Win32/Crytes [Threat Name] go to Threat

Win32/Crytes.AA [Threat Variant Name]

Category	worm
Size	1578496 B
Detection created	Mar 09, 2016
Detection database version	13153
Aliases	Trojan.Win32.Miner.ays (Kaspersky)
	Trojan:Win32/CoinMiner.BB!bit (Microsoft)
	Win32:BitCoinMiner-IW.[Trj] (Avast)

Win32/Crytes.AA is a worm that uses the hardware resources of the infected computer for mining the digital currency.

In order to be executed on every system start, the worm sets the following Registry entry:

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion]
- "Run" = %malwarefilepath%

The worm copies itself into the root folders of all drives using the following name:

Win32/Crytes.AA is a worm that repeatedly tries to connect to various IP addresses.

The FTP protocol is used.

The following usernames are used:

The following passwords are used:

If it succeeds, a copy of the worm is retrieved from the attacking machine.

The following filename is used:

The worm also copies itself into existing subfolders.

The worm infects files with the following extensions:

The worm inserts the following text marker into the infected files:

The following information is collected:

The worm attempts to send gathered information to a remote machine.

The worm acquires data and commands from a remote computer or the Internet.

The worm contains a list of (13) URLs. The HTTP, FTP protocol is used in the communication.

The worm uses the hardware resources of the infected computer for mining the digital currency.

The following file is dropped into the %temp% folder:

The file is then executed.

The worm creates the following files: