Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'NVIDIA GeForce Experience' = '<Full path to file>'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NVIDIA GeForce Experience' = '<Full path to file>'
Malicious functions
To complicate detection of its presence in the operating system,
modifies the following system settings:
- DNS server to '<DNS_SERVER>'
- DNS server to '114.114.114.114'
Modifies file system
Creates the following files
- %PROGRAMDATA%\wmiprvsefileassoc.exe
Sets the 'hidden' attribute to the following files
- <Full path to file>
Deletes the following files
- %PROGRAMDATA%\wmiprvsefileassoc.exe
Substitutes the following files
- %PROGRAMDATA%\wmiprvsefileassoc.exe
Network activity
Connects to
- 'localhost':19490
- 'tx####inggreat.top':443
- 'mi##.c3pool.com':13333
UDP
- DNS ASK tx####inggreat.top
- DNS ASK mi##.c3pool.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'ÈÎÎñ¹ÜÀГÆ÷'
- ClassName: '' WindowName: 'タスクマネージャ'
- ClassName: '' WindowName: 'windowsタスクマネージャ'
- ClassName: '' WindowName: 'operaation johtaja'
- ClassName: '' WindowName: 'Диспетчер задач'
- ClassName: '' WindowName: 'ikkunat teht?v?n johtaja'
- ClassName: '' WindowName: 'windows 작업 관리자менеджер задач windowsВ '
- ClassName: '' WindowName: 'ВҐВїВҐВ№ВҐВЇВҐГћВҐГЌВ©`ВҐВёВҐГЈ'
- ClassName: '' WindowName: '작업 관리자'
- ClassName: '' WindowName: 'windowsВҐВїВҐВ№ВҐВЇВҐГћВҐГЌВ©`ВҐВёВҐГЈ'
- ClassName: '' WindowName: '§¥§Ú§ã§á§Ö§ä§é§Ö§â §Ù§Ñ§Õ§Ñ§é'
- ClassName: '' WindowName: '防火墙'
- ClassName: '' WindowName: 'Process Explorer'
- ClassName: '' WindowName: '工作管理員'
- ClassName: '' WindowName: '·À»ðǽ'
- ClassName: '' WindowName: 'windows工作管理員'
- ClassName: '' WindowName: '¹¤×÷¹ÜÀÆT'
- ClassName: '' WindowName: 'windows¹¤×÷¹ÜÀÆT'
- ClassName: '' WindowName: 'Manager'
- ClassName: '' WindowName: '急救箱'
- ClassName: '' WindowName: 'Windows Task Manager'
- ClassName: '' WindowName: '网络流量'
- ClassName: '' WindowName: '¼±¾ÈÏä'
- ClassName: '' WindowName: 'ÍøÂçÁ÷Á¿'
- ClassName: '' WindowName: '资源监视器'
- ClassName: '' WindowName: 'Task Manager'
- ClassName: '' WindowName: 'Windows 任务管理器'
- ClassName: '' WindowName: '×ÊÔ´¼à ÊÓÆ÷'
- ClassName: '' WindowName: '任务管理器'
- ClassName: '' WindowName: 'Windows ÈÎÎñ¹ÜÀГÆ÷'
- ClassName: '' WindowName: 'ผู้จัดการงาน'
- ClassName: '' WindowName: 'ikkunat tehtävän johtaja'
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /flushdns&&exit' (with hidden window)
- '%PROGRAMDATA%\wmiprvsefileassoc.exe' -o stratum+tcp://mine.c3pool.com:13333 -u 49LxcDj6At2Xv7Tj1C3BhHTqaeWhU2iNFMsD7rJdf4TuiAxBdSHWfBrHwc42ZJTN1LTMjvF725VvEgrgnJyBYvEj3incvNo -p CPU --max-cpu-usage=25 -K' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /flushdns&&exit
- '%WINDIR%\syswow64\ipconfig.exe' /flushdns
