SHA1:
- 46b8955c8fa07994f8cb3c11dff0a277c7353730 (xmr-1.7z)
- 0909fe2c42c4b3480313671dde00d4e0fd756f1b (xmrig.exe, x86)
- 0785a05695428436a95e875b058268cfb1347207 (xmrig.dll, x86)
- f5c766423bf6a1eca4b2063da8464e2f09778920 (start.js)
- 1c5e358185f15ae619dceb353adce18a2221ff19 (xmr-1-64.7z)
- c9e4dd2f67a4aa2aaa152e92df4fe137d1d73b78 (xmrig.exe, x64)
- 2710c02c6e069b94fc2708eae42f309b1313bf5d (xmrig.dll, x64)
- d91fc46d9af39fb1bbb45f1c4970437b49497edf (start.js)
Description
A module of the MonsterInstall trojan. It’s downloaded on user devices as an xmr-1.7z or xmr-1-64.7z archive.
The contents of the archive:
- node_modules,
- dump,
- moonlight.exe is an executable Node.js file,
- start.js,
- windows-update.exe is a Windows calculator copy,
- xmrig.dll;
where dump, start.js, xmrig.dll are trojan files.
Operating routine
start.js downloads the xmrig.dll file and calls its exported function “mymain”.
xmrig.dll expands its environment variables and terminates the processes:
- %sys32_86%\xmr,
- %sys32_86%\xmr64,
- %pf_86%\Microsoft JDX\32\windows-update.exe,
- %pf_86%\Microsoft JDX\64\windows-update.exe.
If the xmrig.exe file is in the same directory, the trojan loads it into the memory of the current process, erases the MZ signature, decrypts it using XOR with 0x39, and then saves its dump as a file called “dump”. If the trojan finds the “dump” file in the same directory, it decrypts it the same way, launches windows-update.exe and embeds in it the decrypted payload.
xmrig.exe (dump)
The trojan collects information about the system and installed malware and sends it via POST request to the URL: http://cherry-pot[.]top/RemoteApps/xmr/main.php.
{"action":"enter","architecture":"INTEL","cpuAES":true,"cpuCache":8192,"cpuSpeed":3392.0,"cpuThreads":2,"cpuVendorString":" Intel(R) Core(TM) i5-4690S CPU @ 3.20GHz\u0000","hightPages":false,"login":"null","password":"null","ramPhysicalSize":3071,"xmrigVersion":[2,10,0]}
The server replies with the following configuration:
{"maxCpuLoad":1000,"minCpuLoad ":0,"algo":"cryptonight-pico/trtl","av":0,"background":false,"donate-level":1,"max-cpu-usage":75,"retries":5,"retry-pause":5,"cpu-priority":1,"pools":[{"url":"185.224.133.91:5511","keepalive":true,"nicehash":true}]}
The trojan saves the configuration into config.json and starts mining.
