VBS_MINELOAD.ASU

October 20, 2017
 Analysis by: Nikko Tamana
 ALIASES:

Application.BitCoinMiner.RD (Bitdefender), Trojan.VBS.CoinMiner (Ikarus), VBS/CoinMiner.FX trojan (NOD32)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size:

261 bytes

File Type:

VBS

Initial Samples Received Date:

18 Oct 2017

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following processes:

  • "{malware path}\msttc.exe" -a cryptonight -o stratum+tcp://pool.m{BLOCKED}r.com:80 -u 4AQe5sAFWZKECiaeNTt59LG7kVtqRoSRJMjrmQ6GiMFAeUvoL3MFeTE6zwwHkFPrAyNw2JHDxUSWL82RiZThPpk4SEg7Vqe -p x --donate-level=1 --max-cpu-usage=90