Cybercriminals target graphic designers with GPU miners

MITRE Techniques

• [T1218.005] Signed Binary Proxy Execution – Msiexec – The attackers use msiexec.exe to execute the dropped malicious batch through the trojanized installer. Quote: “The attack sequence is initiated when a victim clicks on a legitimate software installer, which the attacker bundled with a malicious script using Advanced Installer. The installer then drops a malicious batch script named “core.bat” and the legitimate PE executable “viewer.exe,” an Advanced Installer component as “MSI72E2.tmp” in the local user profile application data temporary folder. To execute the malicious script, the attackers abused Advanced Installer’s Custom Action feature by including command-line arguments to execute the dropped malicious batch file.”
• [T1059.001] PowerShell – The campaign uses PowerShell loaders (cor.ps1, PS-2) and a PowerShell downloader to decrypt and execute payloads. Quote: “drops a malicious PowerShell loader script named “cor.ps1” (PS-1) and an encrypted file named “core.bin” which is the M3_Mini_RAT client stub.”
• [T1105] Ingress Tool Transfer – The PowerShell downloader fetches a malicious ZIP from attacker-controlled servers to %windir%, then unzips to drop PS-2, ENC-2 and the PhoenixMiner binary. Quote: “The downloaded PowerShell loader downloads a malicious ZIP archive from an attacker-controlled server to the %windir% location on the victim’s machine. It unzips its contents to drop another PowerShell loader script “core.ps1” (PS-2), an encrypted file (ENC-2), and an Ethash miner called PhoenixMiner executable…”
• [T1053.005] Scheduled Task – The malware creates tasks (e.g., ViGEmBusUpdater, MSI Task Host – Detect_Monitor) to run PowerShell loaders at defined intervals. Quote: “The malicious batch script “core.bat,” which was dropped during the initial execution stage of the software installer, contains a command to configure the task scheduler in the victim’s machine… schtasks /create …”
• [T1140] Deobfuscate/Decode Files or Information – The encrypted payloads are decrypted to generate and execute the M3_Mini_Rat client stub and PowerShell loaders. Quote: “decrypts the encrypted file “core.bin” to generate the M3_Mini_Rat client stub.”
• [T1036] Masquerading – The attacker uses file names like svhost.exe to resemble legitimate svchost.exe, attempting to evade detection. Quote: “The PowerShell launcher runs PhoenixMiner… The attacker uses the filename “svhost.exe,” which closely matches the legitimate Windows executable filename “svchost.exe” in the Windows systems folder, possibly trying to go unnoticed…”
• [T1095] Non-Application Layer Protocol – The M3_Mini_Rat client communicates with a C2 over a TCP channel (port 3434), indicating a non-application-layer C2 path. Quote: “the RAT client connects to the command and control server by establishing a TCP connection on port 3434.”