MEITY
Cyber Swachhta Kendra

Adylkuzz-Cryptocurrency Mining Malware

Original Issue Date:- May 19, 2017
Type:- Trojan
Severity:- High

It has been reported that a new cryptocurrency miner ransomware named as "Adylkuzz" is spreading, exploiting Microsoft Server Message Block (SMB) vulnerability (MS17-010). Adylkuzz also uses exploits ETERNALBLUE for exploiting the SMB vulnerability & install DOUBLEPULSAR backdoor, the same exploits used by WannaCry ransomware. It propagates by scanning internet for machines with open TCP 445 port, if found then it uses ETERNALBLUE exploit for initial exploitation and thereafter infect machines with DOUBLEPULSAR backdoor.

The malware is capable of performing the following functions:

  • It mines Monero, a cryptocurrency similar to Bitcoin
  • It shut down SMB networking to prevent further infections with other malware (including the WannaCry worm) by blocking TCP port 445 in windows Firewall
  • It degrades PC and server performances
  • It prevents access to shared Windows resources
  • It make network connections to C2 server and sends Public IP address, Malware version, operating system and architecture, CPU frequency, Number of processors & Memory size information of infected machine
  • It determines the public IP address of the victim, downloads Monero cryptocurrency miner and additional tools, and make DNS queries to the Monero mining pool server.
  • Downloads the mining instructions

Indicators of Compromise:

File system changes:

It creates the following files:

  • %ProgramFiles%\Hardware Driver Management \ windriver.exe
  • %Windir%\Fonts \ wuauser.exe
  • %ProgramFiles%\Microsoft.NET\Primary Interop Assemblies \ LMS.dat
  • %Windir%\Fonts \ msiexev.exe
  • %Temp%\[RANDOM CHARACTERS]._Miner_.log

Services created with service name:

  • WHDMIDE
  • WELM

The Trojan stops itself and the miner process if the following processes are running:

  • taskmgr.exe
  • mmc.exe
  • procexp.exe

It detects the presence of antivirus installed on affected machine by checking the following processes:

avp.exe, nod32krn.exe, mcshield.exe, ccsvchst.exe, 360sd.exe, avguard.exe, msseces.exe, avastsvc.exe, avgnsx.exe, spidernt.exe, kwatch.exe, xcomsvr.exe, fsdfwd.exe, ravmon.exe, sfctlcom.exe, qhlpsvc.exe, guardxservice.exe

List of SHA256 of Adylkuzz samples:

  • 29d6f9f06fa780b7a56cae0aa888961b8bdc559500421f3bb3b97f3dd94797c2
  • 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233
  • 450cb5593d2431d00455cabfecc4d28d42585789d84c25d25cdc5505189b4f9f
  • a7000b2618512f1cb24b51f4ae2f34d332b746183dfad6483aba04571ba8b2f9
  • e96681456d793368a6fccfa1321c10c593f3527d7cadb1ff462aa0359af61dee
  • e6680bf0d3b32583047e9304d1703c87878c7c82910fbe05efc8519d2ca2df71
  • 55622d4a582ceed0d54b12eb40222bca9650cc67b39f74c5f4b78320a036af88
  • 6f74f7c01503913553b0a6118b0ea198c5a419be86fca4aaae275663806f68f3
  • fab31a2d44e38e733e1002286e5df164509afe18149a8a2f527ec6dc5e71cb00
  • d73c9230811f1075d5697679b6007f5c15a90177991e238c5adc3ed55ce04988

Network communications:

Connects to below mentioned Command & Control (C2) servers to report installation:

  • panel.minecoins18[.]com/install/st******
  • 08.super5566[.]com/install/st******
  • am.super1024[.]com/report/st******

Connects to URLs used for downloading the cpuminer cryptocurrency miner:

  • panel.minecoins18[.]com/x64******
  • panel.minecoins18[.]com/x86******
  • 08.super5566[.]com/64.******
  • 08.super5566[.]com/86.******
  • am.super1024[.]com/64.******
  • am.super1024[.]com/86.******

Connects to URLs to download configuration for cpuminer:

  • panel.minecoins18[.]com/argline******
  • 08.super5566[.]com/mine******
  • am.super1024[.]com/mine******

Connects to below mentioned domains to sends the information and may download updates:

  • panel.minecoins18[.]com
  • 08.super5566[.]com
  • am.super1024[.]com

It is advised to block/monitor the connections to the above mentioned C2 domains.

Note: For complete list of indicators of compromise, kindly refer to the references section.

