Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\updaterwindows
Modifies file system
Creates the following files
- %LOCALAPPDATA%\conhost.exe
- %LOCALAPPDATA%\windowsupdater\phatk121016.cl.tmp
- %LOCALAPPDATA%\windowsupdater\poclbm130302.cl.tmp
- %LOCALAPPDATA%\windowsupdater\poclbm130302geforce 9600 gtv1w256l4.bin.tmp
- %LOCALAPPDATA%\windowsupdater\scrypt130302.cl.tmp
- %LOCALAPPDATA%\windowsupdater\ssleay32.dll.tmp
- %LOCALAPPDATA%\windowsupdater\zlib1.dll.tmp
- %LOCALAPPDATA%\windowsupdater\cgminer.exe.tmp
- %LOCALAPPDATA%\windowsupdater\bitstreams\copying_fpgaminer.tmp
- %LOCALAPPDATA%\windowsupdater\bitstreams\fpgaminer_top_fixed7_197mhz.ncd.tmp
- %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15b1.bit.tmp
- %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15d1.bit.tmp
- %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15d3.bit.tmp
- %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15d4.bin.tmp
- %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15d4.bit.tmp
- %LOCALAPPDATA%\windowsupdater\miner.php.tmp
- %LOCALAPPDATA%\windowsupdater\news.txt.tmp
- %LOCALAPPDATA%\windowsupdater\linux-usb-cgminer.txt.tmp
- %LOCALAPPDATA%\windowsupdater\libusb-1.0.dll.tmp
- %LOCALAPPDATA%\windowsupdater\libssh2.dll.tmp
- %TEMP%\nrfsontawd\ionic.zip.dll
- %TEMP%\updater.zip
- %LOCALAPPDATA%\windowsupdater\api-example.c.tmp
- %LOCALAPPDATA%\windowsupdater\api-example.php.tmp
- %LOCALAPPDATA%\windowsupdater\api.class.tmp
- %LOCALAPPDATA%\windowsupdater\api.java.tmp
- %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15y1.bin.tmp
- %LOCALAPPDATA%\windowsupdater\bitstreams\copying_ztex.tmp
- %LOCALAPPDATA%\windowsupdater\cgminer-fpgaonly.exe.tmp
- %LOCALAPPDATA%\windowsupdater\diakgcn121016.cl.tmp
- %LOCALAPPDATA%\windowsupdater\example.conf.tmp
- %LOCALAPPDATA%\windowsupdater\libcurl.dll.tmp
- %LOCALAPPDATA%\windowsupdater\libeay32.dll.tmp
- %LOCALAPPDATA%\windowsupdater\libidn-11.dll.tmp
- %LOCALAPPDATA%\windowsupdater\librtmp.dll.tmp
- %TEMP%\nrfsontawd\hndvvtjdxh.exe
- %LOCALAPPDATA%\windowsupdater\diablo130302.cl.tmp
- %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15y1.bit.tmp
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\conhost.exe
- %LOCALAPPDATA%\windowsupdater\cgminer.exe
Deletes the following files
- %TEMP%\nrfsontawd\ionic.zip.dll
- %TEMP%\nrfsontawd\hndvvtjdxh.exe
Moves the following files
- from %LOCALAPPDATA%\windowsupdater\api-example.c.tmp to %LOCALAPPDATA%\windowsupdater\api-example.c
- from %LOCALAPPDATA%\windowsupdater\phatk121016.cl.tmp to %LOCALAPPDATA%\windowsupdater\phatk121016.cl
- from %LOCALAPPDATA%\windowsupdater\poclbm130302.cl.tmp to %LOCALAPPDATA%\windowsupdater\poclbm130302.cl
- from %LOCALAPPDATA%\windowsupdater\poclbm130302geforce 9600 gtv1w256l4.bin.tmp to %LOCALAPPDATA%\windowsupdater\poclbm130302geforce 9600 gtv1w256l4.bin
- from %LOCALAPPDATA%\windowsupdater\scrypt130302.cl.tmp to %LOCALAPPDATA%\windowsupdater\scrypt130302.cl
- from %LOCALAPPDATA%\windowsupdater\ssleay32.dll.tmp to %LOCALAPPDATA%\windowsupdater\ssleay32.dll
- from %LOCALAPPDATA%\windowsupdater\zlib1.dll.tmp to %LOCALAPPDATA%\windowsupdater\zlib1.dll
- from %LOCALAPPDATA%\windowsupdater\bitstreams\copying_ztex.tmp to %LOCALAPPDATA%\windowsupdater\bitstreams\copying_ztex
- from %LOCALAPPDATA%\windowsupdater\example.conf.tmp to %LOCALAPPDATA%\windowsupdater\example.conf
- from %LOCALAPPDATA%\windowsupdater\bitstreams\fpgaminer_top_fixed7_197mhz.ncd.tmp to %LOCALAPPDATA%\windowsupdater\bitstreams\fpgaminer_top_fixed7_197mhz.ncd
- from %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15b1.bit.tmp to %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15b1.bit
