{"id":11046,"date":"2018-01-09T10:10:43","date_gmt":"2018-01-09T18:10:43","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/01\/09\/news-4817\/"},"modified":"2018-01-09T10:10:43","modified_gmt":"2018-01-09T18:10:43","slug":"news-4817","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/01\/09\/news-4817\/","title":{"rendered":"RIG exploit kit campaign gets deep into crypto craze"},"content":{"rendered":"

Credit to Author: J\u00e9r\u00f4me Segura| Date: Tue, 09 Jan 2018 17:11:16 +0000<\/strong><\/p>\n

There isn’t a day that goes by without a headline about yet another massive spike in Bitcoin valuation<\/a>, or a story about someone mortgaging their house<\/a> to purchase the hardware required to become a serious cryptocurrency miner.<\/p>\n

If many folks are thinking about joining the ‘crypto craze’ movement, they may be surprised to learn that they already have. We’ve documented in-browser miners before on this blog, or what we call drive-by cryptomining<\/a>, but drive-by download attacks such as those via the RIG exploit kit want a piece of the action, too. While the latter is not a new trend<\/a>, we have noticed an increase in malware payloads from EKs that are coin miners, and we think this is going to be something to follow for 2018.<\/p>\n

Overview<\/h3>\n

Today, we take a look at a prolific campaign that is focused on the distribution of coin miners via drive-by download attacks. We started to notice larger-than-usual payloads from the RIG exploit kit around November 2017, a trend that has continued more recently via a campaign dubbed Ngay<\/a>.<\/p>\n

What happened is that the initial dropper contained additional binaries that contributed to its oversized nature as depicted below.\u00a0Droppers from this campaign have contained one or more coin miners consistently, for at least Monero and lesser known but still popular other currencies such as Bytecoin<\/a>.<\/p>\n

\"\"<\/a><\/p>\n

One payload leads to two different coin miners.<\/em><\/p>\n

For the same attack, these two processes will mine for the well-known Monero and Electroneum cryptocurrencies. When both executables are running, the CPU usage on the victim’s computer is maxed at 100 percent.<\/p>\n

Distribution<\/h3>\n

The Ngay campaign<\/a>, identified as such by Nao_Sec<\/a>, is one of several malvertising chains that relies on the RIG exploit kit to distribute its payloads. Recently, we observed a more complex redirection chain involving bestadbid<\/em> and various XML feeds upstream, eventually trickling down to the more familiar redirect to RIG.<\/p>\n

\"\"<\/a><\/p>\n

Infection flow showing redirection to RIG EK, followed by coin miner payloads<\/em><\/p>\n

\"\"<\/a><\/p>\n

iframe to RIG EK is inserted in Ngay’s template page<\/em><\/p>\n

The dropped binary from RIG EK contains two other artifacts that each lead to a different coin miner and are launched in a rather unusual procedure. In the following sections, we will study their deployment mechanism.<\/p>\n

Monero miner<\/h3>\n

Monero is one of the most well-known digital currencies that, contrary to Bitcoin, does not require special hardware and provides additional privacy benefits. Threat actors have jumped on it in via large-scale drive-by mining attacks, with the help of coin miner-purposed malware.<\/p>\n

Here the Monero miner is downloaded after a convoluted process that also aims at registering it permanently as a running service. The extracted binary from the RIG EK payload (3yanvarya.exe<\/em>) is an installer that drops several .NET modules:<\/p>\n

\"\"<\/a><\/p>\n

.NET modules extracted from one of the two artifacts contained in RIG EK’s payload<\/em><\/p>\n

starter.exe<\/em> uses an exploit (Invoke-MS16-032) copied from this GitHub repository<\/a> (It even re-uses the original license!)\u00a0to elevate privileges:<\/p>\n

\"\"<\/p>\n

Code snippet showing PowerShell code designed to elevate privileges<\/em><\/p>\n

foxcon.exe<\/em>\u00a0contains two sub-modules inside: Hydra and Hand, which purport to protect and manage services:<\/p>\n

\"\"<\/a><\/p>\n

Hydra and Hand: two modules in charge of miner services<\/em><\/p>\n

services.exe<\/em>\u00a0is a service to download and manage the miner:<\/p>\n

\"\"<\/a><\/p>\n

Miner is downloaded from a remote IP address<\/em><\/p>\n

Finally, the Monero miner (series64.exe<\/em>) is retrieved and can start the mining activity. The overall process can be summarized in the diagram below.<\/p>\n

