Game players and other high-performance computing users use various practical software tools, such as Msi Afterburner, which monitors system performance and allows users to modify hardware settings to enhance system performance. Hackers and hacker organizations usually target these software tools to spread malware to users' machines.
Recently, security experts have discovered several phishing campaigns targeting MSI Afterburner software, aiming to spread mining virus malware.
and other activities use complex phishing pages to imitate normal MSI Afterburner websites to lure users to download mining viruses, thereby controlling users' computers to secretly mine digital currency for them. The assistant teacher hosted a
phishing website. The hacker organization has also set up a service i to download the MSI Afterburner software bundled with mining viruses.
Crypto mining is an energy and resource-intensive activity that requires specialized hardware, such as a graphics processor. By bundling a mining program into some legitimate software, such as MSI Afterburner and installing it on the user's machine, the hacker organization can hijack the user's computer's processing capabilities, and the victim's machine mines cryptocurrency without their consent.
The following picture is a phishing website built by a hacker.
In the past three months, we have discovered about 50 phishing sites targeting MSI Afterburner. After visiting these phishing sites, hackers will install malware on users’ machines.
Below is the timeline of the phishing website created for MSI Afterburner.
Technical analysis
We analyzed a sample called "MSIAfterburnerSetup.msi".
SHA265: 2279b8cf7a2b1fa13f1832b4dc0331bd9f971240f38b0fbd694ed6aec093bb8d,
Samples are from the phishing website hxxps://git[.]git[.]skblxin[.]matrizauto[.]ne
"MSIAfterburnerSetup.msi" This installation file contains four executable files ,
such as "msiafterburnersetup465bet2a .exe", "install.exe", "comp.cab" and other files.
contains redline steeler and "browser_assistant.exe" that loads the XMR Miner.
The following figure shows the content of MSIAfterburnerSetup.msi
When the user runs MSIAfterburnerSetup. Msi file, which further executes "install.exe" for installer installation wizard.
The following figure shows the installation wizard
In the background, the installer puts a file named "browser_assist.exe" into %Program files% and executes it. After execution, "the browser_assist .exe" injects itself and loads an Shellcode which attempts to get the binary execution code of XMR Miner from the GitHub repository and further injects it into explore.exe. The following figure shows the process tree of XMR Minner:
malware installs XMR Miner by injecting malicious code into the running process in the background, while the actual valid payload will not be saved on disk.
The following figure shows the infection chain of the XMR miner
loader" browser_assistant.exe "is a 64-bit PyInstaller executable file
SHA256: 0e154eed00b71c0d11bd2caeb64fa2efcbb10524b797c076895752affa0f46c
execution" browser_assistant.exe When ", it releases multiple Python components in the %temp% directory. The following figure shows the extraction of ".pyc", ".pyd", ".dll "file
"Binary_Stub_Replacer.pyc" from the PyInstaller executable file, which is responsible for the Python file compiled by the XMR mining software.During execution, it uses the following steps to retrieve the XMR Miner and inject it into "explorer.exe":
"Binary_Stub_Replacer.py" to decode the actual data and replace the custom function, then save and compile to convert it into binary format, and finally change it to ASCII format
The decoded code is a piece of python code containing embedded base64 encoding content
. This piece of python code is used to decode the base64encoded code segment, and the decoded is shellcode.
Shellcode After using CreateThread() API function, the loaded shellcode will execute and decode the raw data downloaded from the GitHub repository (XMR Miner)
(hxxps [:] / / raw.githubusercontent [] com: 443 / CyberSECx / Dimitri_Quaser_LASTSM_B64/main/RawData) Decode and inject XMR Miner injected into explorer.exe
. The XMR Miner is further started to connect to the mining pool and start the encrypted mining operation.
The following table shows the parameters used by XMR miner malware
malware collects sensitive information at the same time, such as computer name, user name, GPU, CPU and other detailed information of the victim system, and sends them to the following C&C (Command and Control) server URL
hxxp[:]//45[.]87[.]0[.]89/api/endpoint[.]phph
Finally, the malware uses the victim's computer to start mining digital currency, and generates revenue and automatically transfers it to the hacker's own wallet address. The figure below shows the hacker's XMR mining pool dashboard, and the statistics displayed, such as the total amount paid, balance, etc., verify the feasibility of using this XMRminer to obtain economic benefits.
Summary
This mining software malware uses the MSI Afterburner phishing website method to target gamers and other users who need high-performance computing . Hackers use phishing emails, online advertising and various other means of disseminating links to disseminate. We also found that in addition to MSI Afterburner, hackers also target other specialized software to spread malware.
In this case, the malicious MSI Afterburner will release the XMR miner for mining. Abuse of victims' system resources (mainly CPU and RAM) and generate benefits for them.
This will significantly reduce the overall system performance of the victims and consume their system resources, seriously affecting the productivity of the victims' computers.
Indicators of Compromise
