Coinminer.BAT.VIPOR.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• wmic cpu get numberofcores^|findstr "^[0-9] → retrieve the number of CPU cores in the system.
• Antivirus.exe --disable-gpu --algorithm verushash --pool sa.vipor.net:5040 --wallet {wallet id}.Sub4 -p x -t %num% → coinmining capabilities
• ping -n 2 localhost
• ping -n 240 localhost
• tasklist /NH /FI "imagename eq tskmgr.exe" → enumerate running tasks
• taskkill /IM Antivirus.exe /F

Datendiebstahl

Folgende Daten werden gesammelt:

• Number of CPU cores
• Current Running Tasks

Andere Details

Es macht Folgendes:

• It terminates itself if only one CPU core was found in the system.
• It terminates itself if task manager is found running in the system.
• It connects to a remote mining pool:
  • {BLOCKED}or.net:5040