SHA1:
- a843ad31c1a1da3f078d14e8680577f85f077f69
Description
A phase 5 trojan in a multi-phase infection sequence that facilitates data theft, clipboard contents monitoring, backdoor deployment, rogue mining and infecting other files.
- Phase 1 —Trojan.DownLoader49.35384,
- Phase 2 —Trojan.DownLoader49.35687,
- Phase 3 —BackDoor.Siggen2.5906,
- Phase 4 —Trojan.Packed2.50953, Trojan.BtcMine.3956—phase 5 downloader.
This malware engages in rogue mining.
Operation
Mining commences if the user hasn't pressed any keys or moved the mouse cursor for five minutes. The malware uses readily available open-source tools:
- XMRig – a CPU miner.
- T-Rex – a miner for NVIDIA video cards.
- TeamRedMiner – a miner for AMD video cards.
Mining doesn't start if the trojan detects any of these processes belonging to system monitoring tools running on the device:
ProcessHacker.exe
processhacker.exe
procexp64.exe
Process Explorer.exe
Wireshark.exe
Autoruns.exe
Autorunsc.exe
procmon.exe
Procmon64.exe
tcpview.exe
Tcpview64.exe
handle.exe
Handle64.exe
pipelist.exe
RAMMap.exe
RAMMap64.exe
vmmap.exe
Vmmap64.exe
MITRE ATT@CK MATRIX
| Tactic | Technique |
|---|---|
| Discovery |
System information discovery (T1082) Process discovery (T1057) |
More about Trojan.DownLoader49.35384
More about Trojan.DownLoader49.35687
More about BackDoor.Siggen2.5906
