Trojan:Win32/Vicenor.gen!B

Installation

Trojan:Win32/Vicenor.B!gen might be downloaded onto your PC via a drive-by download through an exploit, or you might have downloaded it yourself thinking it was something else, like a picture or legitimate program.

We have seen the trojan using the following file names:

• 296291521.gif
• adobe_restart[1].exe
• btc[1].exe
• image19.jpg.pif
• www2d.gif
• yif81909.png

It changes the following registry entry so that it runs each time you start your PC:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "WINSXS32"
With data: <file name and location of the trojan>
Sets value: "mService"
With data: <file name and location of the trojan>

Payload

Uses your PC to mine Bitcoins

The trojan contains and runs a Bitcoin mining program, which connects to a Bitcoin server and uses your PCs power to generate Bitcoins. This can severely affect the doance of your PC, making it seem to run slowly.

We have seen the program connect to the following servers:

• keep.<removed>.biz:2142/ using ID "bigbob0000001@<removed>.com" and password "password"
• eacfcf.<removed>.com/ using ID "niggas" and password "password"
• pool.<removed>.asia:8332/ using ID "redem_check" and password "orneliassssssssss"
• xxxxxxxxxxxxxxx.<removed>.su:1942/ using ID "tyldix_1" and password "password"

The mining program is run in memory - this means that the trojan does not install the program onto your PC, rather it just runs it.

Additional information

Trojan:Win32/Vicenor.B!gen creates a mutex, possibly as an infection marker to prevent multiple instances running on your PC. The mutex name varies between installations of the trojan; we have observed the following mutexes:

• uxJLpe1m
• whatwhstinthebdtt234905429090
• w8a4w2s3i4t5e6dgtr34d03429394

Analysis by Jeong Mun