“C:WindowsTEMPseries64.exe” -o 5.23.48.207:5555 -u x -p x -k -B –max-cpu-usage=30 –safe<\/em><\/p>\n

\"\"<\/a><\/p>\n

Overview of the Monero miner deployment<\/em><\/p>\n

Electroneum miner<\/h3>\n

Electroneum,<\/a> the “mobile friendly” digital currency, has only been recently introduced but became popular<\/a> almost immediately.\u00a0The Android app allows anyone to mine and manage their wallet, but miners running desktop platforms can also participate.<\/p>\n

Malware authors are abusing it via a malicious coin miner binary that is dropped from\u00a0dp.exe<\/em> in yet another unusual redirection chain. Indeed, it involves the Bit.ly<\/em> URL shortener to retrieve a fake PNG image containing instructions for the download and eventual launch of the miner itself.<\/p>\n

“C:Users[username]AppDataRoamingbvhostbvhost.exe” -o etn-eu2.nanopool.org:13333 -u etnkKc…<\/em><\/p>\n

\"\"<\/a><\/p>\n

Overview of the Electroneum miner deployment<\/em><\/p>\n

Conclusion<\/h3>\n

As cryptocurrencies become more and more popular, we can only expect to see an increase in malicious coin miners, driven by the prospect of financial gains and increased anonymity. As the mining process has become cross-platform and achievable using regular computers, this has opened new possibilities for threat actors. Indeed, they can put hundreds of thousands of compromised machines to work mining for the latest and hottest digital currency around.<\/p>\n

For end users, the threat of a coin miner infection may seem less impactful than, say, a banking Trojan, but perhaps that is only true in the short term. Not only can existing malware download additional payloads over the course of time, but the illicit gains from cryptomining contribute to financing the criminal ecosystem, costing billions of dollars in losses.<\/p>\n

This particular RIG EK campaign is noteworthy for its focus on cryptominers and the way it unconventionally and at times inefficiently loads them. We will keep monitoring the drive-by download landscape to report on any change in payloads from other threat actors.<\/p>\n

Many thanks to @hasherezade<\/a> for help studying the binaries.<\/em><\/p>\n

Indicators of compromise<\/h3>\n

RIG EK dropper<\/p>\n

FD4A117EDFEA1075132CF7D0A2AD5376B174AFD1C924D91E9B0D124320E3177D<\/pre>\n
Redirections to downloader script<\/p>\n
5.101.179.249  *.lolkekss[.]us  bit[.]ly\/2lXCGUy<\/pre>\n
Downloader script for Electroneum miner (fake PNG)<\/p>\n
lolkekss.usite[.]pro\/DF.png  195.216.243.130<\/pre>\n
Electroneum miner (bvhost.exe<\/em>)<\/p>\n
74.115.50.111  115776615-884492032168661957.preview.editmysite[.]com\/uploads\/1\/1\/5\/7\/115776615\/be  13CE8C6C8E9E4A06880A5F445A391E9E26BB23FCD0C6F4CC495AA5B80E626C0B<\/pre>\n
Monero miner (series64.exe<\/em>)<\/p>\n
188.225.46.219:3000\/files\/mh\/series64.exe  F651B1C5AE7B55B765994EB6630C45A0A7F1E43EBABD801CB8B3B26BDDB09D17<\/pre>\n
Additional miner loaders via RIG EK (SHA256, size in bytes, date found):<\/p>\n
24ff04ef166cbc94d88afd0c7a3cba78dfe2f2d9e02a273a60fcc45ced5cb484,1732969,2017-12-29  d68c5095bd7b82e28acd4df5514a54db6d6d340ada860b64b932cb014fe1ecb3,1513983,2018-01-02  5c32e0d2a69fd77e85f2eecaabeb677b6f816de0d82bf7c29c9d124a818f424f,1732965,2018-01-02  2876ceb760c5b37e03ebb3cabbfb25a175e8c3556de89af9dd9941fda183bc79,1840725,2018-01-03  bba35503156eee0aa6ecef7aa76bbe3e6d26791585aac328f895278cd1c09cb2,2819600,2018-01-04<\/pre>\n
The post RIG exploit kit campaign gets deep into crypto craze<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n
https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Credit to Author: J\u00e9r\u00f4me Segura| Date: Tue, 09 Jan 2018 17:11:16 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
We take a look at a prolific campaign that is focused on the distribution of coin miners via drive-by download attacks. We started to notice larger-than-usual payloads from the RIG exploit kit around November 2017, a trend that has continued more recently via a campaign dubbed Ngay.<\/p>\n
Categories: <\/p>\n