Thursday, March 28, 2024

Android Based Malicious CryptoMiner Spreading by Worm that has Infected more than 5,000 devices in 24 hours

A malicious code that reuses Mirai bot spreading by a worm to mine Monero cryptocurrency and this is the first time Android worm reuse Mirai bot.

The infection spreads by scanning the 5555 adb port using the malicious code and this port is used by adb debug interface on Android.

This port should basically shut down on an android device but some case unknown part of the cause led to the wrong port opened.

Also Read Cryptocurrency Mining Smominru Botnet Infected more than 500,000 Windows Machines

Devices Infected – Android worm

This Android worm is spreading very actively more than 5,000 devices in 24 hours and it directly infects on adb debug interface in Android and it’s rapidly increasing its traffic.

Based on the initial analyze South Korea and China has reported the major infections especially smartphones, as well as smart TV set-top boxes.

Android worm
According to netlab.360 , the scan traffic on port 5555 starts around 15:00 pm, reaches 3 times the daily background data, and reaches 10 times around 24:00. To date, the number of IPs initiating scanning and the total scanning traffic are still growing.

Mainly affected devices are adb debug interface Android devices and malicious code found that most of the source device based on the Android operating system.

Also, the malicious code contains a script that clearly indicates that it trying to mining Monero.

  • Mine Pool Address: pool.monero.hashvault.pro: 5555 or pool . Minexmr . Com
  • Wallet address (mine account): 44XT4KvmobTQfeWa6PCQF5RDosr2MLWm43AsaE3o5iNR
    XXTfDbYk2VPHTVedTQHZyfXNzMn8YYF2466d3FSDT7gJS8gdHAr
  • Pond password: x

We initially highly suspected that the sample had a worm-like spread. Subsequent analysis confirmed the above speculation from several aspects. Follow-up We may release an update to further illustrate this point. netlab said.

Starting February Smominru botnet affects more than 526,000 windows servers and nodes are distributed worldwide and predominantly in Russia, India, and Taiwan.

The botnet approximately mines 24 Monero every day and researchers said most of them are windows servers that impact critical business infrastructure.

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles