SlideShare a Scribd company logo

CoinMiners are Evasive - BsidesTLV

•Download as PPTX, PDF•
•
T
Thomas Roccia

CoinMiners are on the rise, trending so high that in the last couple of month they almost completely replaced ransomware in both media and the research community. Unlike ransomware which profit from rapid encryption of user’s data taken hostage, CoinMiners profit comes from high jacking computer resources. As long as the CoinMiner stays undetected and stealth, the higher its author profit. In this talk we will focus on the unexplored territory of CoinMiner evasive maneuver and functionality to avoid getting found by its victims and provide tactics and tools to combat them.

Technology
1 of 34
CoinMiners are Evasive A deep dive into the uncharted territory of CoinMiners stealth tactics Omri SEGEV MOYAL Co-Founder &VP Research @GeloSnake MINERVA Labs Thomas ROCCIA Security Researcher,AdvancedThreat Research @fr0gger_
Introduction What will be discussed in the talk: The rise of CoinMiners CoinMiners EvasionTactics CoinMinersTurf Wars DefensiveTactics Predictions BsidesTLV – 2018 - @GeloSnake - @fr0gger_ CryptoCurrency Interest Source: Google Trends
The Rise of CoinMiners BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Source: Google News
The Rise of CoinMiners BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Source: Google News
Business Model Mining relies on GPU, CPU,ASICS... Solo mining is no longer profitable. Both malicious and legitimate miners turn to public pools. Cybercriminals highjack victim machines to create large mining botnets. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ The Rise of CoinMiners
Most Currency Mined Monero - cyber criminals most mined currency Relatively high mining profit returns Strong anonymity features Number one currency for web based mining Many open source easy to use tools BsidesTLV – 2018 - @GeloSnake - @fr0gger_ The Rise of CoinMiners
InfectionVectors Traditional malware Adding mining functionality Malicious documents and spams Trojanized software and plugins Worms Exploiting web and local vulnerabilities Using brute force WebMining Highjacking legitimate website Iframe and redirects via advertisement BsidesTLV – 2018 - @GeloSnake - @fr0gger_ The Rise of CoinMiners Source: McAfee
What’s the big deal? BsidesTLV – 2018 - @GeloSnake - @fr0gger_ The Rise of CoinMiners Source: Comino.com
Evasion techniques can be define as follow: BsidesTLV – 2018 - @GeloSnake - @fr0gger_ CoinMiners are Evasive (1) All the digital techniques used by a (mal||soft)ware to avoid, static, dynamic, automatic, human analysis in order to understand its behavior. (2) All the digital techniques used by a malware to avoid (1) and to evade security solutions, security configuration as well human detection to perform malicious action the longer on the infected machines. (3) Evasion techniques are classified as follow: Anti-Sandboxing, Antivirus Evasion, Anti-Debugging, Anti-Monitoring, Packers, Anti- Disassembly, Process Injection, Network Evasion, Obfuscation (encoding, encryption…), Morphism, Anti-Forensic, Anti-Machine Learning.
Comes in trojanized online gaming modes Uses Google Drive to host the malicious components Source code found on Pastebin BsidesTLV – 2018 - @GeloSnake - @fr0gger_ WaterMiner | Modified video games on Russian forum tainted with CoinMiner Source: Minerva
Impersonate Intel or Oracle software XMRig commands are Embedded in the payload Stop mining when monitoring program executes BsidesTLV – 2018 - @GeloSnake - @fr0gger_ WaterMiner | Hiding in a plain sight
Selling on blackmarket Packed samples Watching the clipboard to replace wallet address (LTC, BTC, XMR…) BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Evrial | Watch over what you type Source: McAfee
BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Evrial | Watch over what you type Bitcoin Stealer Cookie Stealer Source: McAfee
Spreads via eternal blue SMB exploit Run parallel to Wannacry Managed to stay under the radar BsidesTLV – 2018 - @GeloSnake - @fr0gger_ UIWIX | Evasive Miner Exploiting ETERNALBLUE
Avoid running in virtual machines Look for debuggers and forensics tools Avoid running in eastern Europe countries Look for cuckoo sandbox Look for debuggers and forensics tools BsidesTLV – 2018 - @GeloSnake - @fr0gger_ UIWIX | For i in EvasionTactics: copy/paste i
