Rewterz Threat ALert – MyKings Variant With Bootloader Persistence

August 21, 2019

Severity

High

Analysis Summary

Trend Micro published a blog post analyzing a variant of the MyKings botnet malware that includes a new bootloader persistence mechanism. The threat was originally detected through EternalBlue exploitation activity, which MyKings uses to propagate laterally. Upon install, the MyKings malware establishes persistence via several different methods, including through registry Run keys, scheduled tasks, and WMI objects. This most recent variant also expanded its persistence capabilities by adding a bootloader component. The bootkit alters kernel-level functions in order to ensure that the malicious code is executed on startup and that the difficulty of cleaning up the infection is greatly increased. The bootkit and other persistence mechanisms are used to perform a series of actions that eventually reach the goal of downloading additional payloads. One of the main payload types distributed by MyKings is cryptocurrency miners, which serve the purpose of providing a profit to the botnet operators.

Impact

Exposure of sensitive information

Indicators of Compromise

URLs

http[:]//js.mykings[.]top:280/helloworld[.]msi
hxxp[:]//js[.]mykings.top:280/v[.]sc

Malware Hash (MD5/SHA1/SH256)

e8ddefd237646a47debc01df9aa02fbcae40686f96b7860511c73798c7546201
7a4f2f2702fababb0619556e67a41d0a09e01fbfdb84d47b4463decdbb360980
d5f907f9d2001ee5013c4c1af965467714bbc0928112e54ba35d142c8eab68bf
790c213e1227adefd2d564217de86ac9fe660946e1240b5415c55770a951abfd
80f8ba7992a5dbaa4a2f76263258d5d7bf3bb8994f9e8a4a5294f70ab8e38ea4
ab26a859633d1ec68e021226fab47870ed78fc2e6a58c70a7a7060be51247c1d
a3bb132ab1ba3e706b90d6fb514504105f174c4e444e87be7bce1995f798044d
79bcb0b7ba00c4c65bf9b41cfe193fd917d92ab1d41456ac775836cec5cadc9a

Remediation

Block all threat indicators at your respective controls.
Always be suspicious about emails sent by unknown senders.
Never click on the link/attachments sent by unknown senders.