Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, rundll32 %TEMP%\d3dx11_19.dll Call_WinLoacal_LPE'
Malicious functions:
Creates and executes the following:
- '%ALLUSERSPROFILE%\Application Data\bitcoin_bot.exe'
Executes the following:
- '<SYSTEM32>\rundll32.exe' "%TEMP%\d3dx11_19.dll",Call_WinLoacal_LPE
Modifies file system:
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\bitcoin_bot.exe
- %TEMP%\d3dx11_19.dll
Moves the following files:
- from %TEMP%\d3dx11_19.dll to %TEMP%\d3dx11_19.dll
Network activity:
Connects to:
- 'go###sta.top':80
TCP:
HTTP POST requests:
- http://go###sta.top/includes/tasks.php
UDP:
- DNS ASK go###sta.top
