A new malware strain dubbed Dexphot has attacked more than 80,000 windows computers to mine cryptocurrency and target monitoring services and scheduled tasks to rerun the infection if windows defender removed it. The malware uses fileless techniques, it gets malicious codes executed directly in memory and also it hijacks the legitimate process to hide the malicious activity.
An obfuscated script designed to check for antivirus products, and regularly-scheduled malware updates is used in the infection to install a coin miner that silently steals computer resources and generates revenue for the attackers. During the initial execution stage, Dexphot first writes five key files to the disk. With the exception of one of the files – an installer with two URLs – most of these files are legitimate processes, making detection of the malware difficult. These legitimate system processes include msiexec.exe (for installing MSI packages later in the process), rundll32.exe (for loading a loader DLL, which later downloads a password-protected ZIP archive), unzip.exe (for extracting files from the password-protected ZIP archive), schtasks.exe (for scheduled tasks), powershell.exe (for forced updates). Meanwhile, the lone non-legitimate file (SoftwareBundler:Win32/ICLoader) is primarily used to run the Dexphot installer.
Once running, the installer then uses two URLs to download malicious payloads. Dexphot also uses these two URLs later to establish persistence, update the malware and re-infect the device.