Monday, November 4, 2024
HomeSecurity NewsDigmine - Cryptocurrency Mining Malware Spreading via Facebook Messenger

Digmine – Cryptocurrency Mining Malware Spreading via Facebook Messenger

Published on

Malware protection

Malware miners are in the raise starting from this year, attackers using various social engineering and more sophisticated attacks for spreading Cryptocurrency Miners.

Security researchers spotted a new Cryptocurrency Miner spreading through Facebook messenger spotted first in South Korea and then spread to other regions.

Cryptocurrency-mining bot dubbed Digmine developed in AutoIt and the executable’s distributed as a video file, once the script executed it communicates with C&C server and downloads multiple components.

facebook Messenger cryptocurrency
Digmine only affects facebook messenger chrome version and if the file opened in any other platforms the malware will not work, if facebook set to log in automatically, it will send the link of the file to your friends.
- Advertisement - SIEM as a Service
facebook Messenger cryptocurrency

It downloads components and saves into directory “%appdata%\<username> directory” it mines Monero and it intends to stay in the system as long as possible.

It will search and launch Chrome then load a malicious browser extension that it retrieves from the C&C server. If Chrome is already running, the malware will terminate and relaunch Chrome to ensure the extension is loaded” says TrendMicro researchers.

Also Read Over 500 Million Users PC’s are Secretly Mining CryptoCurrency in Browser without Users Knowledge

Later its use to download the miner module “codec.exe” and it will connect to C&C for retrieving configuration files, mining component “miner.exe” is an open source Monero miner known as XMRig.

Researchers said “The increasing popularity of cryptocurrency mining is drawing attackers back to the mining botnet business, We disclosed our findings to Facebook, which promptly removed many of the Digmine-related links from its platform”

Indicators of Compromise (IoCs):

Hash detected as TROJ_DIGMINEIN.A (SHA256);
beb7274d78c63aa44515fe6bbfd324f49ec2cc0b8650aeb2d6c8ab61a0ae9f1d
Hash detected as BREX_DIGMINEEX.A (SHA256):
5a5b8551a82c57b683f9bd8ba49aefeab3d7c9d299a2d2cb446816cd15d3b3e9
Hash detected as TROJ_DIGMINE.A (SHA256):
f7e0398ae1f5a2f48055cf712b08972a1b6eb14579333bf038d37ed862c55909

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Threat Actors Allegedly Claiming Leak of Dell Partner Portal Data

A well-known dark web forum threat actor allegedly claimed responsibility for leaking data from...

Securing Your SaaS Application Security

The rapid growth of cloud computing has made SaaS applications indispensable across industries. While...

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Critical PDF.js & React-PDF Vulnerabilities Threaten Millions Of PDF Users

A new critical vulnerability has been discovered in PDF.js, which could allow a threat...

LayerX Security Raises $26M for its Browser Security Platform, Enabling Employees to Work Securely From Any Browser, Anywhere

LayerX, pioneer of the LayerX Browser Security platform, today announced $24 million in Series...

Email Header Analysis – Verify Received Email is Genuine or Spoofed

Email Header Analysis highly required process to prevent malicious threats since Email is...