Before WannaCry, coin mining botnets

[vorticalbox]

http://thehackernews.com/2017/05/smb-exploit-cryptocurrency-mining.html?m=1

 

Quote

According to Kafeine, a security researcher at Proofpoint, another group of cyber criminals was using the same EternalBlue exploit, created by the NSA and dumped last month by the Shadow Brokers, to infect hundreds of thousands of computers worldwide with a cryptocurrency mining malware called 'Adylkuzz.'

This malicious campaign went unnoticed for weeks because unlike WannaCry, this malware does not install ransomware or notify victims, but instead, it quietly infects unpatched computers with malware that only mine 'Monero,' a Bitcoin-like cryptocurrency

 

Quote

The Researcher believes Adylkuzz malware attack could be larger in scale than WannaCry ransomware attack because it has been designed to block SMB ports of a targeted computer after hijacking it.

In other words, Adylkuzz malware infects unpatched computers and then closes SMB ports to prevent them from further infections, which may have indirectly saved hundreds of thousand of computers from getting hacked by WannaCry ransomware as well.

 

This malware is smarter than wanna cry as it blocks the port so no other infects can happen it has also made more money. 

 

Quote

In other words, Adylkuzz malware infects unpatched computers and then closes SMB ports to prevent them from further infections, which may have indirectly saved hundreds of thousand of computers from getting hacked by WannaCry ransomware as well.

 

Mining cryptocurrencies can be a costly investment as it requires an enormous amount of computing power, but the Adylkuzz cryptocurrency-mining malware makes it easier for cybercriminals by allowing them to utilize computing resources of compromised systems and makes lots and lots of dollars.

this isn't the only one going around. 

 

Quote

Last week, in a separate research, GuardiCore researchers uncovered a new botnet malware, dubbed BondNet, that was also infecting Windows machines worldwide, with a combination of techniques, for mining cryptocurrencies — primarily Monero, but also ByteCoin, RieCoin, and ZCash.
 

Seems this attack is far far bigger than wanna cry, which was to be expected.

 

please friends if you haven't updated your computer do it as soon as possible. 

[The Benjamins]

this type is scarier due to it not being detected for longer, it doesn't splash a screen in your face that you got infected.

[vorticalbox]

2 minutes ago, The Benjamins said:

this type is scarier due to it not being detected for longer, it doesn't splash a screen in your face that you got infected.

also cost you more in power costs. 

[The Benjamins]

Just now, vorticalbox said:

also cost you more in power costs. 

I still would rather pay a higher power bill for a month then loss a lot of important data.

[mr moose]

The painful thing about this is you don't know when you were infected so if you backup with complete images like I do you wouldn't know how far back you have to go to get rid of it.

[Guest]

I've never mined for coins so I'm not an expert. But mining takes up alot of processing power right? More processing power = more heat. So wouldn't you notice when your computer suddenly sounds like an jet engine when checking Facebook? 

[Teddy07]

3 minutes ago, Cheezdoodlez said:

But mining takes up alot of processing power right? 

1

True. Problem is mostly inexperienced people get infected so they are less likely to nice the slowdown and heat

[Crossbred]

25 minutes ago, Teddy07 said:

True. Problem is mostly inexperienced people get infected so they are less likely to nice the slowdown and heat

Only noobz get viruses. Duh.

[AnonymousGuy]

Real talk: are all these "not bitcoin" coins complete bullshit?  They seem to only exist because teenagers are in an arms race trying to be "first in" while they're still easy to get, but really there's nothing behind them.

[piemadd]

how would you detect it?

 

I am guessing some sort of program in task manager

 

[Sauron]

4 hours ago, The Benjamins said:

this type is scarier due to it not being detected for longer, it doesn't splash a screen in your face that you got infected.

 

4 hours ago, vorticalbox said:

also cost you more in power costs. 

At least it doesn't encrypt mission crytical data though  I'd rather mine some cryptocurrency for someone else then lose, say, work files or pictures or whatever.

 

Of course it doesn't directly apply to me because the important stuff is on a linux server.

[SpaceGhostC2C]

1 hour ago, AnonymousGuy said:

Real talk: are all these "not bitcoin" coins complete bullshit?  They seem to only exist because teenagers are in an arms race trying to be "first in" while they're still easy to get, but really there's nothing behind them.

As much as bitcoin itself, basically.

 

What I don't understand is the point of infecting random computers. As far as I understand, if your system is slow enough you won't be able to mine anything anyway... I guess that by "mining" newer versions they are more likely to get something out of some consumer PCs, but how much will that amount to anyway?

[Phate.exe]

1 hour ago, Implosivetech said:

how would you detect it?

 

I am guessing some sort of program in task manager

I picked one up a while back.  In short, I noticed my computer was running like dogshit and looked through all processes to see what was using a lot of CPU.

 

Found a process labelled "I.exe" sucking down up resources.  Did a bunch of digging, removed all permissions for that process, then nuked it and all of it's friendsI.  Hasn't seemed to come back since.

