HKTL_BITMINE.SML

This hacking tool may arrive bundled with malware packages as a malware component. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This hacking tool may arrive bundled with malware packages as a malware component.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This hacking tool adds the following folders:

• %AppDataLocal%\Math Problem Solver\cpu
• %User Temp%\ns{random characters 1}.tmp

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It drops the following files:

• %AppDataLocal%\Math Problem Solver\cpu\libcurl-4.dll
• %AppDataLocal%\Math Problem Solver\cpu\pthreadGC2.dll
• %AppDataLocal%\Math Problem Solver\cpu\Solve.exe
• %AppDataLocal%\Math Problem Solver\cpu\zlib1.dll
• %AppDataLocal%\Math Problem Solver\Uninstall.exe
• %Windows%\Tasks\Math Problem Solver CPU.job

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local on Windows Vista and 7.. %Windows% is the Windows folder, which is usually C:\Windows.)

It drops the following component file(s):

• %User Temp%\ns{random characters 1}.tmp\CPUFeatures.dll - deleted afterwards
• %User Temp%\ns{random characters 1}.tmp\ns{random characters}.tmp - deleted afterwards
• %User Temp%\ns{random characters 1}.tmp\nsExec.dll - deleted afterwards
• %User Temp%\ns{random characters 1}.tmp\TaskHelper.dll
• %User Temp%\ns{random characters 1}.tmp\System.dll - deleted afterwards

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It drops and executes the following files:

• %User Temp%\ns{random characters 1}.tmp\power.bat - deleted afterwards

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Autostart Technique

The scheduled task executes the malware every:

• %Windows%\Tasks\Math Problem Solver CPU.job - Runs when idle

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

Other System Modifications

This hacking tool adds the following registry entries:

HKEY_CURRENT_USER\Control Panel\PowerCfg\
PowerPolicies\{next ID}
Description = "Optimized"

HKEY_CURRENT_USER\Control Panel\PowerCfg\
PowerPolicies\{next ID}
Name = "Optimized"

HKEY_CURRENT_USER\Control Panel\PowerCfg\
PowerPolicies\{next ID}
Policies = "{hex values}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Controls Folder\
PowerCfg\PowerPolicies\{next ID}
Policies = "{hex value}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Controls Folder\
PowerCfg\ProcessorPolicies\{next ID}
Policies = "{hex value}"

It adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Math Problem Solver
DisplayName = "Math Problem Solver"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Math Problem Solver
DisplayIcon = "%AppDataLocal%\Math Problem Solver\Uninstall.ico"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Math Problem Solver
UninstallString = "%AppDataLocal%\Math Problem Solver\Uninstall.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Math Problem Solver
NoModify = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Math Problem Solver
NoRepair = 1

Stolen Information

This hacking tool sends the gathered information via HTTP POST to the following URL:

• http://p2pltc.{BLOCKED}ine.org:9327/