Coinminer.Win64.MALXMR.TIAOODCV

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor" /v "AutoRun" /f.
• sc stop clr_optimization_v4.0.30328_64
• sc delete clr_optimization_v4.0.30328_64
• sc stop PrApp
• sc delete PrApp
• sc stop TrustedInstaller
• sc delete TrustedInstaller
• sc stop MicrosoftMsql
• sc delete MicrosoftMsql
• sc stop Workstation
• sc delete Workstation
• sc stop csrss
• sc delete csrss
• sc stop RegSvc
• sc delete RegSvc
• taskkill /f /im csrss.exe
• %System%\Wbem\WMIC.exe wmic process where "name='LDE.exe' and ExecutablePath='%System Root%\ProgramData\WinTcpAutoProxySvc\LDE.exe'" call Terminate
• %System%\Wbem\WMIC.exe wmic process where "name='taskmgr.exe' and ExecutablePath='%System Root%\Windows\Temp\locales\taskmgr.exe'" call Terminate
• sc stop WinTcpAutoProxySvc
• sc delete WinTcpAutoProxySvc
• sc stop WmSrv
• sc delete WmSrv
• %System%\Wbem\WMIC.exe wmic process where "name='myminer.exe' and ExecutablePath='%System Root%\Windows\temp\winstart\myminer.exe'" call Terminate
• sc stop Servc
• sc delete Servc
• %System%\Wbem\WMIC.exe wmic process where "name='systems.exe' and ExecutablePath='%System Root%\Windows\debug\NAT\systems.exe'" call Terminate
• %System%\Wbem\WMIC.exe wmic process where "name='TrustedInsteller.exe' and ExecutablePath='%System Root%\Program Files\Common Files\Services\TrustedInsteller.exe'" call Terminate
• sc stop Microsoft.NET_Framework_NGEN
• sc delete Microsoft.NET_Framework_NGEN
• %System%\Wbem\WMIC.exe wmic process where "name='svchost.exe' and ExecutablePath='%System Root%\ProgramData\vmicvess\svchost.exe'" call Terminate
• sc stop vmicvess
• sc delete vmicvess
• %System%\Wbem\WMIC.exe wmic process where "name='svchost.exe' and ExecutablePath='%System Root%\Windows\SysWOW64\inetsrv\102\svchost.exe'" call Terminate
• %System%\Wbem\WMIC.exe wmic process where "name='systems.exe' and ExecutablePath='%System Root%\Windows\debug\nat\systems.exe'" call Terminate
• sc stop smtpsvrch
• sc delete smtpsvrch
• sc stop smtpsvrZy
• sc delete smtpsvrZy
• taskkill /f /im flbrowser.exe
• taskkill /f /im \xe2\x96\x93\xce\x93\xe2\x95\xa9\xe2\x95\x98\xe2\x95\x98\xe2\x94\x82\xe2\x95\x90\xc2\xb0\xe2\x94\xac\xcf\x84\xe2\x95\x9d\xce\xb1\xe2\x96\x93\xce\x93.exe
• taskkill /f /im zy.exe
• taskkill /f /im Clean.exe
• sc stop sqlservice
• sc delete sqlservice
• sc stop taskmrg
• sc delete taskmrg
• %System%\Wbem\WMIC.exe wmic process where "name='service.exe' and ExecutablePath='%System Root%\Windows\data\service.exe'" call Terminate
• %System%\Wbem\WMIC.exe wmic process where "name='dllhostex.exe' and ExecutablePath='%System Root%\windows\system32\dllhostex.exe'" call Terminate
• %System%\Wbem\WMIC.exe wmic process where "name='xqwkhyc.exe' and ExecutablePath='%System Root%\Windows\hyc\xqwkhyc.exe'" call Terminate
• sc stop nat
• sc delete nat
• %System%\Wbem\WMIC.exe wmic process where "name='explorer.exe' and ExecutablePath='%System Root%\windows\debug\nat\explorer.exe'" call Terminate
• %System%\Wbem\WMIC.exe wmic process where "name='java.exe' and ExecutablePath='%System Root%\windows\java\java.exe'" call Terminate
• taskkill /f /t /im sqlservr.exe
• %System%\Wbem\WMIC.exe wmic process where "name='sqlservr.exe' and ExecutablePath='%System Root%\Windows\Fonts\sqlservr.exe'" call Terminate

(Hinweis: %System Root% ist der Stammordner, normalerweise C:\. Dort befindet sich auch das Betriebssystem.)

Erstellt die folgenden Ordner:

• %Fonts%\sqlservr.exe