Tuesday, November 26, 2024
HomeComputer SecurityHackers Using RIG Exploit Kit to Compromise Windows PC for Mining Crypto-Currency

Hackers Using RIG Exploit Kit to Compromise Windows PC for Mining Crypto-Currency

Published on

A RIG Exploit Kit (EK) propagating sophisticated code injection techniques to mine Monero cryptocurrency from infected Windows PC.

Rig Exploit Kit is one of the powerful exploit kits that actively using in dark web and delivered various payload for many malware and ransomware families such as  GandCrab ransomware and Panda Banker.

Code injection Technique is used to inject malicious code into an application. The code introduced or injected is capable of compromising database integrity and/or compromising privacy website, security and even data correctness.

- Advertisement - SIEM as a Service

Attack chain initially started from the compromised website when users visit it which will then redirect them to RIG EK landing page.

Later RIG delivered the malicious loader NSIS (Nullsoft Scriptable Install System) to leverage the code injection technique and inject shellcode into explorer.exe.

Later infected shell code leverage the next level payload and the payload will download the Monero miner and execute it.

RIG Exploit Kit Injection analysis

Intially user visit the compromised page that contains an iframes which leads into the landing page of the RIG and it contains 3 javascript loader each contains differnet technique to deliver the paylaod.

  • Javascript 1 contains a function called “fa” which returns the VBscript that exploits  CVE-2016-0189 which allows it to download the payload.
  • Javascript 2 contains aditional javascript code to download the another exploit CVE-2015-2419  which utilizes a vulnerability in JSON.stringify.
  • Third Javascript similar to the second one and it adds a flash object that exploits CVE-2018-4878.

According to FireEye Analysis, Once all the exploitation will successfully completed  the shellcode invokes a command line to create a JavaScript file which will then download the next level of Paylaod with the filename called u32.tmp.

Apart from the code infection technique, Attackers using maltiple varaity of payload to evade the detection using anti analysis and anti VM techniques.

3 Stages of Payloads

First Stage of execution contain the SmokeLoader payload that contains two components: a DLL, and a data filewhich is dropped by the RIG EK which helps to read and decrypt the data file and redirect into the second level of Payload.

When we compare to the first level of payload, the second level is higly obfucticated and it perfrom the propagation of the code injection and inject the shellcode and PE in to legitimate windows process.

Third stage of the payload will check and confirm to make sure no analysis tool is runnig within the victms computer and the malware then communicates with the malicious URL to download the final payload.

The Final payload is the Monero Miner which is downloaded from the server and installed into the windows system to mine the Monero cryptocurrency.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting...

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ...

XSS Vulnerability in Bing.com Let Attackers Send Crafted Malicious Requests

A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to...

Meta Removed 2 Million Account Linked to Malicious Activities

 Meta has announced the removal of over 2 million accounts connected to malicious activities,...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Digital Wallets Bypassed To Allow Purchase With Stolen Cards

Digital wallets enable users to securely store their financial information on smart devices and...

Best SIEM Tools List For SOC Team – 2024

The Best SIEM tools for you will depend on your specific requirements, budget, and...

Oracle Releases Biggest Security Update in 2024 – 372 Vulnerabilities Are Fixed – Update Now!

Oracle has released its April 2024 Critical Patch Update (CPU), addressing 372 security vulnerabilities...