Technical Information
Malicious functions:
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' -o stratum+tcp://xmr.pool.minergate.com:45560 -u kuzmin13371488@gmail.com -p x -k -t 2
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe' /logtoconsole=false /logfile= /u "<Full path to file>"
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Network activity:
Connects to:
- 'xm#.###l.minergate.com':45560
UDP:
- DNS ASK xm#.###l.minergate.com
