Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\cmd\windows\system32\cmd.exe
Malicious functions
Injects code into
the following user processes:
- <File name>.exe
Modifies file system
Creates the following files
- %TEMP%\<File name>.exe
- <Current directory>\1206776.bin
Network activity
Connects to
- 'ma##xx.xyz':80
- 'ch#####.amazonaws.com':80
TCP
HTTP GET requests
- http://ma##xx.xyz/panel/login.php
- http://ma##xx.xyz/panel/bot/check.php?hw#########################################################################################################################################################...
- http://ma##xx.xyz/panel/bot/miner.php?ch#####
- http://ma##xx.xyz/panel/bot/miner.php
- http://ma##xx.xyz/panel/bot/do.php?hw###################
UDP
- DNS ASK ma##xx.xyz
- DNS ASK ch#####.amazonaws.com
Miscellaneous
Creates and executes the following
- '%TEMP%\<File name>.exe'
