SHA1:
- 8d1b96f1bfc9d353ce1f28d3c92aaed86b970cd7
The second generation of Trojan.BtcMine.1541. Once launched, it copies itself to the C:\ProgramData\ folder under the name Iostream.exe. To provide the autostart, it creates a task in the Windows Scheduler called \\Windows\\Recovery\\Cleaner.
It creates a separate thread and uses it to shut down all running processes called Iostream.exe or processes with the name of its own executable file. In another thread it tracks the list of running processes. If in the system there is a running process called “Taskmgr.exe’, “taskmgr.exe”, “ProcessHacker.exe”, “procexp.exe”, “procmon.exe” or “anvir.exe”, the Trojan shuts down the process “attrib.exe”.
The Trojan launches a separate thread, which tracks the contents of the clipboard. If it determines a presence of a cryptocurrency wallet number in the clipboard, it changes its number to one stored in the Trojan’s body. If the miner’s buyer doesn’t pay for the clipper’s module, the data is replaced with the wallet number of the Trojan’s seller or the malicious program’s author.
Then the Trojan checks the availability of the running process called “attrib.exe”. When it is detected, it shuts down. In case of absence of such process in the list of running ones, the Trojan launches the application C:\Windows\System32\attrib.exe with the flag CREATE_SUSPENDED and embeds into it a modified miner xmrig with launch parameters hard coded into its body.