Pirates in the crosshairs: how one cybercrime gang has been infecting book, movie, and TV show fans for years

The campaign distributes a miner and RAT through illegal movie, TV streaming, and digital library sites using fake updates, DLL side-loading, and persistence mechanisms. The activity appears active since at least 2022 and uses rotating domains, encrypted C2 traffic, and injected components to maintain control on infected systems. #SilentCryptoMiner #urush1bar4 #5d14vnfb #107.172.212.235

Keypoints

The malware is spread through pirated streaming sites and digital libraries using a fake plugin update prompt.
The initial ZIP archive contains a legitimate EXE and a malicious DLL, which uses DLL side-loading to run code.
The malicious DLL decrypts a main module that is a modified fork of SilentCryptoMiner.
The malware gathers system data and sends it via DNS tunneling before continuing execution.
With elevated privileges, it disables security tools, adds Defender exclusions, stops MSRT, and configures persistence through GoogleUpdateTaskMachineQC.
A Watchdog component protects the miner by monitoring the service and restoring files if tampering is detected.
The RAT and miner infrastructure uses date-based rotating domains, encrypted payloads, and signed server responses.

MITRE Techniques

[T1574.002] DLL Side-Loading – The malicious DLL is launched alongside a legitimate executable to execute attacker code in a trusted process context (‘Launching the EXE triggered a DLL side-loading mechanism’).
[T1055] Process Injection – The components are injected into target processes without writing to disk (‘the components are injected directly into the memory of the target processes’).
[T1055.012] Process Hollowing – The miner is launched through process hollowing inside explorer.exe (‘passed as a command-line parameter to launch the miner inside the explorer.exe process through process hollowing’).
[T1001.003] Data Obfuscation: Protocol Impersonation – DNS traffic is crafted to look legitimate and hidden behind a microsoft.com-like domain (‘disguise the DNS query as legitimate traffic’).
[T1071.004] DNS – The malware transmits system data using DNS tunneling (‘transmitted as a single large DNS query using the DNS tunneling technique’).
[T1112] Modify Registry – Registry keys are created to prevent MSRT from being offered and to establish persistence (‘DontOfferThroughWUAU parameter is created’ and ‘adding an entry to HKEY_CURRENT_USER…Run’).
[T1562.001] Impair Defenses – Defender exclusions are added and MSRT is disabled to reduce detection (‘adds Windows Defender exclusions’ and ‘It kills Microsoft’s Malicious Software Removal Tool’).
[T1105] Ingress Tool Transfer – The malicious archive is downloaded to the victim device (‘Clicking the link downloaded a ZIP archive’).
[T1543.003] Create or Modify System Process: Windows Service – A service is created/used for persistence (‘GoogleUpdateTaskMachineQC service is registered and configured to launch automatically’).
[T1053.005] Scheduled Task/Job: Scheduled Task – The GoogleUpdateTaskMachineQC mechanism is used to start automatically at boot (‘configured to launch automatically at system startup’).
[T1003] OS Credential Dumping – Not mentioned in the article.

Indicators of Compromise

[URL ] malicious archive download and delivery – urush1bar4[.]online, file[.]ipfs[.]us[.]69[.]mu
[Domain ] RAT C2 domains generated from date-based rotation – 5d14vnfb[.]space, r7mvjl67[.]space, and 3 more domains
[IP address ] configuration retrieval / miner infrastructure – 107[.]172[.]212[.]235
[Hashes ] malicious DLL hash and related components – 6A0FE6065D76715FEEBC1526D456DB737F624407AE489324E96A708A09C17E6F02A43B3423367B9DDDC24CC7DFC070DF, and other hashes not specified
[File names ] bundled and referenced files – HLS Installer.874.exe, mrt.exe
[Registry keys / values ] persistence and defense evasion – HKLMSoftwarePoliciesMicrosoftMRTDontOfferThroughWUAU, HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun
[Paths ] persistence and service-related file locations – C:ProgramDataGoogleChrome, %USERPROFILE%AppDataRoamingSandboxie
[User-Agent / C2 parameters ] encrypted request/response parameters – authorization=1, AES-CBC keys and IVs used by the implant

SHARE THIS STORY

WhatsApp X (Twitter)Telegram Bluesky Facebook LinkedIn Threads Email Print