Researchers Find Anti-Detection Monero Mining Malware

Thursday, 15/08/2019 | 09:34 GMT by Arnab Shome
  • Malicious malware targets mostly mid-sized enterprises.
Researchers Find Anti-Detection Monero Mining Malware
Pixabay

Security researchers have discovered yet another piece of crypto-jacking malware targeting victims computers to mine Monero.

Dubbed “Norman,” the malware was discovered by Varonis Security Research. According to the firm, the malware primarily targets computers at mid-sized enterprises to utilize computing power to mine CPU-centric coins like Monero.

“Almost every server and workstation was infected with malware. Most were generic variants of crypto miners. Some were password dumping tools, some were hidden PHP shells, and some had been present for several years,” the researchers noted.

The malware is based on XMRig, which is believed to a high-performance mining algorithm for Monero.

In addition, to avoid detection, the malware closes its mining process when Task Manager is opened and relaunches the process when it is closed.

“Norman employs evasion techniques to hide from analysis and avoid discovery,” the security company noted.

The malware is based on the PHP programming language and is likely to have originated from a French-speaking country, as the researchers found french variables in the code.

“The malware may have originated from France or another French-speaking country: the SFX file had comments in French, which indicate that the author used a French version of WinRAR to create the file,” the report stated.

Monero - a perfect coin for crypto jackers

Monero is one of the favorites of crypto jackers. Unlike Bitcoin or Ethereum , which use GPU-centric processing power, this cryptocurrency can be mined on any device using unutilized CPU power.

Last year, another security research group found more than a hundred pieces of crypto-jacking malware concealed within Flash installers that target computers when users attempt to download the software.

Mobile devices have also become the target of crypto jackers, and Finance Magnates earlier reported that one such piece of malware targeted vulnerable Android devices.

Security researchers have discovered yet another piece of crypto-jacking malware targeting victims computers to mine Monero.

Dubbed “Norman,” the malware was discovered by Varonis Security Research. According to the firm, the malware primarily targets computers at mid-sized enterprises to utilize computing power to mine CPU-centric coins like Monero.

“Almost every server and workstation was infected with malware. Most were generic variants of crypto miners. Some were password dumping tools, some were hidden PHP shells, and some had been present for several years,” the researchers noted.

The malware is based on XMRig, which is believed to a high-performance mining algorithm for Monero.

In addition, to avoid detection, the malware closes its mining process when Task Manager is opened and relaunches the process when it is closed.

“Norman employs evasion techniques to hide from analysis and avoid discovery,” the security company noted.

The malware is based on the PHP programming language and is likely to have originated from a French-speaking country, as the researchers found french variables in the code.

“The malware may have originated from France or another French-speaking country: the SFX file had comments in French, which indicate that the author used a French version of WinRAR to create the file,” the report stated.

Monero - a perfect coin for crypto jackers

Monero is one of the favorites of crypto jackers. Unlike Bitcoin or Ethereum , which use GPU-centric processing power, this cryptocurrency can be mined on any device using unutilized CPU power.

Last year, another security research group found more than a hundred pieces of crypto-jacking malware concealed within Flash installers that target computers when users attempt to download the software.

Mobile devices have also become the target of crypto jackers, and Finance Magnates earlier reported that one such piece of malware targeted vulnerable Android devices.

About the Author: Arnab Shome
Arnab Shome
  • 7315 Articles
  • 133 Followers
About the Author: Arnab Shome
Arnab Shome is an electronics engineer-turned-financial editor. He holds a Bachelor of Technology from the National Institute of Technology, Agartala. He entered the retail trading industry about a decade ago, covering the cryptocurrency market for Finance Magnates, and later expanded his coverage to include forex and CFDs as well. His work at Finance Magnates includes C-level interviews, data-driven analysis, opinion pieces, and scoops of industry exclusives. He also contributes to Finance Magnates’ quarterly industry report. Area of coverage: 1. CFD broker-related news 2. Industry-related Regulatory updates and developments 3. New retail trading trends 4. Prop trading industry updates 5. Executive interviews Education: Bachelor of Technology - National Institute of Technology, Agartala (India)
  • 7315 Articles
  • 133 Followers

More from the Author

CryptoCurrency

!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|} !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}