A new version of the NRSMiner is actively spreading in the southern region of Asia. The majority of detections (54%) have been found in Vietnam, followed by Iran (16%) and Malaysia (12%). The new version either updates existing NRSMiner infections, or spreads to new systems using the EternalBlue exploit.
EternalBlue, one of the NSA exploits stolen by the Shadow Brokers and leaked to the public, is infamously known for the WannaCry and NotPetya outbreaks in 2017. It was patched by Microsoft in March 2017, leaked by Shadow Brokers in April 2017, and used by WannaCry in May 2017.
That EternalBlue is still being used to spread malware nearly two years after it was patched by Microsoft points to a massive failure in patching.
"Falling behind basic security practices, like patching, is usually the main culprit in these situations," Jarno Niemela, principal researcher ata F-Secure Labs told SecurityWeek. "And use of pirated software and how popular Windows is compared to other platforms are probably playing a role here."
However, he continued, "I think the biggest reason this is limited to certain countries has to do with resourcing. Security investments help ensure IT admins have time and money to create and maintain secure systems. And investments that build a culture of security is how those resources become allocated. Some parts of the world have invested in security education for decades, and we don't see this malware achieving the same prevalence in those regions."
The new version of NRSMiner is discussed by F-Secure researcher Neeraj Singh in a report published today. It updates existing infections by downloading new modules and deleting the files and services installed by its own previous versions. Existing infections with the wmassrv service running will connect to tecate[.]traduires[.]com to download an updater module.
The updater module checks to see if the new version is already installed. If it is, it deletes itself. If not, it downloads the malware from one of a series of hardcoded URLs. This malware performs the necessary housekeeping before installing a service named snmpstorsrv, with snmpstorsrv.dll registered as servicedll. It then deletes itself.
The new service creates multiple threads for different purposes, including the exfiltration of processor and system information, checking for a new module, and running the miner. The updated miner is injected into svchost.exe to start crypto-mining. If this fails, the miner is written to TrustedHostex.exe in the system32 folder and executed.
snmpstorsrv also decompresses a wininit.exe file and ejects it into svchost.exe. Failing this, wininit is written to AppDiagnosticswininit.exe and executed. Wininit is responsible for further propagation. One of the files it unzips and places in the AppDiagnostics folder is called svchost.exe but is actually the EternalBlue - 2.2.0 exploit executable.
Wininit.exe scans the local network on TCP port 445 looking for other accessible devices, and executes the EternalBlue exploit on any found and vulnerable systems. If successful, it installs the DoublePulsar backdoor on the new system. The new system is infected, and the process begins again.
The cryptominer used is the XMRig Monero CPU miner, employed to generate units of the Monero cryptocurrency. Monero has suffered the same decline in value experienced by all cryptocurrencies during 2018, peaking at around $542 in January 2018 and currently trading at less than $50. Nevertheless, it is gaining in popularity for both legitimate and illegitimate reasons.
On January 1, 2019, Monero tweeted, "The official Fortnite Merch Store is now exclusively accepting #Monero as a cryptocurrency payment option!" Fortnite is an online video game developed by Epic Games and released in July 2017. It reportedly has 125 million players throughout the world.
The bad guys simply like the increased privacy Monero provides over Bitcoin.
Related: NSA Leak Fuels Rise in Hacking for Crypto Mining: Report
Related: Crypto-Mining Attack Targets Web Servers Globally
Related: $175 Million in Monero Mined via Malicious Programs: Report