Malware News New Botnet Hides in Blockchain DNS Mist and Removes Cryptominer

[LASER_oneXM]

Content source

https://www.bleepingcomputer.com/news/security/new-botnet-hides-in-blockchain-dns-mist-and-removes-cryptominer/

Fbot pushes out cryptomining malware

Fbot spreads by scanning for devices with an open port 5555, used by the ADB (Android Debug Bridge) service on Android, and then retrieving a script via the ADB interface.

One of the script's functions is to uninstall 'com.ufo.miner' malware. Another is to download the main payload, Fbot, which comes embedded with details on contacting the command and control (C2) server. The third function is to self-destruct.
Fbot appears to have a positive impact on a system previously infected with com.ufo.miner, as it looks for processes (SMI, RIG, XIG) associated with cryptomining activity and kills them.

Fbot's technical details are intriguing, and it is unclear if it is the work of a do-gooder or an adversary looking to get rid of competition. However, some of the methods used may become more popular with cybercriminals looking to protect their business. What is sure at the moment is that Fbot eliminates a cryptomining malware and takes its place on the victim system.