Evil Clone Attack – Hackers Injecting Crypto-mining Malware into Legitimate PDF Software

Cybercriminals using a new type of attack called Evil clone to inject Cryptocurrency malware into legitimate PDF software to Mine cryptocurrency with the help of CoinHive miner.

Cryptocurrency malware is dramatically increasing this year to compromise various victims and an attacker generates huge revenue by illegally running miner using victims system resource.

Attackers abusing legitimate PDFescape software application installer to modify the package in order to delivery the crypto-mining malware.

PDFescape is a web-based PDF editor program written in JavaScript, HTML, CSS and ASP. Many Peoples using this software for PDF editing, form filling, page arrangement, printing, saving, and form publishing.

Cybercriminals always using legitimate software to perform malicious activities by applying various modification even though legitimate software’s are secure to use.

In this case, the Attacker went to a depth into the legitimate PDF software PDFescape and create a evil clone.

Cryptomining Malware Injecting Process

Initially, attacker created the similar infrastructure on a server which is controlled by an attacker same as legitimate software vendor infrastructure.

Later they copied all the MSI file from the PDFescape software (installer package file for Windows) and placed it into the newly created infrastructure.

An attacker then decompiled and modified one of MSI and also added the additional malicious files which is represented the coin miner source code that turns the original installer of PDFescape into a malicious one.

This new installer redirect victims into malicious website and downloads the payload with the hidden file.

Attackers spreading this malicious package(pdfescape-desktop-Asian-and-extended-font-pack) in various form, once victim download and execute this malicious file then it drops malicious binary xbox-service.exe.

Then it runs malicious DLL under rundll32 with the name setup.log using the command line:

rundll32 C:\Windows\System32\setup.log.dll

Researchers from Comodo Cybersecurity performed a static analysis that reveals after the DLL file runs malicious process xbox-service.exe, DLL payload tries to modify the Windows HOSTS file to prevent the infected machine from communication with update servers of various PDF-related apps and security software. Thus malware tries to avoid a remote cleaning and remediation of affected machines.

finally, the malicious DLL contains a dangerous browser script with an embedded link http://carma666.byethost12.com/32.html.

Once the embedded link will be executed then it downloads JavaScript of coinminer named CoinHive that utilize the infected system resource and generate the revenue.

Also Read:

Malware Abuse Google Ads to Injecting Coinhive Cryptocurrency Miner

Chinese Threat Actors Rocke Launching Sophisticated Crypto-mining Malware to Mine Monero Cryptocurrency