New Crypto-Mining Malware ZombieBoy Exploits Multiple CVEs for Maximum Impact

Minimalist · Aug 1, 2018

Independent security researcher James Quinn described ZombieBoy, a new family of crypto-mining malware, in AlienVault on July 18. The name comes from the ZombieBoyTools kit the malware uses to drop its first dynamic link library (DLL) file. Much like MassMiner, ZombieBoy is a highly infectious worm, but it uses WinEggDrop rather than MassScan to identify new hosts.

Before recently shutting down one of its addresses on Monero mining pool MineXMR, the crypto-mining malware was raking in approximately $1,000 worth of the digital currency every month, according to Quinn. Based on its use of the Simplified Chinese language, ZombieBoy likely originates from China.
Click to expand...

https://securityintelligence.com/ne...oy-exploits-multiple-cves-for-maximum-impact/

EASTER · Aug 1, 2018

The initial malware package, ZombieBoy.dll, is delivered using the EternalBlue and DoublePulsar exploits, with potential targets identified using the WinEggDrop port scanner. Once this is installed several files are executed.

These are a sequence of executable files which initially download over 70 files These include the XMRig module, the exploits and a copy of itself on the device It obtains the user’s IP address, scans for new devices, downloads and execute a Gh0stRat variant the RAT that collects system and user information. Whilst remaining heavily encrypted.

The final RAT file is used to decrypt and install Loader.dll, another RAT that creates registry entries and runtime objects to ensure persistence.

Prior to shutting down one of its addresses on minexmr.com, ZombieBoy was mining at around 43KH/s. This would earn the attackers slightly over $1,000 USD per month at current Monero prices.
Click to expand...

https://www.systemtek.co.uk/2018/07/zombieboy-cryptocurrency-rat-worm/

Log in or Sign up

New Crypto-Mining Malware ZombieBoy Exploits Multiple CVEs for Maximum Impact

Minimalist Registered Member

EASTER Registered Member

Log in or Sign up

New Crypto-Mining Malware ZombieBoy Exploits Multiple CVEs for Maximum Impact

Minimalist Registered Member

EASTER Registered Member

Useful Searches