:
- %TEMP%\ytmp\t27008.exe
- %TEMP%\afolder\1509568115_log.txt
- %TEMP%\ytmp\t26855.bat
- %APPDATA%\csrss.exe
- %TEMP%\afolder\expl0rer.exe
Network activity:
Connects to:
- 'mi##.#oneropool.com':80
UDP:
- DNS ASK mi##.#oneropool.com
