Rewterz Threat Alert – P2P Worm Spreads Crypto Miners in the Wild

Severity

Medium

Analysis Summary

A white paper was published by Yoroi exploring the risks that users can encounter when downloading materials from P2P sharing network, such as the Torrent one. They discussed how crooks easily lure their victims to download malware along with the desired content.

Technical Analysis

As anticipated, the file downloaded from the BitTorrent network is an executable. A quick recon revealed it actually is an SFX archive containing several other files.

The archive contains more than a dozen of files. In detail it embeds:

• 16 temporary files used during execution;
• a Visual Basic Script;
• a batch script;
• and a setup file

It is possible to see the SFX configuration file. After the auto-extraction, the first file run is “run.vbs”. Its content is minimal and quickly redirect the execution to a small batch file, “installer.bat” contained in the same folder. Then it runs installer.bat (the filename) with the parameter “0? (WindowStyle hidden, to avoid hidden windows because it may trigger AntiViruses heuristics) and “true” (WaitOnReturn).

The content of “installer.bat” file is also minimal and points to a more complex text file “007.tmp”, later renamed as “007.bat”.

Impact

Exposure of sensitive information

Indicators of Compromise

Malware Hash (MD5/SHA1/SH256)

• 552a4cbd2628d16d1fc910c9fc24bc426cafdf0f755f7b4013484adbc0393ca7
• 73bc41504045e4e6de1b63ec40433afabf316141b1289c69905ee946e1b1a263
• 746d17e8d0b961f0c7733f155152fa54d2610fc6d117217d24f32d3ad370075e
• 7bd25bd3c0f003ffea67c846b4fefd8fb8b4f72d836544d0ef786c5c6c63b422
• a3574e73234e18be8d233c9e3fa3819600fc40341d8be8fc4449e4e73632ad6d
• b6080b2786d2e4ac30207fb2f177046cfd40fa6578c56f3dfd13abab7d62e2ea
• f9b2e61200addf760d7bd157c73201e97257b12d5177837a1bffb98f4064e76a

Remediation

• Always research before downloading any software from internet.
• Always scan your files.
• Always download from the publisher’s site.