Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SystemDataSync_8ef96dcf' = '"%LOCALAPPDATA%\SystemMonitoring\DataSyncHost.exe"'
Malicious functions
Creates and executes the following
- '<Full path to file>' (downloaded from the Internet)
Modifies file system
Creates the following files
- %LOCALAPPDATA%\tcwnw\nbgtpasrg.exe
- %LOCALAPPDATA%\systemmonitoring\datasynchost.exe
Network activity
Connects to
- '17#.#6.152.62':5858
TCP
HTTP GET requests
- http://17#.##.152.62:5858/d2a3db0fe2ac476e8ca876f8c23ba92f_miner.exe via 17#.#6.152.62
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\tcwnw\nbgtpasrg.exe'
- '%LOCALAPPDATA%\systemmonitoring\datasynchost.exe'
