Malware miners are in the raise starting from this year, attackers using various social engineering and more sophisticated attacks for spreading Cryptocurrency Miners.
Security researchers spotted a new Cryptocurrency Miner spreading through Facebook messenger spotted first in South Korea and then spread to other regions.
Cryptocurrency-mining bot dubbed Digmine developed in AutoIt and the executable’s distributed as a video file, once the script executed it communicates with C&C server and downloads multiple components.
Digmine only affects facebook messenger chrome version and if the file opened in any other platforms the malware will not work, if facebook set to log in automatically, it will send the link of the file to your friends.
It downloads components and saves into directory “%appdata%\<username> directory” it mines Monero and it intends to stay in the system as long as possible.
“It will search and launch Chrome then load a malicious browser extension that it retrieves from the C&C server. If Chrome is already running, the malware will terminate and relaunch Chrome to ensure the extension is loaded” says TrendMicro researchers.
Later its use to download the miner module “codec.exe” and it will connect to C&C for retrieving configuration files, mining component “miner.exe” is an open source Monero miner known as XMRig.
Researchers said “The increasing popularity of cryptocurrency mining is drawing attackers back to the mining botnet business, We disclosed our findings to Facebook, which promptly removed many of the Digmine-related links from its platform”
Indicators of Compromise (IoCs):
Hash detected as TROJ_DIGMINEIN.A (SHA256);
Hash detected as BREX_DIGMINEEX.A (SHA256):
Hash detected as TROJ_DIGMINE.A (SHA256):