Rewterz Threat Alert – CoinMiner Malware – Active IOCs

Severity

High

Analysis Summary

CoinMiner is a type of malware that is designed to secretly mine cryptocurrencies, such as Bitcoin, on infected computers. The malware is typically spread through email attachments, malicious websites, or software downloads, and can infect both personal and business computers.

Once installed, CoinMiner malware will use the computer’s processing power to solve complex mathematical algorithms and earn cryptocurrency for the hackers who created the malware. This can slow down the infected computer and cause it to overheat, potentially causing damage to the hardware.

CoinMiner malware is often difficult to detect because it is designed to run quietly in the background without drawing attention to itself. However, there are some signs that your computer may be infected with CoinMiner malware, including:

• Sluggish performance
• Increased CPU usage
• Overheating
• Fans running at a high speed
• Increased electricity bills

To prevent CoinMiner malware and other types of malware from infecting your computer, it’s important to keep your operating system and antivirus software up to date, avoid downloading software or opening email attachments from unknown sources, and be cautious when visiting unfamiliar websites.

Impact

• Financial Loss
• Hardware Damage
• Data Loss

Indicators of Compromise

MD5

• 3766ae21daf5a63d48270894d2d264c4
• 6e1fb94a58ec4452ffeb912d148fd183
• 25a1e0a4d436eea408e79a07f45ff684
• c9f5e5246a9d05f6a99c914bb92f02e0
• 3f5f0392410c7d6a2cb1038cb088c1c5
• 36e6d352d14c90d3c6aa3bbc40949670
• b63ae38d8187ffc261e05f8c1d238bb4

SHA-256

• ab99af2866f3e87cbf63d9c3200b88c16cadb2127cc1b59b788c28cfa53d33cc
• 8f617574075cf1085737dae37f04e656ed39fab3f7bcaae9867b84d9d8badb41
• 8f4c3348423dbc5dadff663216b4b015109535a06e5a81fb7cb3993a90ff26c5
• ee95e54aff137684ac10a38bf9a7f5f359d80c3115e7c30777062e369efcda77
• 6063f4a85853fc5f0e09968c9d06c0fdae1d9651f7a73e2d10dc2916c109dd51
• b4fe3db7a70963bd006d9856215611f1a554a1a27a23ce6f88c1d3f87058c1c2
• 025429f14dd5f97af96341d98540c66ade0d61051812622d47bf33371eb7daa9

SHA-1

• 3e457366fcc4a8434ad441e965fa060a453bfd8b
• 3e143bdb0157c37d3104edc46df04b7c97cfce8a
• da6fbf78868b855451769fb1255f7c2cdef66ace
• 22f7fbb8a15ca0f3dd1bb92aa38631dd68044923
• 8d01f32b07a0b044e13bbfe433fa346884fe28cf
• 6208ef0bd606487ac4daa4a2342028e901a9694f
• 806574b1e76d4d5c74ea171281301a3471c63b31

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• In addition, users can also consider using ad-blockers and disabling JavaScript in their web browsers to reduce the risk of drive-by downloads of CoinMiner malware.