- from %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15d1.bit.tmp to %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15d1.bit
- from %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15d3.bit.tmp to %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15d3.bit
- from %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15d4.bin.tmp to %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15d4.bin
- from %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15d4.bit.tmp to %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15d4.bit
- from %LOCALAPPDATA%\windowsupdater\news.txt.tmp to %LOCALAPPDATA%\windowsupdater\news.txt
- from %LOCALAPPDATA%\windowsupdater\miner.php.tmp to %LOCALAPPDATA%\windowsupdater\miner.php
- from %LOCALAPPDATA%\windowsupdater\linux-usb-cgminer.txt.tmp to %LOCALAPPDATA%\windowsupdater\linux-usb-cgminer.txt
- from %LOCALAPPDATA%\windowsupdater\libusb-1.0.dll.tmp to %LOCALAPPDATA%\windowsupdater\libusb-1.0.dll
- from %LOCALAPPDATA%\windowsupdater\libssh2.dll.tmp to %LOCALAPPDATA%\windowsupdater\libssh2.dll
- from %LOCALAPPDATA%\windowsupdater\librtmp.dll.tmp to %LOCALAPPDATA%\windowsupdater\librtmp.dll
- from %LOCALAPPDATA%\windowsupdater\libidn-11.dll.tmp to %LOCALAPPDATA%\windowsupdater\libidn-11.dll
- from %LOCALAPPDATA%\windowsupdater\libeay32.dll.tmp to %LOCALAPPDATA%\windowsupdater\libeay32.dll
- from %LOCALAPPDATA%\windowsupdater\libcurl.dll.tmp to %LOCALAPPDATA%\windowsupdater\libcurl.dll
- from %LOCALAPPDATA%\windowsupdater\bitstreams\copying_fpgaminer.tmp to %LOCALAPPDATA%\windowsupdater\bitstreams\copying_fpgaminer
- from %LOCALAPPDATA%\windowsupdater\diakgcn121016.cl.tmp to %LOCALAPPDATA%\windowsupdater\diakgcn121016.cl
- from %LOCALAPPDATA%\windowsupdater\diablo130302.cl.tmp to %LOCALAPPDATA%\windowsupdater\diablo130302.cl
- from %LOCALAPPDATA%\windowsupdater\cgminer.exe.tmp to %LOCALAPPDATA%\windowsupdater\cgminer.exe
- from %LOCALAPPDATA%\windowsupdater\cgminer-fpgaonly.exe.tmp to %LOCALAPPDATA%\windowsupdater\cgminer-fpgaonly.exe
- from %LOCALAPPDATA%\windowsupdater\api.java.tmp to %LOCALAPPDATA%\windowsupdater\api.java
- from %LOCALAPPDATA%\windowsupdater\api.class.tmp to %LOCALAPPDATA%\windowsupdater\api.class
- from %LOCALAPPDATA%\windowsupdater\api-example.php.tmp to %LOCALAPPDATA%\windowsupdater\api-example.php
- from %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15y1.bin.tmp to %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15y1.bin
- from %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15y1.bit.tmp to %LOCALAPPDATA%\windowsupdater\bitstreams\ztex_ufm1_15y1.bit
Network activity
Connects to
- 'me###fire.com':443
- 'microsoft.com':80
TCP
- 'me###fire.com':443
- 'do######1163.mediafire.com':443
- 'do######941.mediafire.com':443
- 'do######1376.mediafire.com':443
UDP
- DNS ASK me###fire.com
- DNS ASK microsoft.com
- DNS ASK do######1163.mediafire.com
- DNS ASK do######941.mediafire.com
- DNS ASK do######1376.mediafire.com
- DNS ASK do######2275.mediafire.com
Miscellaneous
Creates and executes the following
- '%TEMP%\nrfsontawd\hndvvtjdxh.exe'
- '%LOCALAPPDATA%\windowsupdater\cgminer.exe' -o stratum+tcp://ru-west.stratum.slushpool.com:3333 -u enwr -p password
- '%LOCALAPPDATA%\conhost.exe'
- '%LOCALAPPDATA%\conhost.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C schtasks /create /tn \UpdaterWindows /tr %LOCALAPPDATA%\conhost.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
- '<SYSTEM32>\schtasks.exe' /create /tn \UpdaterWindows /tr %LOCALAPPDATA%\conhost.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
- '<SYSTEM32>\taskeng.exe' {E68AA880-287E-416C-8079-CB257E8D1F39} S-1-5-21-1960123792-2022915161-3775307078-1001:pojhejgo\user:Interactive:[1]
