Home Malware Programs Trojans Kexqoud

Kexqoud

Posted: May 15, 2013

Threat Metric

Threat Level: 9/10
Infected PCs: 365
First Seen: May 15, 2013
Last Seen: July 14, 2023
OS(es) Affected: Windows

Kexqoud is a Trojan that uses an affected computer without a PC owner's consent to create a specific digital currency known as Bitcoins. Kexqoud uses a legal program used for mining Bitcoins, using multiple accounts, to create this currency. Kexqoud is often bundled with legal applications such as games and productivity tools. Once executed, Kexqoud adds a copy of itself to the %APPDATA% directory with a random file name. Kexqoud also adds a legal Bitcoin-mining tool in the %TEMP% directory, also with a random file name. Kexqoud may also make the modifications to the Windows Registry, to assure that it runs automatically every time the PC user starts the computer. To automatically run on system start, Kexqoud adds the registry keys. Kexqoud runs the Bitcoin-mining client in a manner that attributes newly-generated Bitcoins to an account indicated by an attacker. This means, that any Bitcoins the computer user generates, inadvertently or purposefully, will be credited to the attacker. The mining client is configured to run with high CPU utilization, which may notably slow the performance of the infected computer.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%APPDATA%\vxtwtuowmvekobpxnsq.exe File name: %APPDATA%\vxtwtuowmvekobpxnsq.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%TEMP%\riblekbyc.exe File name: %TEMP%\riblekbyc.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[malware file name]" = "%AppData%\[malware filename].exe"

Related Posts

Loading...