Monday, June 24, 2024

Dangerous Underminer Exploit Kit Delivers a Cryptocurrency-mining Malware and Bootkit

A new exploit kit dubbed Underminer spreading through advertising servers that delivers bootkit which affects system boot sectors and the cryptocurrency-mining malware called Hidden Mellifera.

Underminer manages to secure the malware transfers through encrypted transmission control protocol (TCP) and it packs malware as read-only filesystem ROM files.

Security researchers from Trend Micro detected the Underminer’s activity on July 17 at it is primarily targeting Asian countries. The encryption tunnel and dumb file format make payload challenging to analyze for researchers.


The exploit appeared to be created in November 2017 and it exploiting the following vulnerabilities.

CVE-2016-0189 memory corruption vulnerability in Internet Explorer (IE)
CVE-2015-5119 use-after-free vulnerability in Adobe Flash Player
CVE-2018-4878 use-after-free vulnerability in Adobe Flash Player

Underminer Encrypted Tunnel and Capabilities

According to researchers, Underminer contains multiple functionalities such as browser profiling and filtering, preventing of client revisits, URL randomization, and asymmetric encryption of payloads.

When the user’s accessed the exploit kit’s landing page it detects the user’s browser Agent type and the Adobe Flash Player version. If the client profile, not suits for Underminer it redirect’s user’s to the normal site instead of causing an infection.

Also, it set’s a token with a browser cookie and if the user accesses the malicious URL again it redirects them to an HTTP page with 404 error message.

It protects the exploit code and the traffic by using an asymmetric RSA encryption and the symmetric algorithms RC4 or Rabbit.

Before the exploitation Underminer generates a random key and passes to command-and-control (C&C) server. the same key to be used for encrypting javascript and exploits.

Decryption of the exploit payload or javascript can be done only with the private key that Underminer’s operators know.

Underminer Exploitation

Threat actors behind exploit Underminer exploit multiple security flaws and has similar infection chain but differs with execution.

With the Internet Explorer (IE) Exploit CVE-2016-0189, a malicious javascript file downloaded and executed through regsvr32.exe and the malicious DLL loaded executed with rundll32.exe that retrieves the second stage payload.

The infection chain for flash exploit CVE-2015-5119 & CVE-2018-4878 is fileless, the infection starts with the shellcode executed through iexplorer.exe that downloads the malicious cabinet file executed with rundll32.exe that retrieves the second stage payload.


The second payload downloads additional payloads via encrypted TCP tunnel and the third stage of the payload decodes them from romfs and execute it.

In the fourth stage, it coredll.bin reads the configuration files, checks the environment and then drops the files.coredll’s the main function is to migrate it self-based on the configuration. The coredll execution flow is migrated to another process which is usually signed by the manufacturer or currently running an AV program.

The fifth and the final stage of the payload, the setup2.pkg responsible for installing the bootkit from the romfs file and the pgfs.pkg installs the cryptocurrency-mining Malware. Trend Micro published a blog post along with the technical description.

“we expect Underminer to hone their techniques to further obfuscate the ways they deliver their malicious content and exploit more vulnerabilities while deterring security researchers from looking into their activities.” researchers said.


It is always recommended to update your application and to patch your system’s and network.

If the backdoor was already uploaded on an infected server, it is possible to block the communication between to immobilize the backdoor.

Deploying a backdoor shell protection systems to identify and intercept all malicious incoming request.

Also Read

Most Advanced Backdoor Obfuscation and Evasion Technique That used by Hackers

Hackers Distributing FELIXROOT Backdoor Malware using Microsoft Office Vulnerabilities

Malwarebytes New Browser Extension That Protects you From Visiting Malicious Websites

New Variant of Dangerous Kronos Banking Malware Spreading via Malicious Word Documents


Latest articles

Threat Actor Claiming a 0-day in Linux LPE Via GRUB bootloader

A new threat actor has emerged, claiming a zero-day vulnerability in the Linux GRUB...

LockBit Ransomware Group Claims Hack of US Federal Reserve

The notorious LockBit ransomware group has claimed responsibility for hacking the U.S. Federal Reserve,...

Microsoft Power BI Vulnerability Let Attackers Access Organizations Sensitive Data

A vulnerability in Microsoft Power BI allows unauthorized users to access sensitive data underlying...

Consulting Companies to Pay $11 Million Failing Cybersecurity Requirements

Two consulting companies, Guidehouse Inc. and Nan McKay and Associates, have agreed to pay...

New RAT Malware SneakyChef & SugarGhost Attack Windows Systems

Talos Intelligence has uncovered a sophisticated cyber campaign attributed to the threat actor SneakyChef....

Chinese Winnti Group Intensifies Financially Motivated Attacks

Hackers are increasingly executing financially motivated attacks and all due to the lucrative potential...

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from for...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles