Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\Adobe Acrobat.exe
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
the following user processes:
- Adobe Acrobat.exe
Network activity:
Connects to:
- 'po##.#inexmr.com':5555
UDP:
- DNS ASK po##.#inexmr.com
Miscellaneous:
Creates and executes the following:
- '%HOMEPATH%\Start Menu\Programs\Startup\Adobe Acrobat.exe'
Executes the following:
- '<SYSTEM32>\svchost.exe' -o pool.minexmr.com:5555 -u 434PuVPN5tQ6xQA7pdB7NsNTJHWvUD5tL7rmsX7uzJgNdCAx7wo4yESiy51aqCcr13ZoYb3TFq3zw11BFQJiF1tnHibZ6EA -p x -v 0 -t 2
