Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SilkRoadApp' = '%APPDATA%\SilkRoadApp\Loader.exe'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=3548
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=6116
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=4228
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=2568
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=6056
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5564
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5716
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=2692
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5184
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=6136
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5396
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=1904
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5216
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=3024
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=4608
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5484
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=1352
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=4356
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5324
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=4936
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=3236
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=2744
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5944
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=2588
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=2836
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=4796
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=3368
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=4952
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=4828
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5036
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=2112
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=2604
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=4408
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=3628
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=3296
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=2592
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=2904
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=3204
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=244
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5436
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=780
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=3152
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5016
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5136
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5056
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=4308
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=2136
- '%APPDATA%\SilkRoadApp\UFASoft.exe' -a sha256 -g no -o mint.bitminter.com:8332 -u capodes_mine1 -p 637078vdy -t 1
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5496
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5316
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5516
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=1668
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=3248
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5304
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=3648
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=3348
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=3044
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=4956
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5404
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=4816
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=2676
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=4136
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=4948
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=3748
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=4716
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=2876
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=4696
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5576
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=2848
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=4348
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=6016
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=3396
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=4836
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5844
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=6044
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5816
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=3768
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5776
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=3448
- '%APPDATA%\SilkRoadApp\UFASoft.exe' /pid=5896
- '<SYSTEM32>\cmd.exe' (downloaded from the Internet)
- '%APPDATA%\SilkRoadApp\UFASoft.exe' (downloaded from the Internet)
- '<SYSTEM32>\attrib.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\attrib.exe' -a sha256 -g no -o mint.bitminter.com:8332 -u capodes_mine1 -p 637078vdy -t 1
- '<SYSTEM32>\attrib.exe' -s -h %APPDATA%\SilkRoadApp
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\attrib.exe
Modifies file system :
Creates the following files:
- %APPDATA%\SilkRoadApp\phatk.cl
- %APPDATA%\SilkRoadApp\miner.dll
- %APPDATA%\SilkRoadApp\usft_ext.dll
- %APPDATA%\SilkRoadApp\phatk.ptx
- %APPDATA%\SilkRoadApp\coinutil.dll
- %APPDATA%\SilkRoadApp\bdb.dll
- %APPDATA%\SilkRoadApp\UFASoft.exe
- %APPDATA%\SilkRoadApp\btc-evergreen.il
- %APPDATA%\SilkRoadApp\btc.il
Moves itself:
- from <Full path to virus> to %APPDATA%\SilkRoadApp\Loader.exe
Network activity:
Connects to:
- '19#.#0.57.179':80
- 'wp#d':80
TCP:
HTTP GET requests:
- 19#.#0.57.179/sov1001/miner.dll
- 19#.#0.57.179/sov1001/coinutil.dll
- 19#.#0.57.179/sov1001/phatk.cl
- 19#.#0.57.179/sov1001/usft_ext.dll
- 19#.#0.57.179/sov1001/phatk.ptx
- 19#.#0.57.179/sov1001/coin-miner.exe
- wp#d/wpad.dat
- 19#.#0.57.179/sov1001/bdb.dll
- 19#.#0.57.179/sov1001/btc-evergreen.il
- 19#.#0.57.179/sov1001/btc.il
UDP:
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: '(null)'