BsidesTLV – 2018 - @GeloSnake - @fr0gger_ XIAOBA | Redirecting security websites XIAOBA Ransomware previously encrypted data now deploy CoinMiner Use fake icon Infect HTML file with Coinhive link to mine Redirect AV website to localhost Disable safe mode, Registry Delete .ISO and .GHO files Infect others PE on the system to run the miner <fail>Crash the system by infecting every exe</fail> Inject Coinhive script Redirect AV websites Remove Backup file Inject into EXE
BsidesTLV – 2018 - @GeloSnake - @fr0gger_ XIOBA CoinMiner EvasiveTechniques Fake 360Safe AV Edit etchosts Html file modified Registry disabled Disable Safe Boot XIAOBA | Redirecting security websites
BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Killing Competition Mining requires resources Some malware remove other threats Some other patches the system
BsidesTLV – 2018 - @GeloSnake - @fr0gger_ GhostMiner | Fileless powershell worm Spread via exploits Oracle’s WebLogic – CVE-2017-10271 MSSQL – bruteforce phpMyAdmin bruteforce
BsidesTLV – 2018 - @GeloSnake - @fr0gger_ GhostMiner | Fileless killer Improved evasion over time Switched to Powershell Payload improved to only run in- memory Gen.1 Gen.2
BsidesTLV – 2018 - @GeloSnake - @fr0gger_ GhostMiner | Anti-competition features Eliminate competitors Kill running miner process Stop and delete miner services Delete miner schedule tasks
BsidesTLV – 2018 - @GeloSnake - @fr0gger_ GhostMiner | MinerKiller
BsidesTLV – 2018 - @GeloSnake - @fr0gger_ GhostMiner | MinerKiller
BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Adylkuzz | Patching away competition Adylkuzz used EternalBlue to spread but not directly embedded Patched the vulnerability after infection An old variant spreaded differently April 2017 Variant June 2017 Variant Source: McAfee
BsidesTLV – 2018 - @GeloSnake - @fr0gger_ EvasiveTechniques CoinMiner are also using the following techniques: Limit the CPU utilization Enable mining on specific hours Enable mining process when user is inactive Hide behind taskbar (Pop under techniques) Source: Minerva
BsidesTLV – 2018 - @GeloSnake - @fr0gger_ EvasiveTechniques CoinMiners continue to evolve by implementing evasion tricks Miners studied implement only some of the evasion tricks Most techniques used are Packers, Injection andAnti-Monitoring Packer Fake App Anti-monitoring Anti-av Anti-sandbox Replace wallet Anti-dbg Anti-forensic Fileless Injection Waterminer X X Evrial X X UIWIX X X X X X XIAOBA X X X X X GhostMiner X X X Adylkuzz X
BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Detect theThreat Monitoring high CPU activity Miner killer https://github.com/MinervaLabsResearch/BlogPosts/blob/ma ster/MinerKiller/MinerKiller.ps1 Detect withYara Rules https://github.com/advanced-threat- research/IOCs/blob/master/MoneroMiner.yar Monitoring traffic Cryptocurrency Transaction Mining traffic Used CoinblockerList for websites https://github.com/ZeroDot1/CoinBlockerLists
BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Detect theThreat | CoinblockerList
BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Detect theThreat
BsidesTLV – 2018 - @GeloSnake - @fr0gger_ What to expect in the future? Crypto Miner is a growing threat and could dominate theThreat Landscape. Other targets (SmartTV, IOT, ConnectedCar…?) BankingTrojans targeting Cryptocurrencies (Dridex,Trickbot…) MajorityAttack with Botnet Miners (Verge, BTCGold…) Attack on internal Blockchain implementation (Sybil Attack)
BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Raise of Botnet Miner Exploitation of weak ADB port (ADBMiner) Open Port 5555 Source: Shodan
BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Majority Attack Influence Blockchain integrity by forging block Botnet that get control over 51% of the network Generating block faster than the rest of the network Creating its own block Previous attack (Verge Coin, BTC Gold) Honest Miner 49% Malicious Miner 51% Block n Block n+1 Block n+2 Block n+3 Block n+4 Block n+3 Block n+4 Block n+5 Abandonned Blocks Malicious Blocks
BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Quick Recap Review of the CryptoMinerThreat Landscape Review of the Malware EvasionTechniques Look into the CryptoMiners Competition Offered defensive tactics Exploring future trends
Thank you! Omri SEGEV MOYAL Co-Founder &VP Research @GeloSnake MINERVA Labs Thomas ROCCIA Security Researcher,AdvancedThreat Research @fr0gger_ Q/A

