#threatreport #MediumCompleteness
Doctor, where did you get these pictures? Using steganography in cryptocurrency mining (getcert campaign) | 24-01-2025
Source:Key details below ↓

🧑‍💻Actors/Campaigns:
Getcert

💀Threats:
Steganography_technique, Silentcryptominer_tool, Amadey, Siggen, 
🤖LLM extracted TTPs:`
T1036, T1027, T1105, T1562, T1140

🧨IOCs:
 - File: 6
 - Domain: 15
 - Url: 48
 - IP: 1
 - Hash: 41
 - Coin: 3

💽Software: Zoom, Windows Defender

🪙Crypto: monero

🔢Algorithms: zip

📜Programming Languages: powershell

#threatreport:
The analysis of telemetry data by specialists from the Doctor Web virus lab revealed malware samples that are part of an active campaign to mine the Monero cryptocurrency. This campaign is unique as it utilizes malicious chains, with two chains involving scripts extracting payloads from BMP image files. The campaign likely began in 2022 when a Services.exe executable file was discovered, which is a .NET application running a VBscript script creating backdoor functions. One of the malware files downloaded is ubr.txt, a PowerShell script that checks for and replaces existing miners on compromised machines with the SilentCryptoMiner miner used by the attackers.

The campaign includes various disguised miner files, such as those posing as software for video calls in Zoom or Windows services, all designed to remove existing miners, install the new miner, and provide updates. Additionally, the campaign accesses the getcert . net domain for cryptocurrency mining settings. The attackers later enhanced the campaign by integrating steganography, a method of concealing information within other data to avoid detection. The newer chain involves the Amadey Trojan running a PowerShell script that downloads BMP images fromextracting executable files from them, including a stealer Trojan and a payload that disables security measures and accesses attacker-controlled domains.

The SilentCryptoMiner miner accessed via steganography is hidden inside images to evade detection, evolving to use legitimate resources and GitHub to store payloads. Modules in the miner check for sandboxes and virtual machines and detect cybersecurity research tools. An associated wallet has received 340 XMR, indicating potentially significant profits for the scammers due to Monero's price volatility. The mining campaign targets ordinary users, with compromised machines producing an average hashrate of 3.3 million hashes per second, generating 1 XMR every 40 hours.

This campaign underscores the growing use of steganography in cyber threats and emphasizes the need for vigilance in the digital landscape. Doctor Web advises caution, recommending software installations only from trusted sources, avoiding suspicious links, and maintaining antivirus protection while downloading files. The threat landscape showcases the advanced techniques employed by cybercriminals, necessitating ongoing awareness and security measures to mitigate risks effectively.

For further details on specific malware components mentioned in the report, readers are encouraged to explore the detailed articles on PowerShell.Starter.98, PowerShell.DownLoader.1640, Trojan.PackedNET.2429, and VBS.DownLoader.2822.
#threatreport #MediumCompleteness