Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\ati.vbs
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\ChannelFace] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ChannelFace] 'ImagePath' = 'cmd /c start %ALLUSERSPROFILE%\adobe\winvc.vbs'
- [<HKLM>\System\CurrentControlSet\Services\AhannelFace] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\AhannelFace] 'ImagePath' = 'cmd /c start %ALLUSERSPROFILE%\adobe\winvd.vbs'
Creates the following services
- 'ChannelFace' cmd /c start %ALLUSERSPROFILE%\adobe\winvc.vbs
- 'AhannelFace' cmd /c start %ALLUSERSPROFILE%\adobe\winvd.vbs
Modifies file system
Creates the following files
- %WINDIR%\system\<File name>.exe
- %ALLUSERSPROFILE%\libgmp-10.dll
- %ALLUSERSPROFILE%\libjansson-4.dll
- %ALLUSERSPROFILE%\libeay32.dll
- %ALLUSERSPROFILE%\zlib1.dll
- %ALLUSERSPROFILE%\libwinpthread-1.dll
- %ALLUSERSPROFILE%\libstdc++-6.dll
- %ALLUSERSPROFILE%\libgcc_s_seh-1.dll
- %ALLUSERSPROFILE%\libcurl-4.dll
- %ALLUSERSPROFILE%\libcrypto-1_1-x64.dll
- %WINDIR%\syswow64\cmd.manifest
- %ALLUSERSPROFILE%\atixxc.manifest
- %ALLUSERSPROFILE%\ativsi.manifest
- %ALLUSERSPROFILE%\adobe\winvc.vbs
- %WINDIR%\system\atixxc.exe
- %ALLUSERSPROFILE%\atixxc.exe
- %ALLUSERSPROFILE%\ativsi.exe
- %ALLUSERSPROFILE%\adobe\winvd.vbs
Network activity
TCP
- 'hu#.###ingpoolhub.com':20543
UDP
- DNS ASK hu#.###ingpoolhub.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'ativsi.exe'
- ClassName: '' WindowName: 'atixxc.exe'
- ClassName: '' WindowName: 'atiscr.exe'
Creates and executes the following
- '%ALLUSERSPROFILE%\atixxc.exe'
- '%ALLUSERSPROFILE%\ativsi.exe' -a yescrypt -o stratum+tcp://hub.miningpoolhub.com:20543 -u a999apple99.7 -p x
- '%WINDIR%\syswow64\cmd.exe' /c sc Create AhannelFace binPath= "cmd /c start %ALLUSERSPROFILE%\adobe\winvd.vbs" type= own type= interact start= auto' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc Create ChannelFace binPath= "cmd /c start %ALLUSERSPROFILE%\adobe\winvc.vbs" type= own type= interact start= auto' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "%ALLUSERSPROFILE%\ativsi.exe " -a yescrypt -o stratum+tcp://hub.miningpoolhub.com:20543 -u a999apple99.7 -p x' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c sc Create AhannelFace binPath= "cmd /c start %ALLUSERSPROFILE%\adobe\winvd.vbs" type= own type= interact start= auto
- '%WINDIR%\syswow64\cmd.exe' /c sc Create ChannelFace binPath= "cmd /c start %ALLUSERSPROFILE%\adobe\winvc.vbs" type= own type= interact start= auto
- '%WINDIR%\syswow64\cmd.exe' /c "%ALLUSERSPROFILE%\ativsi.exe " -a yescrypt -o stratum+tcp://hub.miningpoolhub.com:20543 -u a999apple99.7 -p x
- '%WINDIR%\syswow64\sc.exe' Create ChannelFace binPath= "cmd /c start %ALLUSERSPROFILE%\adobe\winvc.vbs" type= own type= interact start= auto
- '%WINDIR%\syswow64\sc.exe' Create AhannelFace binPath= "cmd /c start %ALLUSERSPROFILE%\adobe\winvd.vbs" type= own type= interact start= auto
