{"id":13253,"date":"2018-09-03T03:20:27","date_gmt":"2018-09-03T11:20:27","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/09\/03\/news-7020\/"},"modified":"2018-09-03T03:20:27","modified_gmt":"2018-09-03T11:20:27","slug":"news-7020","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/09\/03\/news-7020\/","title":{"rendered":"I am invisible – Monero (XMR) Miner"},"content":{"rendered":"

Credit to Author: Ghanshyam More| Date: Mon, 03 Sep 2018 10:27:58 +0000<\/strong><\/p>\n

Estimated reading time: 4 minutesFrom the last one year, Quick Heal Security Labs has been observing a boost in the number of mining malware. Nowadays malware authors are using mining as a replacement for Ransomware to make money. Recently Quick Heal Security Labs came across a malware which mines Monero(XMR). This miner has many different components in it. The infection vector of this mining malware is still unconfirmed, but based on attribution this miner arrives on the system via spear phishing, malvertising etc. \u00a0Technical Analysis: Analyzed Miner is a self-extracting executable (SFX). It extracts components at \u201cC:Program FilesWindriverhost\u201d as listed below: vbs (VBScript) exe (Extraction utility) rar (Password Protected Archive) bat (Batch File) Fig 1 : Extracted components of the malware After extraction of components, it starts VBScript(jsnel.vbs) as shown in Fig 2. Fig 2 : Starting jsnel.vbs jsnel.vbs\u00a0contains a simple piece of code to launch chax.bat. Fig 3 : Content of jsnel.vbs rar.exe\u00a0is command line utility to unpack archives. Here it is used to unpack password protected db.rar. chax.bat\u00a0file\u00a0contains commands to delete old version components of Password Protected Archive\u00a0and malware as shown in Fig 4. Fig 4 : Content of chax.bat Important\u00a0task of chax.bat is to extract below mentioned components of db.rar\u00a0at the current location and launch ouyk.vbs. vbs(VBScript) bat(Batch file) json(Configuration file) driverhost.exe\u00a0(Mining tool) Fig 5 : Extracted components of db.rar Similar to previous VBScript(jsnel.vbs),\u00a0this script(ouyk.vbs)\u00a0too just launches batch file(xvvq.bat). Fig 6 : Content of ouyk.vbs xvvq.bat has two main purposes: To keep the system always ON using PowerCFG command, so that mining is not interrupted. \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u201cpowercfg -change -standby-timeout-ac 0\u201d\u00a0 To hide driverhost.exe from analysis tools: \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 It enumerates processes using tasklist command\u00a0to check if any of below-listed\u00a0process is\u00a0running, and if it finds any of these processes\u00a0are running, it kills driverhost.exe. \u00a0 \u00a0 \u00a0\u201ctaskmgr.exe\u201d \u00a0 \u00a0 \u00a0\u201cperfmon.exe\u201d \u00a0 \u00a0 \u201cProcessHacker.exe\u201d \u00a0 \u00a0 \u201cprocexp.exe\u201d \u00a0 \u00a0 \u201cprocexp64.exe\u201d \u00a0 \u00a0 \u201cdumpcap.exe\u201d \u00a0 \u00a0 \u201cWireshark.exe\u201d \u00a0 \u00a0 \u201canvir.exe\u201d But there is a bug in xvvq.bat,\u00a0it checks\u00a0only for taskmgr.exe and kills\u00a0dirverhost.exe as shown in Fig 7. And if any other process like procexp.exe is running it does not kill driverhost.exe. Fig 7 : Content of xvvq.bat And if none of the above mentioned processes are\u00a0running, then\u00a0it starts driverhost.exe\u00a0which is\u00a0a\u00a0core mining tool.\u00a0It keeps on checking for all these processes continuously using an infinite loop in xvvq.bat and act accordingly. config.json\u00a0is\u00a0a configuration\u00a0file,\u00a0which stores data such as username, password, max CPU usage, etc. as shown in Fig 8. Fig 8 : Content of config.json On execution, driverhost.exe\u00a0reads miner configurations from config.json and connects to \u201cxmr[.]pool[.]minergate[.]com\u201d, and sends username and password from config.json to server and starts mining with port 45560\u00a0(port used for mining). as shown in Fig 9 and Fig 10. Fig 9 : Network Analysis Fig 10 : Sends username and password to the server It limits CPU usage to 35% for mining as shown in Fig 11. Fig 11 : CPU Usage by driverhost.exe For persistence, malware adds a shortcut\u00a0in\u00a0the startup\u00a0folder for ouyk.vbs\u00a0with name driverhost.lnk. Fig 12 : Creating a shortcut for ouyk.vbs Fig 13 : Shortcut to ouyk.vbs in the startup folder Execution Flow of miner: IOC: SHA256: b4ea81958403f717c1a20f18731ef05b648465c7e20cbc6f45bd2f5166c7c940 URL: hxxp:\/\/xmr[.]pool[.]minergate[.]com:45560 Quick Heal\u00a0detects this Miner\u00a0as \u201cTrojan.Occamy\u201d. Conclusion: As the price and appreciation of digital currencies has grown exponentially, mining malware too have increased over the last year. In fact, miners are so common that thousands of computers are already infected. The number of mining malware has increased and they have also become complex as discussed in the above blog post. Subject Matter Expert Ravi Gidwani,\u00a0 Pratik Pachpor | Quick Heal Security Labs The post I am invisible – Monero (XMR) Miner appeared first on Quick Heal Blog | Latest computer security news, tips, and advice.
http:\/\/blogs.quickheal.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Credit to Author: Ghanshyam More| Date: Mon, 03 Sep 2018 10:27:58 +0000<\/strong><\/p>\n

From the last one year, Quick Heal Security Labs has been observing a boost in the number of mining malware. Nowadays malware authors are using mining as a replacement for Ransomware to make money. Recently Quick Heal Security Labs came across a malware which mines Monero(XMR). This miner has many…<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10459,10378],"tags":[14393,16415,10477,19189,3764,901,10538,19383,714],"class_list":["post-13253","post","type-post","status-publish","format-standard","hentry","category-quickheal","category-security","tag-archive","tag-cryptojacking","tag-cyber-safety","tag-dropper","tag-malware","tag-mining","tag-monero","tag-multi-component","tag-security"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/13253","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=13253"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/13253\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=13253"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=13253"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=13253"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}