The authors thank their colleagues Oliver Devane and Deepak Setty for their help with this analysis.
McAfee Labs researchers have discovered new Russian malware, dubbed WebCobra, which harnesses victims’ computing power to mine for cryptocurrencies.
Coin mining malware is difficult to detect. Once a machine is compromised, a malicious app runs silently in the background with just one sign: performance degradation. As the malware increases power consumption, the machine slows down, leaving the owner with a headache and an unwelcome bill, as the energy it takes to mine a single bitcoin can cost from $531 to $26,170, according to a recent report.
The increase in the value of cryptocurrencies has inspired cybercriminals to employ malware that steals machine resources to mine crypto coins without the victims’ consent.
The following chart shows how the prevalence of miner malware follows changes in the price of Monero cryptocurrency.
Figure 1: The price of cryptocurrency Monero peaked at the beginning of 2018. The total samples of coin miner malware continue to grow. Source: https://coinmarketcap.com/currencies/monero/.
McAfee Labs has previously analyzed the cryptocurrency file infector CoinMiner; and the Cyber Threat Alliance, with major assistance from McAfee, has published a report, “The Illicit Cryptocurrency Mining Threat.” Recently we examined the Russian application WebCobra, which silently drops and installs the Cryptonight miner or Claymore’s Zcash miner, depending on the architecture WebCobra finds. McAfee products detect and protect against this threat.
We believe this threat arrives via rogue PUP installers. We have observed it across the globe, with the highest number of infections in Brazil, South Africa, and the United States.
Figure 2: McAfee Labs heat map of WebCobra infections from September 9–13.
This cryptocurrency mining malware is uncommon in that it drops a different miner depending on the configuration of the machine it infects. We will discuss that detail later in this post.
Behavior
The main dropper is a Microsoft installer that checks the running environment. On x86 systems, it injects Cryptonight miner code into a running process and launches a process monitor. On x64 systems, it checks the GPU configuration and downloads and executes Claymore’s Zcash miner from a remote server.
Figure 3: WebCobra’s installation window.
After launching, the malware drops and unzips a password-protected Cabinet archive file with this command:
Figure 4: The command to unzip the dropped file.
The CAB file contains two files:
- LOC: A DLL file to decrypt data.bin
- bin: Contains the encrypted malicious payload
The CAB file uses the following script to execute ERDNT.LOC:
Figure 5: The script to load the DLL file, ERDNT.LOC.
ERDNT.LOC decrypt data.bin and passes the execution flow to it with this routine:
- [PlainText_Byte] = (([EncryptedData_Byte] + 0x2E) ^ 0x2E) + 0x2E
Figure 6: The decryption routine.
The program checks the running environment to launch the proper miner, shown in the following diagram:
Figure 7: Launching the proper miner depending on a system’s configuration.
Once data.bin is decrypted and executed, it tries a few anti-debugging, anti-emulation, and anti-sandbox techniques as well as checks of other security products running on the system. These steps allow the malware to remain undetected for a long time.
Most security products hook some APIs to monitor the behavior of malware. To avoid being found by this technique, WebCobra loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs.
List of unhooked ntdll.dll APIs
- LdrLoadDll
- ZwWriteVirtualMemory
- ZwResumeThread
- ZwQueryInformationProcess
- ZwOpenSemaphore
- ZwOpenMutant
- ZwOpenEvent
- ZwMapViewOfSection
- ZwCreateUserProcess
- ZwCreateSemaphore
- ZwCreateMutant
- ZwCreateEvent
- RtlQueryEnvironmentVariable
- RtlDecompressBuffer
List of unhooked user32.dll APIs
- SetWindowsHookExW
- SetWindowsHookExA
Infecting an x86 system
The malware injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with these strings. This is another check by WebCobra to determine if it is running in an isolated environment designed for malware analysis.
- adw
- emsi
- avz
- farbar
- glax
- delfix
- rogue
- exe
- asw_av_popup_wndclass
- snxhk_border_mywnd
- AvastCefWindow
- AlertWindow
- UnHackMe
- eset
- hacker
- AnVir
- Rogue
- uVS
- malware
The open windows will be terminated if any of preceding strings shows in the windows title bar text.
Figure 8: Terminating a process if the windows title bar text contains specific strings.
Once the process monitor executes, it creates an instance of svchost.exe with the miner’s configuration file specified as an argument and injects the Cryptonight miner code.
