Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /IM MBAMService.exe /T /F
- '<SYSTEM32>\sc.exe' delete MinerGate
- '<SYSTEM32>\net1.exe' stop MBAMService
- '<SYSTEM32>\net.exe' stop MBAMService
- '<SYSTEM32>\sc.exe' delete swprv
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\2.bat" <Full path to file>"
- '<SYSTEM32>\net1.exe' stop MinerGate
- '<SYSTEM32>\net.exe' stop MinerGate
Modifies file system:
Creates the following files:
- %TEMP%\1.tmp\2.bat
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
