The Latest in IT Security

Skypemageddon by bitcoining

05
Apr
2013

Is it a Skype day? Or maybe a Bitcoin one? Or maybe just both?

I say this because right after I published my previous
post
about malware ongoing campaign on Skype, a mate from
Venezuela sent me a screenshot of her Skype client with a similar
campaign in terms of propagation but different in terms of origins and
purposes. Here is the original screenshot:

(Translation from Spanish: ?this is my favorite picture of you?)


This campaign is born right today and is ongoing too:

An average clicking is also pretty high with more than 2k clicks
per hour
. Most of potential victims live in Italy then Russia,
Poland, Costa Rica, Spain, Germany, Ukraine and others.

The initial dropper is downloaded from a server located in India.
The detection rate on VirusTotal
is low. Once the machine is infected it drops to the system many
other pieces of malware. Downloads come from the Hotfile.com
service. At the same time the malware connects to its C2 server
located in Germany.

The IP address of C2 is 213.165.68.138:9000

So what does malware do? To be honest many things but one of the
most interesting is it turns the infected machine to a slave of the
bitcoin generator. The usage of CPU grows up significantly. Here is
an example:

The mentioned process runs with the command ?bitcoin-miner.exe
-a 60 -l no -o http://suppp.cantvenlinea.biz:1942/ -u
[email protected] -p XXXXXXXX
? (sensitive data was
replaced by XXXXXX) It abuses the CPU of infected machine to mine
Bitcoins for the criminal.

As I said the campaign is quite active. If you see your machine is
working hard, using all available CPU resources, you may be
infected.

The initial dropper is detected by Kaspersky as Trojan.Win32.Jorik.IRCbot.xkt.

Follow me on twitter: @dimitribest

Leave a reply


Categories

FRIDAY, JULY 19, 2019
WHITE PAPERS

Mission-Critical Broadband – Why Governments Should Partner with Commercial Operators:
Many governments embrace mobile network operator (MNO) networks as ...

ARA at Scale: How to Choose a Solution That Grows With Your Needs:
Application release automation (ARA) tools enable best practices in...

The Multi-Model Database:
Part of the “new normal” where data and cloud applications are ...

Featured

Archives

Latest Comments

Social Networks