Tuesday, July 23, 2024

KingMiner Malware Targets Windows Servers and Uses 100% CPU To Mine Monero

KingMiner malware targets Windows server and utilizes entire CPU resources to mine Monero. The malware primarily targets Microsoft Servers using IIS\SQL.

The malware was first identified in June 2018, security researchers form Checkpoint detected new version of KingMiner with significant that bypass several detection engines.

KingMiner malware gains access to the machines by using brute force method to download Windows Scriptlet file (.sct) on the victim’s machine.

KingMiner malware

Then it will detect the CPU architecture of the infected machine and downloads the XML payload file based on the CPU architecture. The downloaded zip file includes five files.

config.json – XMRig CPU miner configuration file.
md5.txt – Text file containing only the string “zzz.”
powered.exe (called fix.exe in older versions) – The main executable file.
soundbox.dll/soundbox.dll – DLL files containing functions to be exported by powered.exe.
x.txt/y.png – Binary blob files. Note – This is not a real PNG file.

Researchers said the powered.exe is executed, then it creates XMRig miner and appends key on the registry, and executes functions from DLL files.

The function King1 decodes the binary blob file x.txt & y.png, which is the modified version of the XMRig CPU miner.

The XMRig CPU Miner designed to consume only 75% of the CPU resource but it consumes of 100%. The malware is evolving constantly and it has placeholders for future operations or upcoming updates which will make this malware even harder to detect.

Related Read

Powerful Mobile Malware Rotexy Launched over 70,000 Attacks with Banking Trojan & Ransomware Modules

$60 Million Worth Cryptocurrencies Stolen Hackers From Japanese Cryptocurrency Exchange

Bittrex Cryptocurrency Exchange Delist the Bitcoin Gold After They Declined to Pay 12,372 BTG for Cyber Attack


Latest articles

SonicOS IPSec VPN Vulnerability Let Attackers Cause Dos Condition

SonicWall has disclosed a critical heap-based buffer overflow vulnerability in its SonicOS IPSec VPN....

Hackers Registered 500k+ Domains Using Algorithms For Extensive Cyber Attack

Hackers often register new domains for phishing attacks, spreading malware, and other deceitful activities. Such...

Hackers Claim Breach of Daikin: 40 GB of Confidential Data Exposed

Daikin, the world's largest air conditioner manufacturer, has become the latest target of the...

Emojis Are To Express Emotions, But CyberCriminals For Attacks

There are 3,664 emojis that can be used to express emotions, ideas, or objects...

Beware Of Fake Browser Updates That Installs Malicious BOINC Infrastructre

SocGholish malware, also known as FakeUpdates, has exhibited new behavior since July 4th, 2024,...

Data Breach Increases by Over 1,000% Annually

The Identity Theft Resource Center® (ITRC), a nationally recognized nonprofit organization established to support...

UK Police Arrested 17-year-old Boy Responsible for MGM Resorts Hack

UK police have arrested a 17-year-old boy from Walsall in connection with a notorious...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles