Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\xbooster.job
Malicious functions:
Creates and executes the following:
- '%WINDIR%\ghjgfsjdgfsh.exe' -o stratum+tcp://xmr-eu1.nanopool.org:14444 -u 4JUdGzvrMFDWrUUwY3toJATSeNwjn54LkCnKBPRzDuhzi5vSepHfUckJNxRL2gjkNrSqtCoRUrEDAgRwsQvVCjZbRwhkbK2uwRj8snedXv/1 -p x
- '%WINDIR%\ghjgfsjdgfsh.exe' (downloaded from the Internet)
Modifies file system:
Creates the following files:
- %WINDIR%\ghjgfsjdgfsh.exe
Network activity:
Connects to:
- 'os##oft.com':80
- 's3######st-2.amazonaws.com':80
- 'localhost':1037
TCP:
HTTP GET requests:
- http://os##oft.com/console/visit.php
- http://s3######st-2.amazonaws.com/zminer/NsCpuCNMiner32.exe
UDP:
- DNS ASK os##oft.com
- DNS ASK s3######st-2.amazonaws.com
