Malware News WinstarNssmMiner Coinminer Campaign Makes 500,000 Victims in Three Days (shuts down AV products)

[LASER_oneXM]

Content source

https://www.bleepingcomputer.com/news/security/winstarnssmminer-coinminer-campaign-makes-500-000-victims-in-three-days/

Security researchers from Qihoo 360 Total Security have detected a massive malware campaign spreading a new coinminer, and which appears to have made roughly 500,000 victims in three days alone.

At the heart of this campaign is a new malware strain named WinstarNssmMiner, targeting Windows computers.

Under the hood, WinstarNssmMiner is your typical cryptocurrency-mining malware these days, based on the open-source and legitimate Monero mining utility named XMRig.

WinstarNssmMiner shuts down AV products

Qihoo 360 researchers did not say how WinstarNssmMiner spreads, but they said this coinminer is unique to other cryptocurrency-mining threats active on the market today.

The typical WinstarNssmMiner modus operandi, according to researchers, is the following:

...
.....
.......

 

[Atlas147]

interesting report, article goes on to describe the infection " Scan for Avast and Kaspersky antivirus process. If user is using one of the two, abandon infection "

Wonder what Avast and Kaspersky are doing right for the malware authors to be so vigilant with these 2 AVs and not the rest.

 

[yitworths]

interesting report, article goes on to describe the infection " Scan for Avast and Kaspersky antivirus process. If user is using one of the two, abandon infection "

Wonder what Avast and Kaspersky are doing right for the malware authors to be so vigilant with these 2 AVs and not the rest.

the malware is actually taunting other AV products. & it's a shame for other av products if it lets a malware to run svchost.exe process, whatever it's modus operandi is. Or behaviour blocker of those av is just a facade.

 

[upnorth]

According to existing research on the malicious use of XMRig, black-hat developers have hardly applied any changes to the original code. Past modifications show some changes to hardcoded command-line arguments that contain the attacker’s wallet address and mining pool URL, plus changes to a few arguments that kill all previously running instances of XMRig to ensure no one else benefits from the same hardware. Changes of this scope could take mere minutes to perform.

The world of cryptojacking malware is undergoing rapid evolution, and although permutations of XMRig will likely continue to occur, there is also a threat that new codes will appear this year. Mitigating the risk from known threats should be an integral part of your cyber hygiene and security management practices. While malware hunting is often regarded as a whack-a-mole endeavor, preventing XMRig-based malcode is easier because of its prevalence in the wild.

Since XMRig is open source and keeps getting reused in attacks, security teams should look into controls that deliver blanket protection and eliminate different iterations of this code. For those running older servers and operating systems in which risk of infection is higher, security best practices call for minimizing exposure, implementing compensating controls and planning for a prompt upgrade to dampen risks.

XMRig: Father Zeus of Cryptocurrency Mining Malware?

More information about another XMRig operation as it give clues on how it's delivered :

Large Scale Monero Cryptocurrency Mining Operation using XMRig

 

[Atlas147]

the malware is actually taunting other AV products. & it's a shame for other av products if it lets a malware to run svchost.exe process, whatever it's modus operandi is. Or behaviour blocker of those av is just a facade.

Hopefully the others learn a little from this tiny piece of malware and up their game for their self protection modules on their AVs