Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\Onedrive.lnk
Malicious functions:
Executes the following:
- '<SYSTEM32>\calc.exe' -o pool.supportxmr.com:3333 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQmHRikz4oTMLGafjV9 -p ProXMRminer --max-cpu-usage=50 --donate-level=1 -k ...
Injects code into
the following system processes:
- <SYSTEM32>\calc.exe
Modifies file system:
Creates the following files:
- %TEMP%\LZMA.DLL
Network activity:
Connects to:
- 'po##.#upportxmr.com':3333
UDP:
- DNS ASK po##.#upportxmr.com
