Rewterz Threat Alert – Dexphot Malware Hijacked 80K+ Windows Computers to Mine Cryptocurrency

Severity

High

Analysis Summary

A new malware strain dubbed Dexphot has attacked more than 80,000 windows computers to mine cryptocurrency and target monitoring services and scheduled tasks to rerun the infection if windows defender removed it. The malware uses fileless techniques, it gets malicious codes executed directly in memory and also it hijacks the legitimate process to hide the malicious activity.
An obfuscated script designed to check for antivirus products, and regularly-scheduled malware updates is used in the infection to install a coin miner that silently steals computer resources and generates revenue for the attackers. During the initial execution stage, Dexphot first writes five key files to the disk. With the exception of one of the files – an installer with two URLs – most of these files are legitimate processes, making detection of the malware difficult. These legitimate system processes include msiexec.exe (for installing MSI packages later in the process), rundll32.exe (for loading a loader DLL, which later downloads a password-protected ZIP archive), unzip.exe (for extracting files from the password-protected ZIP archive), schtasks.exe (for scheduled tasks), powershell.exe (for forced updates). Meanwhile, the lone non-legitimate file (SoftwareBundler:Win32/ICLoader) is primarily used to run the Dexphot installer.

Once running, the installer then uses two URLs to download malicious payloads. Dexphot also uses these two URLs later to establish persistence, update the malware and re-infect the device.

Impact

• Process hijacking
• Cryptocurrency mining

Indicators of Compromise

Domain Name

winc[.]com

MD5

• 3b9c87fab8d8d63073eda151c95c51c6
• eaf2fac5c3474ce2016ed0c94e3e8db7
• 65ed10b49ea4bb2d07a5d677854fc2d2
• 9a3bc2e33e24696329b46feaab0ad68d
• 7d32ab66e40d145b67bce42b871624e5

SHA-256

• aa5c56fe01af091f07c56ac7cbd240948ea6482b6146e0d3848d450977dff152
• 22beffb61cbdc2e0c3eefaf068b498b63a193b239500dab25d03790c467379e3
• 504cc403e0b83233f8d20c0c86b0611facc040b868964b4afbda3214a2c8e1c5
• 72acaf9ff8a43c68416884a3fff3b23e749b4bb8fb39e16f9976643360ed391f
• 537d7fe3b426827e40bbdd1d127ddb59effe1e9b3c160804df8922f92e0b366e

Remediation

• Block the threat indicators at their respective controls.
• Refrain from visiting untrusted URLs found in email attachments, Ads or elsewhere on the internet.
• Do not download files attached in unexpected emails.