Specific Countermeasures to prevent Adylkuzz infection:

Users and administrators are advised to take the following preventive measures to protect their computer networks from ransomware infection/ attacks:

  • In order to prevent infection users and organizations are advised to apply patches to Windows systems as mentioned in Microsoft Security Bulletin MS17-010

  • Microsoft Patch for Unsupported Versions such as Windows XP,Vista,Server 2003, Server 2008 etc. http://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598

  • To prevent data loss Users & Organisations are advised to take backup of Critical Data

  • Block SMB ports on Enterprise Edge/perimeter network devices [UDP 137, 138 and TCP 139, 445] or Disable SMBv1. https://support.microsoft.com/en-us/help/2696547

  • Apply following signatures/rules at IDS/IPS

    alert tcp $HOME_NET 445 -> any any (msg:"ET EXPLOIT Possible ETERNALBLUE MS17-010 Echo Response"; flow:from_server,established; content:"|00 00 00 31 ff|SMB|2b 00 00 00 00 98 07 c0|"; depth:16; fast_pattern; content:"|4a 6c 4a 6d 49 68 43 6c 42 73 72 00|"; distance:0; flowbits:isset,ETPRO.ETERNALBLUE; classtype:trojan-activity; sid:2024218; rev:2;)

    (http://docs.emergingthreats.net/bin/view/Main/2024218)

    alert smb any any -> $HOME_NET any (msg:"ET EXPLOIT Possible ETERNALBLUE MS17-010 Echo Request (set)"; flow:to_server,established; content:"|00 00 00 31 ff|SMB|2b 00 00 00 00 18 07 c0|"; depth:16; fast_pattern; content:"|4a 6c 4a 6d 49 68 43 6c 42 73 72 00|"; distance:0; flowbits:set,ETPRO.ETERNALBLUE; flowbits:noalert; classtype:trojan-activity; sid:2024220; rev:1;)

    alert smb $HOME_NET any -> any any (msg:"ET EXPLOIT Possible ETERNALBLUE MS17-010 Echo Response"; flow:from_server,established; content:"|00 00 00 31 ff|SMB|2b 00 00 00 00 98 07 c0|"; depth:16; fast_pattern; content:"|4a 6c 4a 6d 49 68 43 6c 42 73 72 00|"; distance:0; flowbits:isset,ETPRO.ETERNALBLUE; classtype:trojan-activity; sid:2024218; rev:1;)

Countermeasures:

  • Block SMB ports on Enterprise Edge/perimeter network devices [UDP 137, 138 and TCP 139, 445] or Disable SMBv1. SMB ports should not be visible over public network.
  • Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, this data should be kept on a separate device, and backups should be stored offline.
  • Establish a Sender Policy Framework (SPF), Domain Message Authentication Reporting and Conformance (DMARC), and DomainKeys Identified Mail (DKIM) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing.
  • Don't open attachments in unsolicited e-mails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs close out the e-mail and go to the organization's website directly through browser
  • Restrict execution of PowerShell /WSCRIPT in enterprise environment Ensure installation and use of the latest version (currently v5.0) of PowerShell, with enhanced logging enabled. Script block logging, and transcription enabled. Send the associated logs to a centralized log repository for monitoring and analysis.
  • Application whitelisting/Strict implementation of Software Restriction Policies (SRP) to block binaries running from %APPDATA%, %PROGRAMDATA% and %TEMP% paths. Malware sample drops and executes generally from these locations. Enforce application whitelisting on all endpoint workstations.
  • Deploy web and email filters on the network. Configure these devices to scan for known bad domains, sources, and addresses; block these before receiving and downloading messages. Scan all emails, attachments, and downloads both on the host and at the mail gateway with a reputable antivirus solution.
  • Disable macros in Microsoft Office products. Some Office products allow for the disabling of macros that originate from outside of an organization and can provide a hybrid approach when the organization depends on the legitimate use of macros. For Windows, specific settings can block macros originating from the Internet from running.
  • Configure access controls including file, directory, and network share permissions with least privilege in mind. If a user only needs to read specific files, they should not have write access to those files, directories, or shares.
  • Maintain updated Antivirus software on all systems
  • Consider installing Enhanced Mitigation Experience Toolkit, or similar host-level anti-exploitation tools.
  • Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf
  • Keep the operating system third party applications (MS office, browsers, browser Plugins) up-to-date with the latest patches.
  • Follow safe practices when browsing the web. Ensure the web browsers are secured enough with appropriate content controls.
  • Network segmentation and segregation into security zones - help protect sensitive information and critical services. Separate administrative network from business processes with physical controls and Virtual Local Area Networks.
  • Disable remote Desktop Connections, employ least-privileged accounts.
  • Ensure integrity of the codes /scripts being used in database, authentication and sensitive systems, Check regularly for the integrity of the information stored in the databases.
  • Restrict users' abilities (permissions) to install and run unwanted software applications.
  • Enable personal firewalls on workstations.
  • Implement strict External Device (USB drive) usage policy.
  • Employ data-at-rest and data-in-transit encryption.
  • Carry out vulnerability Assessment and Penetration Testing (VAPT) and information security audit of critical networks/systems, especially database servers from CERT-IN empaneled auditors. Repeat audits at regular intervals.
  • Individuals or organizations are not encouraged to pay the ransom, as this does not guarantee files will be released. Report such instances of fraud to CERT-In and Law Enforcement agencies

References