Rewterz Threat ALert – MyKings Variant With Bootloader Persistence

Severity

High

Analysis Summary

Trend Micro published a blog post analyzing a variant of the MyKings botnet malware that includes a new bootloader persistence mechanism. The threat was originally detected through EternalBlue exploitation activity, which MyKings uses to propagate laterally. Upon install, the MyKings malware establishes persistence via several different methods, including through registry Run keys, scheduled tasks, and WMI objects. This most recent variant also expanded its persistence capabilities by adding a bootloader component. The bootkit alters kernel-level functions in order to ensure that the malicious code is executed on startup and that the difficulty of cleaning up the infection is greatly increased. The bootkit and other persistence mechanisms are used to perform a series of actions that eventually reach the goal of downloading additional payloads. One of the main payload types distributed by MyKings is cryptocurrency miners, which serve the purpose of providing a profit to the botnet operators.

Impact

Exposure of sensitive information

Indicators of Compromise

URLs

• http[:]//js.mykings[.]top:280/helloworld[.]msi
• hxxp[:]//js[.]mykings.top:280/v[.]sc

Malware Hash (MD5/SHA1/SH256)

• e8ddefd237646a47debc01df9aa02fbcae40686f96b7860511c73798c7546201
• 7a4f2f2702fababb0619556e67a41d0a09e01fbfdb84d47b4463decdbb360980
• d5f907f9d2001ee5013c4c1af965467714bbc0928112e54ba35d142c8eab68bf
• 790c213e1227adefd2d564217de86ac9fe660946e1240b5415c55770a951abfd
• 80f8ba7992a5dbaa4a2f76263258d5d7bf3bb8994f9e8a4a5294f70ab8e38ea4
• ab26a859633d1ec68e021226fab47870ed78fc2e6a58c70a7a7060be51247c1d
• a3bb132ab1ba3e706b90d6fb514504105f174c4e444e87be7bce1995f798044d
• 79bcb0b7ba00c4c65bf9b41cfe193fd917d92ab1d41456ac775836cec5cadc9a

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the link/attachments sent by unknown senders.