Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'ADSL Dial' = '<Full path to file>'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\SA3282] 'ImagePath' = '%TEMP%\VE2jaao.sys'
Malicious functions:
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtCreateThread, handler: unknown
- NtProtectVirtualMemory, handler: unknown
Modifies file system:
Creates the following files:
- %TEMP%\VE2jaao.sys
- <Current directory>\VMwarec.exe
- <Current directory>\VMware.exe
- <Current directory>\smss.bat
Sets the 'hidden' attribute to the following files:
- <Full path to file>
- %TEMP%\VE2jaao.sys
- <Current directory>\VMware.exe
- <Current directory>\smss.bat
- <Current directory>\VMwarec.exe
Deletes the following files:
- %TEMP%\VE2jaao.sys
Network activity:
Connects to:
- '12#.#25.114.144':80
- 'mi##.ppxxmr.com':3333
TCP:
HTTP GET requests:
- http://www.ba##u.com/ via 12#.#25.114.144
UDP:
- DNS ASK www.ba##u.com
- DNS ASK mi##.ppxxmr.com
Miscellaneous:
Creates and executes the following:
- '<Current directory>\VMwarec.exe'
- '<Current directory>\VMware.exe' -a cryptonight -o stratum+tcp://111.111.111.1:3333 -u 44UGwLdFrLBU67GoR4VmWXCX9U56hnX6mPMJrtBefhZZHZgFRSKN6fJFu4ow4PUsqRe4eAjqhsaay9vi36ozaCct6ZxWCSG+001 -p x --donate-level=1
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""<Current directory>\smss.bat" "
