Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath @($env:userprofile,$env:programdata) -Force"
Injects code into
the following system processes:
- <SYSTEM32>\notepad.exe
- %WINDIR%\explorer.exe
Patches code
in AMSI dll
- explorer.exe process, Amsi.dll module
in NTDLL dll
- explorer.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\th8ab7.tmp
- %ALLUSERSPROFILE%\wildrig.exe
Network activity
Connects to
- 'ak#####arcpacket.com':443
- 'x1.#.lencr.org':80
- 'xm#####.nanopool.org':10343
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'ak#####arcpacket.com':443
- 'xm#####.nanopool.org':10343
UDP
- DNS ASK ak#####arcpacket.com
- DNS ASK x1.#.lencr.org
- DNS ASK xm#####.nanopool.org
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\wildrig.exe' --algo pearlhash --url pool.pearlhash.xyz:9000 --worker test --user prl1plcalsukcg22cp33wvcqt37skd4y4egm37ummk3shqyg9jrdc77jqrhnqmm --pass x --gpu-fan-speed 80 --api-port 21550 --no-color
Executes the following
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\notepad.exe' --encargs 585e011d1b121117581f0004101f4541555e0a520d1e175f1006545c1b120b1d051c0a1e5b1c17154f4255414140455f00535d4b424b26183f250e3a13192b3c420901262f2b3d373646243721220a050c3e5613271c56463710524...
