Malware miners are in the raise starting from this year, attackers using various social engineering and more sophisticated attacks for spreading Cryptocurrency Miners.
Security researchers spotted a new Cryptocurrency Miner spreading through Facebook messenger spotted first in South Korea and then spread to other regions.
Cryptocurrency-mining bot dubbed Digmine developed in AutoIt and the executable’s distributed as a video file, once the script executed it communicates with C&C server and downloads multiple components.
Digmine only affects facebook messenger chrome version and if the file opened in any other platforms the malware will not work, if facebook set to log in automatically, it will send the link of the file to your friends.
It downloads components and saves into directory “%appdata%\<username> directory” it mines Monero and it intends to stay in the system as long as possible.
“It will search and launch Chrome then load a malicious browser extension that it retrieves from the C&C server. If Chrome is already running, the malware will terminate and relaunch Chrome to ensure the extension is loaded” says TrendMicro researchers.
Also Read Over 500 Million Users PC’s are Secretly Mining CryptoCurrency in Browser without Users Knowledge
Later its use to download the miner module “codec.exe” and it will connect to C&C for retrieving configuration files, mining component “miner.exe” is an open source Monero miner known as XMRig.
Researchers said “The increasing popularity of cryptocurrency mining is drawing attackers back to the mining botnet business, We disclosed our findings to Facebook, which promptly removed many of the Digmine-related links from its platform”
Indicators of Compromise (IoCs):
Hash detected as TROJ_DIGMINEIN.A (SHA256);
beb7274d78c63aa44515fe6bbfd324f49ec2cc0b8650aeb2d6c8ab61a0ae9f1d
Hash detected as BREX_DIGMINEEX.A (SHA256):
5a5b8551a82c57b683f9bd8ba49aefeab3d7c9d299a2d2cb446816cd15d3b3e9
Hash detected as TROJ_DIGMINE.A (SHA256):
f7e0398ae1f5a2f48055cf712b08972a1b6eb14579333bf038d37ed862c55909
Cybersecurity specialists have devised an innovative approach to combat an emerging cybercrime called "PigButchering" on…
A sophisticated spam campaign targeting Portuguese-speaking users in Brazil has been uncovered by Cisco Talos,…
Silent Push Threat Analysts have recently exposed a sophisticated financial scam leveraging a vulnerability in…
Google Chrome has emerged as the undisputed champion of data collection among 10 popular web…
A recent discovery by Netskope Threat Labs has brought to light a highly complex ransomware…
Ransomware-as-a-Service (RaaS) has solidified its position as the dominant framework driving ransomware attacks in 2024,…