Technical Information
Malicious functions:
Injects code into
the following user processes:
- svchost.exe
Modifies file system:
Creates the following files:
- %TEMP%\svchost.exe
- %TEMP%\bitcoin-0.15.1-win64-setup.exe
- %TEMP%\nsy2.tmp
- %TEMP%\nst3.tmp\System.dll
Miscellaneous:
Creates and executes the following:
- '%TEMP%\svchost.exe'
- '%TEMP%\bitcoin-0.15.1-win64-setup.exe'
