Technical Information
Malicious functions
Injects code into
the following user processes:
- myphone(32bit).exe
Modifies file system
Creates the following files
- %APPDATA%\myphone\libcurl-4.dll
- %APPDATA%\myphone\libeay32.dll
- %APPDATA%\myphone\libidn-11.dll
- %APPDATA%\myphone\librtmp.dll
- %APPDATA%\myphone\libssh2.dll
- %APPDATA%\myphone\ssleay32.dll
- %APPDATA%\myphone\zlib1.dll
- %APPDATA%\myphone\diablo130302.cl
- %APPDATA%\myphone\diakgcn121016.cl
- %APPDATA%\myphone\phatk121016.cl
- %APPDATA%\myphone\poclbm130302.cl
- %APPDATA%\myphone\scrypt130511.cl
- %APPDATA%\myphone\opencl.dll
- %APPDATA%\myphone\myphone(32bit).exe
- %APPDATA%\myphone\libwinpthread-1.dll
Network activity
TCP
- 'us.###ecoinpool.org':3333
UDP
- DNS ASK us.###ecoinpool.org
Miscellaneous
Creates and executes the following
- '%APPDATA%\myphone\myphone(32bit).exe' -o stratum+tcp://us.litecoinpool.org:3333 -u hackore55.4 -p 4
- '%APPDATA%\myphone\myphone(32bit).exe' --scrypt -o stratum+tcp://us.litecoinpool.org:3333 -u hackore55.4 -p 4
- '%APPDATA%\myphone\myphone(32bit).exe' -o stratum+tcp://us.litecoinpool.org:3333 -u hackore55.4 -p 4' (with hidden window)
- '%APPDATA%\myphone\myphone(32bit).exe' --scrypt -o stratum+tcp://us.litecoinpool.org:3333 -u hackore55.4 -p 4' (with hidden window)