Recommended

TRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS MalwareTRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS MalwareThomas Roccia
 
Malware Evasion Techniques
Malware Evasion TechniquesMalware Evasion Techniques
Malware Evasion TechniquesThomas Roccia
 
42 - Malware - Understand the Threat and How to Respond
42 - Malware - Understand the Threat and How to Respond42 - Malware - Understand the Threat and How to Respond
42 - Malware - Understand the Threat and How to RespondThomas Roccia
 
Wannacry | Technical Insight and Lessons Learned
Wannacry | Technical Insight and Lessons LearnedWannacry | Technical Insight and Lessons Learned
Wannacry | Technical Insight and Lessons LearnedThomas Roccia
 
BSides IR in Heterogeneous Environment
BSides IR in Heterogeneous EnvironmentBSides IR in Heterogeneous Environment
BSides IR in Heterogeneous EnvironmentStefano Maccaglia
 
Breaking the cyber kill chain!
Breaking the cyber kill chain!Breaking the cyber kill chain!
Breaking the cyber kill chain!Nahidul Kibria
 
MMW June 2016: The Rise and Fall of Angler
MMW June 2016: The Rise and Fall of Angler MMW June 2016: The Rise and Fall of Angler
MMW June 2016: The Rise and Fall of Angler Marci Bontadelli
 
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptxChi En (Ashley) Shen
 

Recommended

TRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS MalwareTRITON: The Next Generation of ICS Malware
TRITON: The Next Generation of ICS MalwareThomas Roccia
 
Malware Evasion Techniques
Malware Evasion TechniquesMalware Evasion Techniques
Malware Evasion TechniquesThomas Roccia
 
42 - Malware - Understand the Threat and How to Respond
42 - Malware - Understand the Threat and How to Respond42 - Malware - Understand the Threat and How to Respond
42 - Malware - Understand the Threat and How to RespondThomas Roccia
 
Wannacry | Technical Insight and Lessons Learned
Wannacry | Technical Insight and Lessons LearnedWannacry | Technical Insight and Lessons Learned
Wannacry | Technical Insight and Lessons LearnedThomas Roccia
 
BSides IR in Heterogeneous Environment
BSides IR in Heterogeneous EnvironmentBSides IR in Heterogeneous Environment
BSides IR in Heterogeneous EnvironmentStefano Maccaglia
 
Breaking the cyber kill chain!
Breaking the cyber kill chain!Breaking the cyber kill chain!
Breaking the cyber kill chain!Nahidul Kibria
 
MMW June 2016: The Rise and Fall of Angler
MMW June 2016: The Rise and Fall of Angler MMW June 2016: The Rise and Fall of Angler
MMW June 2016: The Rise and Fall of Angler Marci Bontadelli
 
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptxChi En (Ashley) Shen
 
EverSec + Cyphort: Big Trends in Cybersecurity
EverSec + Cyphort: Big Trends in CybersecurityEverSec + Cyphort: Big Trends in Cybersecurity
EverSec + Cyphort: Big Trends in CybersecurityCyphort
 
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.Light, Dark and... a Sunburst... dissection of a very sophisticated attack.
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.Stefano Maccaglia
 
【HITCON Hackathon 2017】 TrendMicro Datasets
【HITCON Hackathon 2017】 TrendMicro Datasets【HITCON Hackathon 2017】 TrendMicro Datasets
【HITCON Hackathon 2017】 TrendMicro DatasetsHacks in Taiwan (HITCON)
 
[CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by C...
[CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by C...[CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by C...
[CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by C...CODE BLUE
 
What you need to know about ExPetr ransomware
What you need to know about ExPetr ransomwareWhat you need to know about ExPetr ransomware
What you need to know about ExPetr ransomwareKaspersky
 
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...PROIDEA
 
Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...
Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...
Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...HackIT Ukraine
 
Hunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul AlvarezHunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul AlvarezEC-Council
 
Syrian Malware
Syrian MalwareSyrian Malware
Syrian MalwareKaspersky
 
The Rising Threat of Fileless Malware
The Rising Threat of Fileless MalwareThe Rising Threat of Fileless Malware
The Rising Threat of Fileless MalwareChelsea Sisson
 
