Thursday, March 28, 2024

Fileless Cryptocurrency Miner that affects Windows Machine Through WMI and EternalBlue

Nowadays Hackers Distributing Advanced Fileless Malware with Evasion capabilities which are very Difficult to Detect. Security experts from Trend Micro Identified a new crypto miner which uses Fileless malware Techniques.

It uses Windows Management Instrumentation for fileless persistence and uses scrcons.exe to execute its scripts. In order to enter into the system, it uses EternalBlue vulnerability – MS17-010.This combination makes malware more powerful.

Infection Chain of Fileless Malware

The infection flow of this cryptocurrency miner malware has many stages. The infection flow starts with MS17-010; the vulnerability is employed to drop and run a backdoor on the system (BKDR_FORSHARE.A), that installs numerous WMI scripts.

Fileless Malware

These scripts then connect with its C&C servers to urge directions and transfer the cryptocurrency miner malware besides its elements. Complete analysis report published by TrendMicro.

Once the javascript executed it connects with Multiple layers of C&C server, first stage hxxp://wmi[.]mykings[.]top:8888/test[.]html has instruction to download Miner also it has the address of other stages.

Fileless Malware
Fileless Malware

These are the following scripts used in triggering the malicious WMI script when the required conditions meet.

ActiveScriptEventConsumer is the persistence payload
__EventFilter class trigger the Event
__IntervalTimerInstruction Exposes Time Interval between Events
__AbsoluteTimerInstruction Event generated on specific time and date
__FilterToConsumerBinding Required for class registration

EternalBlue Malware Developed by National Security Agency (NSA) exploiting Windows based Server Message Block (SMBv1) and to be believed the tool has released by Shadow Brokers hackers Group in April 2017 and it has been used for Wannacry Cyber Attack.

Not all machines need the WMI service. If a machine doesn’t want access to WMI, disable it to eliminate the chance. Microsoft provides a tool which will trace WMI activity. SMBv1 also can be disabled to scale back the chance to users.TrendMicro recommended.

Common Defence’s to stay safe

  • Don’t open the attachments that you are not expecting.
  • Patch or Update your software.
  • Use a reputable security suite.
  • Download applications from Reputed sites.
  • Stay strict with CIA Cycle.
Website

Latest articles

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles