Tuesday, April 16, 2024

Android Based Malicious CryptoMiner Spreading by Worm that has Infected more than 5,000 devices in 24 hours

A malicious code that reuses Mirai bot spreading by a worm to mine Monero cryptocurrency and this is the first time Android worm reuse Mirai bot.

The infection spreads by scanning the 5555 adb port using the malicious code and this port is used by adb debug interface on Android.

This port should basically shut down on an android device but some case unknown part of the cause led to the wrong port opened.

Also Read Cryptocurrency Mining Smominru Botnet Infected more than 500,000 Windows Machines

Devices Infected – Android worm

This Android worm is spreading very actively more than 5,000 devices in 24 hours and it directly infects on adb debug interface in Android and it’s rapidly increasing its traffic.

Based on the initial analyze South Korea and China has reported the major infections especially smartphones, as well as smart TV set-top boxes.

Android worm
According to netlab.360 , the scan traffic on port 5555 starts around 15:00 pm, reaches 3 times the daily background data, and reaches 10 times around 24:00. To date, the number of IPs initiating scanning and the total scanning traffic are still growing.

Mainly affected devices are adb debug interface Android devices and malicious code found that most of the source device based on the Android operating system.

Also, the malicious code contains a script that clearly indicates that it trying to mining Monero.

  • Mine Pool Address: pool.monero.hashvault.pro: 5555 or pool . Minexmr . Com
  • Wallet address (mine account): 44XT4KvmobTQfeWa6PCQF5RDosr2MLWm43AsaE3o5iNR
    XXTfDbYk2VPHTVedTQHZyfXNzMn8YYF2466d3FSDT7gJS8gdHAr
  • Pond password: x

We initially highly suspected that the sample had a worm-like spread. Subsequent analysis confirmed the above speculation from several aspects. Follow-up We may release an update to further illustrate this point. netlab said.

Starting February Smominru botnet affects more than 526,000 windows servers and nodes are distributed worldwide and predominantly in Russia, India, and Taiwan.

The botnet approximately mines 24 Monero every day and researchers said most of them are windows servers that impact critical business infrastructure.

Website

Latest articles

Hacker Customize LockBit 3.0 Ransomware to Attack Orgs Worldwide

Cybersecurity researchers at Kaspersky have uncovered evidence that cybercriminal groups are customizing the virulent...

Microsoft .NET, .NET Framework, & Visual Studio Vulnerable To RCE Attacks

A new remote code execution vulnerability has been identified to be affecting multiple Microsoft...

LightSpy Hackers Indian Apple Device Users to Steal Sensitive Data

The revival of the LightSpy malware campaign has been observed, focusing on Indian Apple...

LightSpy Malware Attacking Android and iOS Users

A new malware known as LightSpy has been targeting Android and iOS users.This sophisticated...

This Startup Aims To Simplify End-to-End Cybersecurity, So Anyone Can Do It

The Web3 movement is going from strength to strength with every day that passes....

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles