sha1:
- 4ffae4669eba9938639662667f5430a806e56980
- 7717e9c5d85e77653bf65e57ed20f89086c3e3ed
Description
A trojan for Windows OS written in C++. It is a miner loader based on the open source SilentCryptoMiner project. The code is obfuscated using a modified Obfuscate library. The loader arrives on infected computers attached to a distribution of pirated software. Unpacking the installation package revealed the paths where the trojan's source files were stored:
C:\bot_sibnet\Resources\softportal\exe\
C:\bot_sibnet\Resources\protect_build\miner\According to the Dr.Web Cloud service, more than 3,000 infection attempts were detected in December.
Once launched, the loader copies itself to %ProgramFiles%\google\chrome\ under the name updater.exe and creates a scheduler task to ensure its loading at system startup. For stealth purposes, the task is named GoogleUpdateTaskMachineQC. The loader also runs Powershell to add itself to Windows Defender exceptions.
powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Then it prevents the computer from shutting down or hibernating.
cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 &powercfg /x -standby-timeout-dc 0
The initial settings are embedded in the trojan’s body; then the settings are downloaded from a remote host. Once initialized, this loader injects Trojan.BtcMine.2742, the payload responsible for hidden cryptocurrency mining, into explorer.exe.
In addition, in terms of functionality, this loader can:
- Install the r77 fileless rootkit on a compromised computer,
- Disable Windows updates (by stopping the UsoSvc, WaaSMedicSvc, Wuauserv, BITS, and DoSvc services and renaming their corresponding registry branches),
- Block access to websites (by modifying the hosts file),
- Automatically delete and restore its files,
- Suspend the cryptocurrency mining process and free the RAM and VRAM occupied by the miner when the user launches process monitors.
