Android Based Malicious CryptoMiner Spreading by Worm that has Infected more than 5,000 devices in 24 hours

A malicious code that reuses Mirai bot spreading by a worm to mine Monero cryptocurrency and this is the first time Android worm reuse Mirai bot.

The infection spreads by scanning the 5555 adb port using the malicious code and this port is used by adb debug interface on Android.

This port should basically shut down on an android device but some case unknown part of the cause led to the wrong port opened.

Also Read Cryptocurrency Mining Smominru Botnet Infected more than 500,000 Windows Machines

Devices Infected – Android worm

This Android worm is spreading very actively more than 5,000 devices in 24 hours and it directly infects on adb debug interface in Android and it’s rapidly increasing its traffic.

Based on the initial analyze South Korea and China has reported the major infections especially smartphones, as well as smart TV set-top boxes.

According to netlab.360 , the scan traffic on port 5555 starts around 15:00 pm, reaches 3 times the daily background data, and reaches 10 times around 24:00. To date, the number of IPs initiating scanning and the total scanning traffic are still growing.

Mainly affected devices are adb debug interface Android devices and malicious code found that most of the source device based on the Android operating system.

Also, the malicious code contains a script that clearly indicates that it trying to mining Monero.

• Mine Pool Address: pool.monero.hashvault.pro: 5555 or pool . Minexmr . Com

• Wallet address (mine account): 44XT4KvmobTQfeWa6PCQF5RDosr2MLWm43AsaE3o5iNR
  XXTfDbYk2VPHTVedTQHZyfXNzMn8YYF2466d3FSDT7gJS8gdHAr

• Pond password: x

We initially highly suspected that the sample had a worm-like spread. Subsequent analysis confirmed the above speculation from several aspects. Follow-up We may release an update to further illustrate this point. netlab said.

Starting February Smominru botnet affects more than 526,000 windows servers and nodes are distributed worldwide and predominantly in Russia, India, and Taiwan.

The botnet approximately mines 24 Monero every day and researchers said most of them are windows servers that impact critical business infrastructure.