The talent over at Malwarebytes broke a story this week regarding Fake Flash Player phishing attempts dropping malicious content onto victim machines for the purpose of mining Bitcoins. The threat tricks users into thinking that they are downloading a new version of Flash Player. In actuality, the threat drops a few malicious executables (stored in "[username]/AppData/Roaming/Data"), called Control.exe and svchost.exe. Once the threat is up and running, it communicates over a specific port for the purposes of mining Bitcoins.
I did some digging of my own to see if there are other such instances of phishing attacks made by this threat. I found a variant as described in MalwareBytes blog based on the dropped files and the string ".pw/blam/flashplayerv". The end result was an additional 21 files which display similar network traffic patterns as those mentioned in the companion blog.
The conclusion we can reach is that Bitcoin mining is proving to have reached a point where it is profitable enough to be on the radar for scammers. Administrators should take note of the traffic patterns mentioned here and monitor for similar transactions. It should also be stated that the above list contains some still active download locations for this threat, and that the VT results can be confusing. All of the MD5s mentioned above are detected across the board as different threats ranging from InfoStealers to Backdoor trojan droppers. This shows that regardless of the initial focus of the malicious executable, bitcoin mining is still a profitable enough for scammers to bundle into their ill-gotten gains.
I did some digging of my own to see if there are other such instances of phishing attacks made by this threat. I found a variant as described in MalwareBytes blog based on the dropped files and the string ".pw/blam/flashplayerv". The end result was an additional 21 files which display similar network traffic patterns as those mentioned in the companion blog.
- hXXp://testcomplex.ru/start.rar
- hXXp://testcomplex.ru/start.rar
- hXXp://testcomplex.ru/start.rar
- hXXp://testcomplex.ru/install.exe
- hXXp://37.49.225.116/min.gif
- hXXp://apl.wipmania.com.stcus.ru/icon/n.gif
- hXXp://apl.wipmania.com.stcus.ru/icon/n.gif
- hXXp://37.49.224.190/minfd.gif
- hXXp://37.49.224.190/min.gif
- hXXp://37.49.224.190/mymin.gif
- hXXp://v.wipmsc.ru/7.gif
- hXXp://apl.wipmania.com.stcus.ru/icon/n.gif
- hXXp://194.63.143.179/winupd.exe
- hXXp://afox-news.pw/blam/flashplayerv10.1.57.108.exe
- hXXp://api9.wipmania.com.wipmsc.ru/api9.gif
- hXXp://api9.wipmania.com.wipmsc.ru/api9.gif
- hXXp://api9.wipmania.com.wipmsc.ru/api9.gif
- hXXp://api9.wipmania.com.wipmsc.ru/api9.gif
- hXXp://www.darxk.com/aviatic/systema.exe
- hXXp://api9.wipmania.com.wipmsc.ru/api9.gif
- hXXp://www.marc-weding.de/images/banners/sysmonitor.exe
- hXXp://www.darxk.com/aviatic/systema.exe
The conclusion we can reach is that Bitcoin mining is proving to have reached a point where it is profitable enough to be on the radar for scammers. Administrators should take note of the traffic patterns mentioned here and monitor for similar transactions. It should also be stated that the above list contains some still active download locations for this threat, and that the VT results can be confusing. All of the MD5s mentioned above are detected across the board as different threats ranging from InfoStealers to Backdoor trojan droppers. This shows that regardless of the initial focus of the malicious executable, bitcoin mining is still a profitable enough for scammers to bundle into their ill-gotten gains.
