ZombieBoy, a new Monero miner that allows to earn $1,000 on a monthly basis
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-0143 +1 in the same advisory: …0146 | Remote Code Execution in Microsoft Windows SMBv1 (EternalBlue family) CVE-2017-0143 is a remote code execution flaw in the SMBv1 server implementation shipped with a wide range of Windows releases; it is one of the March 2017 'MS17-010' SMBv1 bugs (an EternalBlue-family flaw) and is distinct from CVE-2017-0144, -0145, -0146 and -0148. An attacker triggers it by sending specially crafted packets to a target's SMBv1 service over the network, gaining the ability to execute arbitrary code on the host. Because SMB is commonly reachable inside enterprise networks (and sometimes from the internet), exploitation has enabled wormable spread, ransomware (WannaCry), coin miners (Adylkuzz), and DOUBLEPULSAR backdoor implants. Anyone running unpatched, SMBv1-enabled systems from the affected list is exposed: Windows from Vista/Server 2008 through Windows 10 1607 and Server 2016, plus third-party products embedding Windows, including Philips IntelliSpace Portal and Siemens ACUSON/syngo/Versant medical systems. Exploitation is heavily confirmed in the wild: the Buckeye group used the tools before the Shadow Brokers leak, followed by mass exploitation by WannaCry, Adylkuzz, Uiwix and EternalRocks; the flaw is in CISA's KEV (added 2021-11-03, ransomware use known) and EPSS is 93.3%. Do: Apply Microsoft's MS17-010 security updates (March 2017 cumulative updates or later) to all listed Windows versions, per the CISA KEV required action. Disable SMBv1 where feasible, block or restrict inbound TCP 445 from untrusted networks, and check exposed hosts for DOUBLEPULSAR implants; public Metasploit modules (EternalBlue/EternalRomance/EternalSynergy/EternalChampion) can be used to verify exploitability. For Philips IntelliSpace Portal and Siemens ACUSON/syngo/Versant medical systems, apply the vendors' MS17-010 firmware/advisory updates. | 8.8 | 93% | KEV ransomware PoC ×5 |
| masshundreds of millions of Windows installations potentially affected (SMBv1 enabled by default), with hundreds of thousands of hosts exposing SMB/port 445… | |
| CVE-2017-9073 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-0176. Reason: This candidate is a reservation duplicate of CVE-2017-0176. Notes: All CVE users should reference CVE-2017-0176 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage NVD description · AI analysis pending | — | — | — | — |
Full article338 words · extracted from securityaffairs.com · click to collapse
A security researcher discovered a new crypto mining worm dubbed ZombieBoy that leverages several exploits to evade detection.
The security researcher James Quinn has spotted a new strain of crypto mining worm dubbed ZombieBoy that appears to be very profitable and leverages several exploits to evade detection.
The expert called this new malware ZombieBoy because it uses a tool called ZombieBoyTools to drop the first dll, it uses some exploits to spread.
Unlike MassMiner cryptocurrency miner, ZombieBoy leverages WinEggDrop instead of MassScan to search for new hosts to infect.
The cryptocurrency uses Simplified Chinese language, which suggests that its author is a Chinese coder.
The ZombieBoy mine leverages several exploits, including:
- CVE-2017-9073, RDP vulnerability on Windows XP and Windows Server 2003
- CVE-2017-0143, SMB exploit
- CVE-2017-0146, SMB exploit
ZombieBoy also uses both NSA-linked exploits DoublePulsar and EternalBlue exploits to remotely install the main dll. The malware used the ZombieBoyTools to install the two exploits.
Once the has established a backdoor in the target system it could deliver other families of malware, such as ransomware, and keyloggers.
According to Quinn’s, the 64.exe module downloaded by ZombieBoy uses the DoublePulsar exploit to install both an SMB backdoor as well as an RDP backdoor.
The same component uses XMRIG to mine Monero coins at 43 KH/s, that means that users can earn $1,000 on a monthly base at the current rate.
“In addition, 64.exe uses XMRIG to mine for XMR. Prior to shutting down one of its addresses on minexmr.com, ZombieBoy was mining at around 43KH/s. This would earn the attackers slightly over $1,000 per month at current Monero prices.” continues the analysis.
Quinn highlighted that the miner is being updated constantly, he is observing new samples on a daily base.
The malware is able to detect VM and doesn’t run in a virtualized environment to make hard its detection.
Further details including IoCs are reported in the analysis published by the expert.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – miner, Monero)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/75070/malware/zombieboy-monero-miner.html