 

Honestly not sure how long it was on there.  If it was set up semi-intelligently it would sit dormant for a few days to a week to see if the computer gets left on and runs at low load for long periods of time (during the workday, overnight, etc) before it starts slamming the CPU to avoid detection.

[piemadd]

38 minutes ago, Phate.exe said:

I picked one up a while back.  In short, I noticed my computer was running like dogshit and looked through all processes to see what was using a lot of CPU.

 

Found a process labelled "I.exe" sucking down up resources.  Did a bunch of digging, removed all permissions for that process, then nuked it and all of it's friendsI.  Hasn't seemed to come back since.

 

Honestly not sure how long it was on there.  If it was set up semi-intelligently it would sit dormant for a few days to a week to see if the computer gets left on and runs at low load for long periods of time (during the workday, overnight, etc) before it starts slamming the CPU to avoid detection.

My computer has been reaching 71% load recently, which is very high. The ram usually bottlenecks it to around 40%. Pls inform whatever directories it was stored in. I will investigate tonight. 

[BuckGup]

54 minutes ago, SpaceGhostC2C said:

As much as bitcoin itself, basically.

 

What I don't understand is the point of infecting random computers. As far as I understand, if your system is slow enough you won't be able to mine anything anyway... I guess that by "mining" newer versions they are more likely to get something out of some consumer PCs, but how much will that amount to anyway?

I you think a CPU is slow it to mine bitcoins it is. Now take an ASIC and it mines it exponentially faster. Well have enough CPUs and you basically have yourself an ASIC. The CPUs aren't made for the algorithm so it isn't 100% the same but free power and hashing power is profit.

[Zodiark1593]

And here I thought everyone here keeps task manager open like a religion. 

 

A sudden spike in cpu usage without my say so pokes my OCD. The computer is my servant after all. 

[Phate.exe]

19 minutes ago, Zodiark1593 said:

And here I thought everyone here keeps task manager open like a religion. 

 

A sudden spike in cpu usage without my say so pokes my OCD. The computer is my servant after all. 

Yeah if there is any sort of "I'm not running anything, why is my computer running like crap", I start looking.

 

36 minutes ago, Implosivetech said:

My computer has been reaching 71% load recently, which is very high. The ram usually bottlenecks it to around 40%. Pls inform whatever directories it was stored in. I will investigate tonight. 

 

I'd imagine it picks some fairly random process name.  "I.exe" looks obvious and sketchy as hell.

 

My only recommendation is to open up Task Manager while your computer is chugging, sort by CPU usage, and look for anything that's using a lot of juice.  You should be able to right-click on the process and either "open file location" or "properties" to find where it lives.  Start googling to see if anyone else has seen it before.  Once you've established that you're looking at the correct executable, you should be able to remove all access privileges, hit "end task", and delete it.

 

Then run you should be able to just nuke the files.  Once you've done that, run a full system scan one after another with whatever AV software you have.

[vorticalbox]

5 hours ago, SpaceGhostC2C said:

As much as bitcoin itself, basically.

 

What I don't understand is the point of infecting random computers. As far as I understand, if your system is slow enough you won't be able to mine anything anyway... I guess that by "mining" newer versions they are more likely to get something out of some consumer PCs, but how much will that amount to anyway?

estimates say 200,000 devices and upto 5 figures a day. A small devices will mine very slow but have 200,000 all mining the same worker it adds up. 

[jagdtigger]

11 hours ago, The Benjamins said:

this type is scarier due to it not being detected for longer, it doesn't splash a screen in your face that you got infected.

It can be detected if users would take better care of their PC, if the coolers running at top speed 24/7 then its either the paste or you have "unwanted visitors" .

[Phate.exe]

4 minutes ago, jagdtigger said:

It can be detected if users would take better care of their PC, if the coolers running at top speed 24/7 then its either the paste or you have "unwanted visitors" .

Part of what makes me unsure of how long I had the one I picked up is the fact that the machine has a water loop and was being used as a server for a bit.  It's quiet, and sounds no different at full load than it does at idle.

[jagdtigger]

3 minutes ago, Phate.exe said:

Part of what makes me unsure of how long I had the one I picked up is the fact that the machine has a water loop and was being used as a server for a bit.  It's quiet, and sounds no different at full load than it does at idle.

Buy a cheap USB display and have task manager run on it... Or an aquaero.

[SpaceGhostC2C]

12 hours ago, BuckGup said:

I you think a CPU is slow it to mine bitcoins it is. Now take an ASIC and it mines it exponentially faster. Well have enough CPUs and you basically have yourself an ASIC. The CPUs aren't made for the algorithm so it isn't 100% the same but free power and hashing power is profit.

 

7 hours ago, vorticalbox said:

estimates say 200,000 devices and upto 5 figures a day. A small devices will mine very slow but have 200,000 all mining the same worker it adds up. 

 

But only if you can efficiently combine the work of all those nodes. What surprises me is that running in your toaster and my potato, and then gathering the output through the internet, and only while our computers are on and online, could amount to something relevant (again, under the assumption that if you are too slow someone beats you to it and you get zero).