Figure 9: Creating an instance of svchost.exe and executing the Cryptonight miner.
Finally, the malware resumes the process with the Cryptonight miner running silently and consuming almost all the CPU’s resources.
Figure 10: An x86 machine infected with the Cryptonight miner.
Infecting an x64 system
The malware terminates the infection if it finds Wireshark running.
Figure 11: Checking for Wireshark.
The malware checks the GPU brand and mode. It runs only if one of the following GPUs is installed:
- Radeon
- Nvidia
- Asus
Figure 12: Checking the GPU mode.
If these checks are successful, the malware creates the following folder with hidden attributes and downloads and executes Claymore’s Zcash miner from a remote server.
- C:\Users\AppData\Local\WIX Toolset 11.2
Figure 13: Requesting the download of Claymore’s Zcash miner.
Figure 14: Claymore’s miner.
Figure 15: Executing the miner with its configuration file.
Finally, the malware drops a batch file at %temp%\–xxxxx.cMD to delete the main dropper from [WindowsFolder]\{DE03ECBA-2A77-438C-8243-0AF592BDBB20}\*.*.
Figure 16: A batch file deleting the dropper.
The configuration files of the miners follow.
Figure 17: Cryptonight’s configuration file.
This configuration file contains:
- The mining pool: 5.149.254.170
- Username: 49YfyE1xWHG1vywX2xTV8XZzbzB1E2QHEF9GtzPhSPRdK5TEkxXGRxVdAq8LwbA2Pz7jNQ9gYBxeFPHcqiiqaGJM2QyW64C
- Password: soft-net
Figure 18: Claymore’s Zcash miner configuration file.
This configuration file contains:
- The mining pool: eu.zec.slushpool.com
- Username: pavelcom.nln
- Password: zzz
Coin mining malware will continue to evolve as cybercriminals take advantage of this relatively easy path to stealing value. Mining coins on other people’s systems requires less investment and risk than ransomware, and does not depend on a percentage of victims agreeing to send money. Until users learn they are supporting criminal miners, the latter have much to gain.
MITRE ATT&CK techniques
- Exfiltration over command and control channel
- Command-line interface
- Hooking
- Data from local system
- File and directory discovery
- Query registry
- System information discovery
- Process discovery
- System time discovery
- Process injection
- Data encrypted
- Data obfuscation
- Multilayer encryption
- File deletion
Indicators of compromise
IP addresses
- 149.249.13:2224
- 149.254.170:2223
- 31.92.212
Domains
- fee.xmrig.com
- fee.xmrig.com
- ru
- zec.slushpool.com
McAfee detections
- CoinMiner Version 2 in DAT Version 8986; Version 3 in DAT Version 3437
- l Version 2 in DAT Version 9001; Version 3 in DAT Version 3452
- RDN/Generic PUP.x Version 2 in DAT Version 8996; Version 3 in DAT Version 3447
- Trojan-FQBZ, Trojan-FQCB, Trojan-FQCR Versions 2 in DAT Version 9011; Versions 3 in DAT Version 3462
Hashes (SHA-256)
- 5E14478931E31CF804E08A09E8DFFD091DB9ABD684926792DBEBEA9B827C9F37
- 2ED8448A833D5BBE72E667A4CB311A88F94143AA77C55FBDBD36EE235E2D9423
- F4ED5C03766905F8206AA3130C0CDEDEC24B36AF47C2CE212036D6F904569350
- 1BDFF1F068EB619803ECD65C4ACB2C742718B0EE2F462DF795208EA913F3353B
- D4003E6978BCFEF44FDA3CB13D618EC89BF93DEBB75C0440C3AC4C1ED2472742
- 06AD9DDC92869E989C1DF8E991B1BD18FB47BCEB8ECC9806756493BA3A1A17D6
- 615BFE5A8AE7E0862A03D183E661C40A1D3D447EDDABF164FC5E6D4D183796E0
- F31285AE705FF60007BF48AEFBC7AC75A3EA507C2E76B01BA5F478076FA5D1B3
- AA0DBF77D5AA985EEA52DDDA522544CA0169DCA4AB8FB5141ED2BDD2A5EC16CE
The post WebCobra Malware Uses Victims’ Computers to Mine Cryptocurrency appeared first on McAfee Blogs.
