Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Registry.exe' = '%TEMP%\tmp1.tmp.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'audiodriver' = '%APPDATA%\coolbro\Loader.exe'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5272
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5472
- '%APPDATA%\coolbro\UFASoft.exe' /pid=1540
- '%APPDATA%\coolbro\UFASoft.exe' /pid=4796
- '%APPDATA%\coolbro\UFASoft.exe' /pid=2852
- '%APPDATA%\coolbro\UFASoft.exe' /pid=4868
- '%APPDATA%\coolbro\UFASoft.exe' /pid=3380
- '%APPDATA%\coolbro\UFASoft.exe' /pid=3200
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5532
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5720
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5732
- '%APPDATA%\coolbro\UFASoft.exe' /pid=4736
- '%APPDATA%\coolbro\UFASoft.exe' /pid=3320
- '%APPDATA%\coolbro\UFASoft.exe' /pid=2132
- '%APPDATA%\coolbro\UFASoft.exe' /pid=3144
- '%APPDATA%\coolbro\UFASoft.exe' /pid=4416
- '%APPDATA%\coolbro\UFASoft.exe' /pid=2840
- '%APPDATA%\coolbro\UFASoft.exe' /pid=6072
- '%APPDATA%\coolbro\UFASoft.exe' /pid=3520
- '%APPDATA%\coolbro\UFASoft.exe' /pid=4040
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5120
- '%APPDATA%\coolbro\UFASoft.exe' /pid=3300
- '%APPDATA%\coolbro\UFASoft.exe' /pid=6188
- '%APPDATA%\coolbro\UFASoft.exe' /pid=6332
- '%APPDATA%\coolbro\UFASoft.exe' /pid=6176
- '%APPDATA%\coolbro\UFASoft.exe' /pid=924
- '%APPDATA%\coolbro\UFASoft.exe' /pid=2560
- '%APPDATA%\coolbro\UFASoft.exe' /pid=6388
- '%APPDATA%\coolbro\UFASoft.exe' /pid=6848
- '%APPDATA%\coolbro\UFASoft.exe' /pid=6892
- '%APPDATA%\coolbro\UFASoft.exe' /pid=6792
- '%APPDATA%\coolbro\UFASoft.exe' /pid=6552
- '%APPDATA%\coolbro\UFASoft.exe' /pid=6652
- '%APPDATA%\coolbro\UFASoft.exe' /pid=6032
- '%APPDATA%\coolbro\UFASoft.exe' /pid=1016
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5680
- '%APPDATA%\coolbro\UFASoft.exe' /pid=4288
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5020
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5192
- '%APPDATA%\coolbro\UFASoft.exe' /pid=6052
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5092
- '%APPDATA%\coolbro\UFASoft.exe' /pid=2892
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5460
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5712
- '%APPDATA%\coolbro\UFASoft.exe' /pid=772
- '%APPDATA%\coolbro\UFASoft.exe' /pid=2644
- '%APPDATA%\coolbro\UFASoft.exe' /pid=4972
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5000
- '%APPDATA%\coolbro\UFASoft.exe' /pid=4568
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5200
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5780
- '%APPDATA%\coolbro\UFASoft.exe' /pid=4436
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5432
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5540
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5372
- '%APPDATA%\coolbro\UFASoft.exe' /pid=3420
- '%APPDATA%\coolbro\UFASoft.exe' /pid=6012
- '%APPDATA%\coolbro\UFASoft.exe' /pid=3728
- '%APPDATA%\coolbro\UFASoft.exe' /pid=4668
- '%APPDATA%\12164307721209541778434321872.exe'
- '%APPDATA%\coolbro\UFASoft.exe' -a scrypt -g no -o http://mi##.#ool-x.eu:8080 -u hustler.1 -p x -t 1
- '%APPDATA%\coolbro\UFASoft.exe' /pid=2996
- '%APPDATA%\coolbro\UFASoft.exe' /pid=4716
- '%APPDATA%\coolbro\UFASoft.exe' /pid=4496
- '%APPDATA%\coolbro\UFASoft.exe' /pid=764
- '%APPDATA%\coolbro\UFASoft.exe' /pid=2160
- '%APPDATA%\coolbro\UFASoft.exe' /pid=2912
- '%APPDATA%\coolbro\UFASoft.exe' /pid=4916
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5072
- '%APPDATA%\coolbro\UFASoft.exe' /pid=3600
- '%APPDATA%\coolbro\UFASoft.exe' /pid=3700
- '%APPDATA%\coolbro\UFASoft.exe' /pid=3468
- '%APPDATA%\coolbro\UFASoft.exe' /pid=4944
- '%APPDATA%\coolbro\UFASoft.exe' /pid=2744
- '%APPDATA%\coolbro\UFASoft.exe' /pid=728
- '%APPDATA%\coolbro\UFASoft.exe' /pid=2472
- '%APPDATA%\coolbro\UFASoft.exe' /pid=6120
- '%APPDATA%\coolbro\UFASoft.exe' /pid=3740
- '%APPDATA%\coolbro\UFASoft.exe' /pid=3640
- '%APPDATA%\coolbro\UFASoft.exe' /pid=3016
- '%APPDATA%\coolbro\UFASoft.exe' /pid=5912
- '%APPDATA%\coolbro\UFASoft.exe' /pid=4116
- '%APPDATA%\coolbro\UFASoft.exe' /pid=4188
- '%APPDATA%\coolbro\UFASoft.exe' /pid=3620
- '%APPDATA%\12164307721209541778434321872.exe' /pid=4040
- '%APPDATA%\coolbro\UFASoft.exe' /pid=2952
- '%APPDATA%\coolbro\UFASoft.exe' /pid=3076
- '<SYSTEM32>\cmd.exe' (downloaded from the Internet)
- '%APPDATA%\12164307721209541778434321872.exe' (downloaded from the Internet)
- '%APPDATA%\coolbro\UFASoft.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\attrib.exe' -s -h %APPDATA%\coolbro
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system :
Creates the following files:
- %APPDATA%\coolbro\miner.dll
- %APPDATA%\coolbro\coinutil.dll
- %APPDATA%\coolbro\phatk.cl
- %APPDATA%\coolbro\usft_ext.dll
- %APPDATA%\coolbro\phatk.ptx
- %APPDATA%\12164307721209541778434321872.exe
- %APPDATA%\coolbro\UFASoft.exe
- %TEMP%\tmp1.tmp.exe
- %APPDATA%\coolbro\bdb.dll
- %APPDATA%\coolbro\btc-evergreen.il
- %APPDATA%\coolbro\btc.il
Moves itself:
- from <Full path to virus> to %APPDATA%\coolbro\Loader.exe
Network activity:
Connects to:
- 'dl.##opbox.com':80
- '19#.#3.167.160':80
- 'wp#d':80
TCP:
HTTP GET requests:
- 19#.#3.167.160/sov1001/miner.dll
- 19#.#3.167.160/sov1001/coinutil.dll
- 19#.#3.167.160/sov1001/phatk.cl
- 19#.#3.167.160/sov1001/usft_ext.dll
- 19#.#3.167.160/sov1001/phatk.ptx
- dl.##opbox.com/FileToDownload.exe
- 19#.#3.167.160/sov1001/coin-miner.exe
- wp#d/wpad.dat
- 19#.#3.167.160/sov1001/bdb.dll
- 19#.#3.167.160/sov1001/btc-evergreen.il
- 19#.#3.167.160/sov1001/btc.il
UDP:
- DNS ASK dl.##opbox.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