[CB19] Deep Exploit: Fully Automatic Penetration Test Tool Using Reinforcemen...
[CB19] Deep Exploit: Fully Automatic Penetration Test Tool Using Reinforcemen...[CB19] Deep Exploit: Fully Automatic Penetration Test Tool Using Reinforcemen...
[CB19] Deep Exploit: Fully Automatic Penetration Test Tool Using Reinforcemen...CODE BLUE
 
MMW Anti-Sandbox Techniques
MMW Anti-Sandbox TechniquesMMW Anti-Sandbox Techniques
MMW Anti-Sandbox TechniquesCyphort
 
Honeycon2016-honeypot updates for public
Honeycon2016-honeypot updates for publicHoneycon2016-honeypot updates for public
Honeycon2016-honeypot updates for publicJulia Yu-Chin Cheng
 
MMW April 2016 Ransomware Resurgence
MMW April 2016 Ransomware Resurgence MMW April 2016 Ransomware Resurgence
MMW April 2016 Ransomware Resurgence Cyphort
 
Adaptive Defense - Understanding Cyber Attacks
Adaptive Defense - Understanding Cyber AttacksAdaptive Defense - Understanding Cyber Attacks
Adaptive Defense - Understanding Cyber AttacksJermund Ottermo
 
Security by Weston Hecker
Security by Weston HeckerSecurity by Weston Hecker
Security by Weston HeckerEC-Council
 
Evolving Threat Landscapes Web-Based Botnet Through Exploit Kits and Scripts ...
Evolving Threat Landscapes Web-Based Botnet Through Exploit Kits and Scripts ...Evolving Threat Landscapes Web-Based Botnet Through Exploit Kits and Scripts ...
Evolving Threat Landscapes Web-Based Botnet Through Exploit Kits and Scripts ...Julia Yu-Chin Cheng
 
Adversary tactics config mgmt-&amp;-logs-oh-my
Adversary tactics config mgmt-&amp;-logs-oh-myAdversary tactics config mgmt-&amp;-logs-oh-my
Adversary tactics config mgmt-&amp;-logs-oh-myJesse Moore
 
Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL
Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOLMalware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL
Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOLCyphort
 
Living off the land and fileless attack techniques
Living off the land and fileless attack techniquesLiving off the land and fileless attack techniques
Living off the land and fileless attack techniquesSymantec Security Response
 
Pedro Fortuna - Protecting Crypto Exchanges From a New Wave of Man-in-the-Bro...
Pedro Fortuna - Protecting Crypto Exchanges From a New Wave of Man-in-the-Bro...Pedro Fortuna - Protecting Crypto Exchanges From a New Wave of Man-in-the-Bro...
Pedro Fortuna - Protecting Crypto Exchanges From a New Wave of Man-in-the-Bro...Hacken_Ecosystem
 
Rapport ICO Rating
Rapport ICO RatingRapport ICO Rating
Rapport ICO RatingSociété Tripalio
 

More Related Content

What's hot

EverSec + Cyphort: Big Trends in Cybersecurity
EverSec + Cyphort: Big Trends in CybersecurityEverSec + Cyphort: Big Trends in Cybersecurity
EverSec + Cyphort: Big Trends in CybersecurityCyphort
 
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.Light, Dark and... a Sunburst... dissection of a very sophisticated attack.
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.Stefano Maccaglia
 
【HITCON Hackathon 2017】 TrendMicro Datasets
【HITCON Hackathon 2017】 TrendMicro Datasets【HITCON Hackathon 2017】 TrendMicro Datasets
【HITCON Hackathon 2017】 TrendMicro DatasetsHacks in Taiwan (HITCON)
 
[CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by C...
[CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by C...[CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by C...
[CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by C...CODE BLUE
 
What you need to know about ExPetr ransomware
What you need to know about ExPetr ransomwareWhat you need to know about ExPetr ransomware
What you need to know about ExPetr ransomwareKaspersky
 
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...PROIDEA
 
Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...
Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...
Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...HackIT Ukraine
 
Hunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul AlvarezHunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul AlvarezEC-Council
 
Syrian Malware
Syrian MalwareSyrian Malware
Syrian MalwareKaspersky
 
The Rising Threat of Fileless Malware
The Rising Threat of Fileless MalwareThe Rising Threat of Fileless Malware
The Rising Threat of Fileless MalwareChelsea Sisson
 
