Rewterz Threat Alert – GoMiner spreads via public cloud storage providers
Severity
High
Analysis Summary
A family of Monero Miners that spreads through cloud storage providers such as OneDrive, Google Drive and Dropbox. It also has the ability to mutate or change itself to try to avoid detection.
This malware’s main objective is to mine Monero. It includes in its body a version of XMRig miner. The system infected with this malware will be noticeably slow, as the cryptominer will consume most of the CPU. to extract the XMRig configuration files from the binaries we analyzed and identified at least four mining pools that this miner joins. This indicates that there could be more than one threat actor operating this network of miners.
One unique characteristic of this GoMiner is that it can spread itself via public cloud storage by dropping several copies of itself in “Public” folders.
It looks for the availability of the following files before dropping itself in those directories:
%USERPROFILE%\Dropbox\Public
%USERPROFILE%\OneDrive\Public
%USERPROFILE%\Google Drive
When the above folders exist, it will drop a copy of itself with the following filenames: