Cyfirma analyzes how threat actors use a YouTube channel to distribute a Monero cryptominer through multi-stage payloads, evasion, and persistence techniques. The report highlights dynamic download URLs, anti-analysis measures, C2 communications, and safeguards that enable ongoing mining while avoiding detection.
#Monero #MrFiles #Cryptojacking #ghub #AutoInstall
#Monero #MrFiles #Cryptojacking #ghub #AutoInstall
Keypoints
- A YouTube channel distributes the Monero cryptocurrency miner as a download locked in a password-protected archive.
- The downloaded file is a password-protected compressed archive (RAR) used in the initial payload.
- The YouTube channel’s about page hosts the primary download URL, which the actor frequently alters along with the archive’s name and size.
- The final malware payload is delivered via a multi-step process with staged executables (AutoInstall.exe, software2.exe, software.exe, ghub.exe).
- The malware inflates payloads with null bytes to thwart antivirus and analysis tools.
- Persistence is achieved by adding itself as a startup service, and it disables Windows security/updates (MRT, update services).
- Anti-debugging, stealth, process hollowing, and injections into legitimate Windows processes enable covert mining and monitoring.
- Regular C2 communication occurs from the mining bot to IP 185.221.196.81 with status updates and instructions.
MITRE Techniques
- [T1059.003] Windows Command Shell – The malware uses a script-driven installer (NSIS) to orchestrate payload deployment. Quote: “The original malware sample comes as a RAR archive with the password ‘1234’.” and “NSIS (Nullsoft Scriptable Install System)”.
- [T1569.002] Service Execution – ghub.exe is registered and runs as a Windows service to establish persistence. Quote: “ghub.exe runs as the service” and “registers as service to start and executes the executable”.
- [T1204.001] Malicious Link – The download URL is hosted on a YouTube About page, acting as a deceptive link to the payload. Quote: “The URL shared on this page is for the GitHub repository…”
- [T1024.002] Malicious File – The payload is delivered as a compressed archive containing executables like AutoInstall.exe. Quote: “The original malware sample comes as a RAR archive…”
- [T1547.001] Registry Run Keys / Startup Folder – The malware configures startup behavior and auto-launch mechanisms. Quote: “enabling persistence… as a startup service”.
- [T1543.003] Windows Service – ghub.exe is installed as a system service for persistence. Quote: “registers as service to start and executes the executable”.
- [T1653] Power Settings – The malware alters the system power settings to keep the system running. Quote: “altering the power setting of the system”.
- [T1622] Debugger Evasion – The malware employs anti-debugging measures and stealth operations. Quote: “anti-debugging techniques and follows a stealth operation process”.
- [T1562.001] Disable or Modify Tools – Modifies tools/defender exclusions as part of its defense. Quote: “adding the executable (.exe) files as an exception from Windows Defender scanning”.
- [T1562.002] Disable Windows Event Logging – Disables or alters event logging to evade traces. Quote: “stops the system Event Logging”.
- [T1070.004] File Deletion – Deletes artifacts and self-deletes after cleanup. Quote: “deleting a service subkey ‘ghub’ from the registry” and “deletes itself”.
- [T1055.012] Process Hollowing – Injects into legitimate processes (conhost.exe, dwm.exe) via hollowing techniques. Quote: “process hollowing, creates a process (NtCreateUserProcess) conhost.exe in suspended state, injects the code”.
- [T1497] Virtualization/Sandbox Evasion – Uses virtualization/sandbox evasion techniques to avoid analysis. Quote: “Virtualization/Sandbox Evasion”.
- [T1071.001] Web Protocols – Communicates with C2 over web protocols and reports status. Quote: “Communicate with C2 with status update and receive instruction”.
- [T1496] Resource Hijacking – The miner exploits system resources for cryptocurrency mining. Quote: “Crypto-Mining: The final stage” and capabilities list including resource hijacking.
- [T1489] Service Stop – Stops or disables services such as MRT and Windows Update services. Quote: “disabling Windows update services” and “Uninstalls Windows MRT (Malicious Software Removal Tool) update”.
Indicators of Compromise
- [MD5 Hash] – LaunchInstallerFile_Passwd_1234.rar – 380f9774da8b0eb497bad9d4df6bfdb4, AutoInstall.exe – ed4a65c1d8afb84b9ae8e57307cdb4fa, and 2 more hashes
- [SHA-256 Hash] – LaunchInstallerFile_Passwd_1234.rar – 454df772c510dbd8811382e0aa578b462ddfa520314468ac96efc2a61b358cd9, AutoInstall.exe – 7bb518d6881bb9fd88af0a65be64765a3106e41d54f64e8f515643e5767d888e, and 2 more
- [MD5 Hash] – software2.exe – ae0e0e425bbc61ed33ed008d44d22ce9, software.exe – 1accf288f3d7c35497e4b422671fae5b, and 2 more
- [SHA-256 Hash] – software2.exe – 12c4e815d60b14450fc1abcdd6290f80b4bccecf34bc09ff89965c4f65f9986c, software.exe – 264d33a988d994bbd7f7ebe934b125a5953399f2189eb06da3c16a0b7dd89a3c, and 2 more
- [IP Address] – 185.221.196.81 (C2) – used for status updates and receiving instructions