Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\xbooster.job
Malicious functions:
Creates and executes the following:
- '%WINDIR%\dshdhddh.exe' -o stratum+tcp://xmr-eu1.nanopool.org:14444 -u 4JUdGzvrMFDWrUUwY3toJATSeNwjn54LkCnKBPRzDuhzi5vSepHfUckJNxRL2gjkNrSqtCoRUrEDAgRwsQvVCjZbRwFRDTx2ydzMSdp6ZD/5 -p x
- '%WINDIR%\dshdhddh.exe' (downloaded from the Internet)
Modifies file system:
Creates the following files:
- %WINDIR%\dshdhddh.exe
Network activity:
Connects to:
- 'xt###ker.club':80
- 's3######st-2.amazonaws.com':80
- 'localhost':1038
TCP:
HTTP GET requests:
- http://xt###ker.club/click.php?cn###############
- http://s3######st-2.amazonaws.com/zminer/NsCpuCNMiner32.exe
UDP:
- DNS ASK xt###ker.club
- DNS ASK s3######st-2.amazonaws.com
