Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Startup' = '%APPDATA%\Mining\MicrosoftUpdater.exe'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\Mining\coin-miner.exe' /pid=5000
- '%APPDATA%\Mining\coin-miner.exe' /pid=5460
- '%APPDATA%\Mining\coin-miner.exe' /pid=4700
- '%APPDATA%\Mining\coin-miner.exe' /pid=4500
- '%APPDATA%\Mining\coin-miner.exe' /pid=6108
- '%APPDATA%\Mining\coin-miner.exe' /pid=2516
- '%APPDATA%\Mining\coin-miner.exe' /pid=560
- '%APPDATA%\Mining\coin-miner.exe' /pid=956
- '%APPDATA%\Mining\coin-miner.exe' /pid=4100
- '%APPDATA%\Mining\coin-miner.exe' /pid=2828
- '%APPDATA%\Mining\coin-miner.exe' /pid=1404
- '%APPDATA%\Mining\coin-miner.exe' /pid=5188
- '%APPDATA%\Mining\coin-miner.exe' /pid=5408
- '%APPDATA%\Mining\coin-miner.exe' /pid=2788
- '%APPDATA%\Mining\coin-miner.exe' /pid=3716
- '%APPDATA%\Mining\coin-miner.exe' /pid=5428
- '%APPDATA%\Mining\coin-miner.exe' /pid=4640
- '%APPDATA%\Mining\coin-miner.exe' /pid=4928
- '%APPDATA%\Mining\coin-miner.exe' /pid=1464
- '%APPDATA%\Mining\coin-miner.exe' /pid=4888
- '%APPDATA%\Mining\coin-miner.exe' /pid=4108
- '%APPDATA%\Mining\coin-miner.exe' /pid=3828
- '%APPDATA%\Mining\coin-miner.exe' /pid=436
- '%APPDATA%\Mining\coin-miner.exe' /pid=3688
- '%APPDATA%\Mining\coin-miner.exe' /pid=2140
- '%APPDATA%\Mining\coin-miner.exe' /pid=6100
- '%APPDATA%\Mining\coin-miner.exe' /pid=2512
- '%APPDATA%\Mining\coin-miner.exe' /pid=3156
- '%APPDATA%\Mining\coin-miner.exe' /pid=3428
- '%APPDATA%\Mining\coin-miner.exe' /pid=6084
- '%APPDATA%\Mining\coin-miner.exe' /pid=484
- '%APPDATA%\Mining\coin-miner.exe' /pid=4520
- '%APPDATA%\Mining\coin-miner.exe' /pid=4720
- '%APPDATA%\Mining\coin-miner.exe' /pid=492
- '%APPDATA%\Mining\coin-miner.exe' /pid=2908
- '%APPDATA%\Mining\coin-miner.exe' /pid=5288
- '%APPDATA%\Mining\coin-miner.exe' /pid=5448
- '%APPDATA%\Mining\coin-miner.exe' /pid=2808
- '%APPDATA%\Mining\coin-miner.exe' /pid=6124
- '%APPDATA%\Mining\coin-miner.exe' /pid=5268
- '%APPDATA%\Mining\coin-miner.exe' /pid=3208
- '%APPDATA%\Mining\coin-miner.exe' /pid=2240
- '%APPDATA%\Mining\coin-miner.exe' /pid=2888
- '%APPDATA%\Mining\coin-miner.exe' /pid=3508
- '%APPDATA%\Mining\coin-miner.exe' /pid=5008
- '%APPDATA%\Mining\coin-miner.exe' /pid=5804
- '%APPDATA%\Mining\coin-miner.exe' /pid=5904
- '%APPDATA%\Mining\coin-miner.exe' -a sha256 -o http://ca###############.com_slave:flamereaper66@pit.deepbit.net:8332 -T 83 -l yes -t 1
- '%APPDATA%\Mining\coin-miner.exe' /pid=5388
- '%APPDATA%\Mining\coin-miner.exe' /pid=4908
- '%APPDATA%\Mining\coin-miner.exe' /pid=6044
- '%APPDATA%\Mining\coin-miner.exe' /pid=5964
- '%APPDATA%\Mining\coin-miner.exe' /pid=5844
- '%APPDATA%\Mining\coin-miner.exe' /pid=4128
- '%APPDATA%\Mining\coin-miner.exe' /pid=2284
- '%APPDATA%\Mining\coin-miner.exe' /pid=2364
- '%APPDATA%\Mining\coin-miner.exe' /pid=5980
- '%APPDATA%\Mining\coin-miner.exe' /pid=3656
- '%APPDATA%\Mining\coin-miner.exe' /pid=4408
- '%APPDATA%\Mining\coin-miner.exe' /pid=4588
- '%APPDATA%\Mining\coin-miner.exe' /pid=1896
- '%APPDATA%\Mining\coin-miner.exe' /pid=5680
- '%APPDATA%\Mining\coin-miner.exe' /pid=2716
- '%APPDATA%\Mining\coin-miner.exe' /pid=5100
- '%APPDATA%\Mining\coin-miner.exe' /pid=5020
- '%APPDATA%\Mining\coin-miner.exe' /pid=4120
- '%APPDATA%\Mining\coin-miner.exe' /pid=5824
- '%APPDATA%\Mining\coin-miner.exe' /pid=6068
- '%APPDATA%\Mining\coin-miner.exe' /pid=5888
- '%APPDATA%\Mining\coin-miner.exe' /pid=5540
- '%APPDATA%\Mining\coin-miner.exe' (downloaded from the Internet)
Modifies file system :
Creates the following files:
- %APPDATA%\Mining\coin-miner.exe
Moves itself:
- from <Full path to virus> to %APPDATA%\Mining\MicrosoftUpdater.exe
Network activity:
Connects to:
- 'my####emshake.info':80
- 'wp#d':80
TCP:
HTTP GET requests:
- my####emshake.info/UFA.exe
- wp#d/wpad.dat
UDP:
- DNS ASK my####emshake.info
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