[CB19] Deep Exploit: Fully Automatic Penetration Test Tool Using Reinforcemen...
[CB19] Deep Exploit: Fully Automatic Penetration Test Tool Using Reinforcemen...[CB19] Deep Exploit: Fully Automatic Penetration Test Tool Using Reinforcemen...
[CB19] Deep Exploit: Fully Automatic Penetration Test Tool Using Reinforcemen...CODE BLUE
 
MMW Anti-Sandbox Techniques
MMW Anti-Sandbox TechniquesMMW Anti-Sandbox Techniques
MMW Anti-Sandbox TechniquesCyphort
 
Honeycon2016-honeypot updates for public
Honeycon2016-honeypot updates for publicHoneycon2016-honeypot updates for public
Honeycon2016-honeypot updates for publicJulia Yu-Chin Cheng
 
MMW April 2016 Ransomware Resurgence
MMW April 2016 Ransomware Resurgence MMW April 2016 Ransomware Resurgence
MMW April 2016 Ransomware Resurgence Cyphort
 
Adaptive Defense - Understanding Cyber Attacks
Adaptive Defense - Understanding Cyber AttacksAdaptive Defense - Understanding Cyber Attacks
Adaptive Defense - Understanding Cyber AttacksJermund Ottermo
 
Security by Weston Hecker
Security by Weston HeckerSecurity by Weston Hecker
Security by Weston HeckerEC-Council
 
Evolving Threat Landscapes Web-Based Botnet Through Exploit Kits and Scripts ...
Evolving Threat Landscapes Web-Based Botnet Through Exploit Kits and Scripts ...Evolving Threat Landscapes Web-Based Botnet Through Exploit Kits and Scripts ...
Evolving Threat Landscapes Web-Based Botnet Through Exploit Kits and Scripts ...Julia Yu-Chin Cheng
 
Adversary tactics config mgmt-&amp;-logs-oh-my
Adversary tactics config mgmt-&amp;-logs-oh-myAdversary tactics config mgmt-&amp;-logs-oh-my
Adversary tactics config mgmt-&amp;-logs-oh-myJesse Moore
 
Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL
Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOLMalware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL
Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOLCyphort
 
Living off the land and fileless attack techniques
Living off the land and fileless attack techniquesLiving off the land and fileless attack techniques
Living off the land and fileless attack techniquesSymantec Security Response
 

What's hot (20)

EverSec + Cyphort: Big Trends in Cybersecurity
EverSec + Cyphort: Big Trends in CybersecurityEverSec + Cyphort: Big Trends in Cybersecurity
EverSec + Cyphort: Big Trends in Cybersecurity
 
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.Light, Dark and... a Sunburst... dissection of a very sophisticated attack.
Light, Dark and... a Sunburst... dissection of a very sophisticated attack.
 
【HITCON Hackathon 2017】 TrendMicro Datasets
【HITCON Hackathon 2017】 TrendMicro Datasets【HITCON Hackathon 2017】 TrendMicro Datasets
【HITCON Hackathon 2017】 TrendMicro Datasets
 
[CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by C...
[CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by C...[CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by C...
[CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by C...
 
What you need to know about ExPetr ransomware
What you need to know about ExPetr ransomwareWhat you need to know about ExPetr ransomware
What you need to know about ExPetr ransomware
 
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...
 
Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...
Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...
Ник Белогорский - Будни Кремниевой Долины. История карьеры Ника, борьба с хак...
 
Hunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul AlvarezHunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul Alvarez
 
Syrian Malware
Syrian MalwareSyrian Malware
Syrian Malware
 
The Rising Threat of Fileless Malware
The Rising Threat of Fileless MalwareThe Rising Threat of Fileless Malware
The Rising Threat of Fileless Malware
 
[CB19] Deep Exploit: Fully Automatic Penetration Test Tool Using Reinforcemen...
[CB19] Deep Exploit: Fully Automatic Penetration Test Tool Using Reinforcemen...[CB19] Deep Exploit: Fully Automatic Penetration Test Tool Using Reinforcemen...
[CB19] Deep Exploit: Fully Automatic Penetration Test Tool Using Reinforcemen...
 
