{"uuid": "3d24b33d-0390-4c1e-9969-bdd1f279742d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-10271", "type": "exploited", "source": "https://t.me/information_security_channel/15424", "content": "Fileless Crypto-Mining Malware Discovered\nhttp://feedproxy.google.com/~r/Securityweek/~3/HNDxMrHJyQs/fileless-crypto-mining-malware-discovered\n\nMalicious crypto-miners have invaded the threat landscape over the past year, fueled by a massive increase in the value of crypto-currency.\u00a0\nA recent attack discovered by security researchers from\u00a0Minerva Lab used malware dubbed GhostMiner, which has adopted the most effective techniques used by other malware families, including fileless infection attacks.\nFocused on mining  Monero crypto-currency, the new threat used PowerShell evasion frameworks \u2013 Out-CompressedDll and Invoke-ReflectivePEInjection \u2013 that employed fileless techniques to hide the malicious code. \nEach of the malware\u2019s components was designed for a different purpose: one PowerShell script to ensure propagation to new machines, and another to perform the actual mining operations. \n\u201cThis evasive approach was highly effective at bypassing many security tools: some of the payloads analyzed were fully undetected by all the security vendors,\u201d Minerva Labs\u2019 Asaf Aprozper and Gal Bitensky reveal. \nThe security researchers compared the detection of the malicious executable with and without the fileless method and discovered that, once the fileless module is removed, most of the VirusTotal vendors would detect the payload. \nThe PowerShell script in charge with infecting new victims targets servers running Oracle\u2019s WebLogic (leveraging the CVE-2017-10271 vulnerability), MSSQL, and phpMyAdmin. \nDespite that, however, the attack only attempts to exploit WebLogic servers, the security researchers say. For that, the malicious code randomly probes IP addresses, creating numerous new TCP connections per second, in an attempt to discover vulnerable targets.\nCommunication with the command and control (C&C) server is performed via HTTP through Base64-encoded requests and replies. The protocol the malware uses to exchange messages involves a simple hand shake followed by a request to perform various tasks. Once the task is completed, a new request is sent to the server. \nLaunched directly from memory, the mining component is a slightly customized version of the open source XMRig miner. \nThe mining operation, Minerva Labs researchers say, had been running for about three weeks by the time they discovered it, but the attackers have made only 1.03 Monero (around $200) to date, based on the employed wallet. However, the attackers might also be using addresses that the researchers haven\u2019t detected yet. \n\u201cAnother potential explanation for the low \u2018revenues\u2019 of the GhostMiner campaign is the aggressive rivalry between mining gangs. There are plenty of potential victims, but the exploits and techniques they use are public. The attackers are aware that their competitors share the same toolset and try to infect the same vulnerable machines,\u201d the security researchers note. \nThe analysed sample itself contained a variety of techniques meant to kill the process of any other miner running on the targeted machine. These include PowerShell\u2019s \u201cStop-Process -force\u201d command, stopping blacklisted services and blacklisted scheduled tasks by name using exe, and stopping and removing miners by their commandline arguments or by looking at established TCP connections.\nMinerva Labs security researchers also suggest that defenders use similar methods as these \u201ccompetitor killers\u201d to prevent malicious miners from running on endpoints. They even provide a killer script that can be modified for such purposes. \nRelated: Fileless Attacks Ten Times More Likely to Succeed: Report\n\n                         \n            \n            \n  \n        \n                         \n            \n                \n            \n            \n            \n                Tweet (http://twitter.com/share)", "creation_timestamp": "2018-03-28T18:40:31.000000Z"}