Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'ADSL Dial' = '<Full path to file>'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '<File name>.exe' = '<Full path to file>'
Modifies file system:
Creates the following files:
- <Current directory>\svchsot.exe
Network activity:
Connects to:
- 's.###v586.cc':80
- 'xm#.#2pool.com':13531
TCP:
HTTP GET requests:
- http://s.###v586.cc/1.txt
UDP:
- DNS ASK s.###v586.cc
- DNS ASK xm#.#2pool.com
Miscellaneous:
Creates and executes the following:
- '<Current directory>\svchsot.exe' --max-cpu-usage 85 --cpu-priority 3 -o xmr.f2pool.com:13531 -u 4LYWaNAqVLsD2BoEqi64szTFV64R8xz7QPhxgHFeDrrPU5nii5uWGXh128UUYXayQHFUrjojugSByAyf2VHatc9gLDtn6LAmyhbCFFfuWB.xh -p x -k -t 1 --donat...
