MyKings botnet still active and making massive amounts of money

guest · Oct 13, 2021

MyKings botnet still active and making massive amounts of money
October 13, 2021
https://www.bleepingcomputer.com/ne...l-active-and-making-massive-amounts-of-money/

The MyKings botnet (aka Smominru or DarkCloud) is still actively spreading, making massive amounts of money in crypto, five years after it first appeared in the wild.

Being one of the most analyzed botnets in recent history, MyKings is particularly interesting to researchers thanks to its vast infrastructure and versatile features, including bootkits, miners, droppers, clipboard stealers, and more.
Click to expand...

The botnet uses many cryptocurrency wallet addresses, with the balances in some of them being quite high. Avast believes that these wallets' cryptocurrency was amassed by the clipboard stealer and the crypto mining components.

The earnings reflected in the wallet addresses linked to MyKings are approximately $24.7 million. However, since the botnet uses more than 20 cryptocurrencies in total, this amount is only a part of its total financial gains.
To protect the hardcoded wallet address value from extraction and analysis, the malware encrypts it with a simple ROT cipher.
Click to expand...

New URL substitution tricks
Apart from the wallet address substitution that diverts transactions, Avast has also spotted a new monetization technique used by MyKings operators involving the Steam gaming platform.
The modified links point to Yandex storage addresses containing RAR or ZIP archives named "photos," which deliver a copy of the MyKings malware to these machines.

Today, it appears that the botnet has grown to new proportions while still managing to remain hidden and free from law enforcement crackdowns.
Click to expand...

Avast: The King is Dead, Long Live MyKings! (Part 1 of 2)

MyKings is a long-standing and relentless botnet which has been active from at least 2016. Since then it has spread and extended its infrastructure so much that it has even gained multiple names from multiple analysts around the world — MyKings, Smominru, and DarkCloud, for example. Its vast infrastructure consists of multiple parts and modules, including bootkit, coin miners, droppers, clipboard stealers, and more.

In this first part of our two-part blog series, we will peek into the already known clipboard stealer module of MyKings, focusing on its technical aspects, monetization, and spread. In addition, we’ll look into how the functionality of the clipboard stealer enabled attackers to carry out frauds with Steam trade offers and Yandex Disk links, leading to more financial gain and infection spread.
Click to expand...

Log in or Sign up

MyKings botnet still active and making massive amounts of money

guest Guest

Log in or Sign up

MyKings botnet still active and making massive amounts of money

guest Guest

Useful Searches