Tuesday, June 18, 2024

Evil Clone Attack – Hackers Injecting Crypto-mining Malware into Legitimate PDF Software

Cybercriminals using a new type of attack called Evil clone to inject Cryptocurrency malware into legitimate PDF software to Mine cryptocurrency with the help of CoinHive miner.

Cryptocurrency malware is dramatically increasing this year to compromise various victims and an attacker generates huge revenue by illegally running miner using victims system resource.

Attackers abusing legitimate PDFescape software application installer to modify the package in order to delivery the crypto-mining malware.

PDFescape is a web-based PDF editor program written in JavaScript, HTML, CSS and ASP. Many Peoples using this software for PDF editing, form filling, page arrangement, printing, saving, and form publishing.

Cybercriminals always using legitimate software to perform malicious activities by applying various modification even though legitimate software’s are secure to use.

In this case, the Attacker went to a depth into the legitimate PDF software PDFescape and create a evil clone.

Cryptomining Malware Injecting Process

Initially, attacker created the similar infrastructure on a server which is controlled by an attacker same as legitimate software vendor infrastructure.

Later they copied all the MSI file from the PDFescape software (installer package file for Windows) and placed it into the newly created infrastructure.

An attacker then decompiled and modified one of MSI and also added the additional malicious files which is represented the coin miner source code that turns the original installer of PDFescape into a malicious one.

This new installer redirect victims into malicious website and downloads the payload with the hidden file.

Attackers spreading this malicious package(pdfescape-desktop-Asian-and-extended-font-pack) in various form, once victim download and execute this malicious file then it drops malicious binary xbox-service.exe.

Then it runs malicious DLL under rundll32 with the name setup.log using the command line:

rundll32 C:\Windows\System32\setup.log.dll

Researchers from Comodo Cybersecurity performed a static analysis that reveals after the DLL file runs malicious process xbox-service.exe,  DLL payload tries to modify the Windows HOSTS file to prevent the infected machine from communication with update servers of various PDF-related apps and security software. Thus malware tries to avoid a remote cleaning and remediation of affected machines.

finally, the malicious DLL contains a dangerous browser script with an embedded link http://carma666.byethost12.com/32.html.

Once the embedded link will be executed then it downloads JavaScript of coinminer named CoinHive that utilize the infected system resource and generate the revenue.

Also Read:

Malware Abuse Google Ads to Injecting Coinhive Cryptocurrency Miner

Chinese Threat Actors Rocke Launching Sophisticated Crypto-mining Malware to Mine Monero Cryptocurrency


Latest articles

Singapore Police Arrested Two Individuals Involved in Hacking Android Devices

The Singapore Police Force (SPF) has arrested two men, aged 26 and 47, for...

CISA Conducts First-Ever Tabletop Exercise Focused on AI Cyber Incident Response

On June 13, 2024, the Cybersecurity and Infrastructure Security Agency (CISA) made history by...

Europol Taken Down 13 Websites Linked to Terrorist Operations

Europol and law enforcement agencies from ten countries have taken down 13 websites linked...

New ARM ‘TIKTAG’ Attack Impacts Google Chrome, Linux Systems

Memory corruption lets attackers hijack control flow, execute code, elevate privileges, and leak data.ARM's...

Operation Celestial Force Employing Android And Windows Malware To Attack Indian Users

A Pakistani threat actor group, Cosmic Leopard, has been conducting a multi-year cyber espionage...

Hunt3r Kill3rs Group claims they Infiltrated Schneider Electric Systems in Germany

The notorious cybercriminal group Hunt3r Kill3rs has claimed responsibility for infiltrating Schneider Electric's systems...

Hackers Employing New Techniques To Attack Docker API

Attackers behind Spinning YARN launched a new cryptojacking campaign targeting publicly exposed Docker Engine...

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles