Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\Manager.job
- %WINDIR%\Tasks\explorer.job
Modifies file system:
Creates the following files:
- %TEMP%\1.tmp.zip
- %APPDATA%\xbooster\Manager.exe
- %APPDATA%\xbooster\xmrig.exe
Network activity:
Connects to:
- 'qt##cker.tk':80
- 'xm#####.nanopool.org':14444
TCP:
HTTP GET requests:
- http://qt##cker.tk/click.php?cn######
UDP:
- DNS ASK qt##cker.tk
- DNS ASK xm#####.nanopool.org
Miscellaneous:
Creates and executes the following:
- '%APPDATA%\xbooster\xmrig.exe' -o stratum+tcp://xmr-eu1.nanopool.org:14444 -u 41ompKc8rx9eEXtAAm6RJTTm6jg8p6v3y33UqLMsUJS3gdUh739yf7ThiSVzsU4me7hbtVB61rf7EAVsJeRJKGQH4LFi3hR/39 -p x --donate-level=1 -B -t 1
