KingMiner malware targets Windows server and utilizes entire CPU resources to mine Monero. The malware primarily targets Microsoft Servers using IIS\SQL.
The malware was first identified in June 2018, security researchers form Checkpoint detected new version of KingMiner with significant that bypass several detection engines.
KingMiner malware gains access to the machines by using brute force method to download Windows Scriptlet file (.sct) on the victim’s machine.
Then it will detect the CPU architecture of the infected machine and downloads the XML payload file based on the CPU architecture. The downloaded zip file includes five files.
config.json – XMRig CPU miner configuration file.
md5.txt – Text file containing only the string “zzz.”
powered.exe (called fix.exe in older versions) – The main executable file.
soundbox.dll/soundbox.dll – DLL files containing functions to be exported by powered.exe.
x.txt/y.png – Binary blob files. Note – This is not a real PNG file.
Researchers said the powered.exe is executed, then it creates XMRig miner and appends key on the registry, and executes functions from DLL files.
The function King1 decodes the binary blob file x.txt & y.png, which is the modified version of the XMRig CPU miner.
The XMRig CPU Miner designed to consume only 75% of the CPU resource but it consumes of 100%. The malware is evolving constantly and it has placeholders for future operations or upcoming updates which will make this malware even harder to detect.
Powerful Mobile Malware Rotexy Launched over 70,000 Attacks with Banking Trojan & Ransomware Modules
$60 Million Worth Cryptocurrencies Stolen Hackers From Japanese Cryptocurrency Exchange
The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…
White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…
Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…
The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…
Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…
WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…