MMW Anti-Sandbox Techniques
MMW Anti-Sandbox TechniquesMMW Anti-Sandbox Techniques
MMW Anti-Sandbox Techniques
 
Honeycon2016-honeypot updates for public
Honeycon2016-honeypot updates for publicHoneycon2016-honeypot updates for public
Honeycon2016-honeypot updates for public
 
MMW April 2016 Ransomware Resurgence
MMW April 2016 Ransomware Resurgence MMW April 2016 Ransomware Resurgence
MMW April 2016 Ransomware Resurgence
 
Adaptive Defense - Understanding Cyber Attacks
Adaptive Defense - Understanding Cyber AttacksAdaptive Defense - Understanding Cyber Attacks
Adaptive Defense - Understanding Cyber Attacks
 
Security by Weston Hecker
Security by Weston HeckerSecurity by Weston Hecker
Security by Weston Hecker
 
Evolving Threat Landscapes Web-Based Botnet Through Exploit Kits and Scripts ...
Evolving Threat Landscapes Web-Based Botnet Through Exploit Kits and Scripts ...Evolving Threat Landscapes Web-Based Botnet Through Exploit Kits and Scripts ...
Evolving Threat Landscapes Web-Based Botnet Through Exploit Kits and Scripts ...
 
Adversary tactics config mgmt-&amp;-logs-oh-my
Adversary tactics config mgmt-&amp;-logs-oh-myAdversary tactics config mgmt-&amp;-logs-oh-my
Adversary tactics config mgmt-&amp;-logs-oh-my
 
Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL
Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOLMalware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL
Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL
 
Living off the land and fileless attack techniques
Living off the land and fileless attack techniquesLiving off the land and fileless attack techniques
Living off the land and fileless attack techniques
 

Similar to CoinMiners are Evasive - BsidesTLV

Pedro Fortuna - Protecting Crypto Exchanges From a New Wave of Man-in-the-Bro...
Pedro Fortuna - Protecting Crypto Exchanges From a New Wave of Man-in-the-Bro...Pedro Fortuna - Protecting Crypto Exchanges From a New Wave of Man-in-the-Bro...
Pedro Fortuna - Protecting Crypto Exchanges From a New Wave of Man-in-the-Bro...Hacken_Ecosystem
 
How to hide your browser 0-day @ Disobey
How to hide your browser 0-day @ DisobeyHow to hide your browser 0-day @ Disobey
How to hide your browser 0-day @ DisobeyZoltan Balazs
 
Threat hunting in cyber world
Threat hunting in cyber worldThreat hunting in cyber world
Threat hunting in cyber worldAkash Sarode
 
Operations security - SyPy Dec 2014 (Sydney Python users)
Operations security - SyPy Dec 2014 (Sydney Python users)Operations security - SyPy Dec 2014 (Sydney Python users)
Operations security - SyPy Dec 2014 (Sydney Python users)Mikko Ohtamaa
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKKatie Nickels
 
Blue team reboot - HackFest
Blue team reboot - HackFest Blue team reboot - HackFest
Blue team reboot - HackFest Haydn Johnson
 
SEC599 - Breaking The Kill Chain
SEC599 - Breaking The Kill ChainSEC599 - Breaking The Kill Chain
SEC599 - Breaking The Kill ChainErik Van Buggenhout
 
Operations Security - SF Bitcoin Hackday March 2015
Operations Security - SF Bitcoin Hackday March 2015Operations Security - SF Bitcoin Hackday March 2015
Operations Security - SF Bitcoin Hackday March 2015Mikko Ohtamaa
 
Bsides detroit 2013 honeypots
Bsides detroit 2013 honeypotsBsides detroit 2013 honeypots
Bsides detroit 2013 honeypotsTazdrumm3r
 
[CB19] MalConfScan with Cuckoo: Automatic Malware Configuration Extraction Sy...
[CB19] MalConfScan with Cuckoo: Automatic Malware Configuration Extraction Sy...[CB19] MalConfScan with Cuckoo: Automatic Malware Configuration Extraction Sy...
[CB19] MalConfScan with Cuckoo: Automatic Malware Configuration Extraction Sy...CODE BLUE
 
Bsides NYC 2018 - Hunting for Lateral Movement
Bsides NYC 2018 - Hunting for Lateral MovementBsides NYC 2018 - Hunting for Lateral Movement
Bsides NYC 2018 - Hunting for Lateral MovementMauricio Velazco
 
Virus Bulletin 2018: Lazarus Group a mahjong game played with different sets ...
Virus Bulletin 2018: Lazarus Group a mahjong game played with different sets ...Virus Bulletin 2018: Lazarus Group a mahjong game played with different sets ...
Virus Bulletin 2018: Lazarus Group a mahjong game played with different sets ...Peter Kálnai
 
SANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
SANSFIRE18: War Stories on Using Automated Threat Intelligence for DefenseSANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
SANSFIRE18: War Stories on Using Automated Threat Intelligence for DefenseJohn Bambenek
 
Mastering Next Gen SIEM Use Cases (Part 2)
Mastering Next Gen SIEM Use Cases (Part 2)Mastering Next Gen SIEM Use Cases (Part 2)
Mastering Next Gen SIEM Use Cases (Part 2)DNIF
 
How to prevent cyber terrorism taragana
How to prevent cyber terrorism taraganaHow to prevent cyber terrorism taragana
How to prevent cyber terrorism taraganaGilles Sgro
 
Crypto Token Economy Design for Disruptive BM
Crypto Token Economy Design for Disruptive BMCrypto Token Economy Design for Disruptive BM
Crypto Token Economy Design for Disruptive BMJongseung Kim
 
AI and Machine Learning for Analyzing Cryptocurrencies and the Blockchain
AI and Machine Learning for Analyzing Cryptocurrencies and the BlockchainAI and Machine Learning for Analyzing Cryptocurrencies and the Blockchain
AI and Machine Learning for Analyzing Cryptocurrencies and the BlockchainRakuten Group, Inc.
 

Similar to CoinMiners are Evasive - BsidesTLV (20)

Pedro Fortuna - Protecting Crypto Exchanges From a New Wave of Man-in-the-Bro...
Pedro Fortuna - Protecting Crypto Exchanges From a New Wave of Man-in-the-Bro...Pedro Fortuna - Protecting Crypto Exchanges From a New Wave of Man-in-the-Bro...
Pedro Fortuna - Protecting Crypto Exchanges From a New Wave of Man-in-the-Bro...
 
Rapport ICO Rating
Rapport ICO RatingRapport ICO Rating
Rapport ICO Rating
 
Having Honeypot for Better Network Security Analysis
Having Honeypot for Better Network Security AnalysisHaving Honeypot for Better Network Security Analysis
Having Honeypot for Better Network Security Analysis
 
How to hide your browser 0-day @ Disobey
How to hide your browser 0-day @ DisobeyHow to hide your browser 0-day @ Disobey
How to hide your browser 0-day @ Disobey
 
Threat hunting in cyber world
Threat hunting in cyber worldThreat hunting in cyber world
Threat hunting in cyber world
 
Operations security - SyPy Dec 2014 (Sydney Python users)
Operations security - SyPy Dec 2014 (Sydney Python users)Operations security - SyPy Dec 2014 (Sydney Python users)
Operations security - SyPy Dec 2014 (Sydney Python users)
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CK
 
Blue team reboot - HackFest
Blue team reboot - HackFest Blue team reboot - HackFest
Blue team reboot - HackFest
 
SEC599 - Breaking The Kill Chain
SEC599 - Breaking The Kill ChainSEC599 - Breaking The Kill Chain
SEC599 - Breaking The Kill Chain
 
Malware Analysis
Malware AnalysisMalware Analysis
Malware Analysis
 
Operations Security - SF Bitcoin Hackday March 2015
Operations Security - SF Bitcoin Hackday March 2015Operations Security - SF Bitcoin Hackday March 2015
Operations Security - SF Bitcoin Hackday March 2015
 
Bsides detroit 2013 honeypots
Bsides detroit 2013 honeypotsBsides detroit 2013 honeypots
Bsides detroit 2013 honeypots
 
[CB19] MalConfScan with Cuckoo: Automatic Malware Configuration Extraction Sy...
[CB19] MalConfScan with Cuckoo: Automatic Malware Configuration Extraction Sy...[CB19] MalConfScan with Cuckoo: Automatic Malware Configuration Extraction Sy...
[CB19] MalConfScan with Cuckoo: Automatic Malware Configuration Extraction Sy...
 
Bsides NYC 2018 - Hunting for Lateral Movement
Bsides NYC 2018 - Hunting for Lateral MovementBsides NYC 2018 - Hunting for Lateral Movement
Bsides NYC 2018 - Hunting for Lateral Movement
 
Virus Bulletin 2018: Lazarus Group a mahjong game played with different sets ...
Virus Bulletin 2018: Lazarus Group a mahjong game played with different sets ...Virus Bulletin 2018: Lazarus Group a mahjong game played with different sets ...
Virus Bulletin 2018: Lazarus Group a mahjong game played with different sets ...
 
SANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
SANSFIRE18: War Stories on Using Automated Threat Intelligence for DefenseSANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
SANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
 
Mastering Next Gen SIEM Use Cases (Part 2)
Mastering Next Gen SIEM Use Cases (Part 2)Mastering Next Gen SIEM Use Cases (Part 2)
Mastering Next Gen SIEM Use Cases (Part 2)
 
How to prevent cyber terrorism taragana
How to prevent cyber terrorism taraganaHow to prevent cyber terrorism taragana
How to prevent cyber terrorism taragana
 
Crypto Token Economy Design for Disruptive BM
Crypto Token Economy Design for Disruptive BMCrypto Token Economy Design for Disruptive BM
Crypto Token Economy Design for Disruptive BM
 
AI and Machine Learning for Analyzing Cryptocurrencies and the Blockchain
AI and Machine Learning for Analyzing Cryptocurrencies and the BlockchainAI and Machine Learning for Analyzing Cryptocurrencies and the Blockchain
AI and Machine Learning for Analyzing Cryptocurrencies and the Blockchain
 

Recently uploaded

New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada
 
My INSURER PTE LTD - Insurtech Innovation Award 2024
My INSURER PTE LTD - Insurtech Innovation Award 2024My INSURER PTE LTD - Insurtech Innovation Award 2024
My INSURER PTE LTD - Insurtech Innovation Award 2024The Digital Insurer
 
"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr BaganFwdays
 
AI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsAI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsMemoori
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsSergiu Bodiu
 
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 3652toLead Limited
 
Dev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio WebDev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio WebUiPathCommunity
 
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...Patryk Bandurski
 
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Mark Simos
 
Scanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsScanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsRizwan Syed
 
Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Commit University
 
APIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDGAPIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDGMarianaLemus7
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationRidwan Fadjar
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek SchlawackFwdays
 
Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Enterprise Knowledge
 
Developer Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQLDeveloper Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQLScyllaDB
 
Vertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering TipsVertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering TipsMiki Katsuragi
 
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...shyamraj55
 
Streamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupStreamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupFlorian Wilhelm
 

Recently uploaded (20)

New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
 
My INSURER PTE LTD - Insurtech Innovation Award 2024
My INSURER PTE LTD - Insurtech Innovation Award 2024My INSURER PTE LTD - Insurtech Innovation Award 2024
My INSURER PTE LTD - Insurtech Innovation Award 2024
 
"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan
 
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptxE-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
 
AI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsAI as an Interface for Commercial Buildings
AI as an Interface for Commercial Buildings
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platforms
 
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
 
Dev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio WebDev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio Web
 
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
 
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
 
Scanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL CertsScanning the Internet for External Cloud Exposures via SSL Certs
Scanning the Internet for External Cloud Exposures via SSL Certs
 
Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!
 
APIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDGAPIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDG
 
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 PresentationMy Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 Presentation
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
 
Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024
 
Developer Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQLDeveloper Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQL
 
Vertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering TipsVertex AI Gemini Prompt Engineering Tips
Vertex AI Gemini Prompt Engineering Tips
 
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
 
Streamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupStreamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project Setup
 

CoinMiners are Evasive - BsidesTLV

  • 1. CoinMiners are Evasive A deep dive into the uncharted territory of CoinMiners stealth tactics Omri SEGEV MOYAL Co-Founder &VP Research @GeloSnake MINERVA Labs Thomas ROCCIA Security Researcher,AdvancedThreat Research @fr0gger_
  • 2. Introduction What will be discussed in the talk: The rise of CoinMiners CoinMiners EvasionTactics CoinMinersTurf Wars DefensiveTactics Predictions BsidesTLV – 2018 - @GeloSnake - @fr0gger_ CryptoCurrency Interest Source: Google Trends
  • 3. The Rise of CoinMiners BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Source: Google News
  • 4. The Rise of CoinMiners BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Source: Google News
  • 5. Business Model Mining relies on GPU, CPU,ASICS... Solo mining is no longer profitable. Both malicious and legitimate miners turn to public pools. Cybercriminals highjack victim machines to create large mining botnets. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ The Rise of CoinMiners
  • 6. Most Currency Mined Monero - cyber criminals most mined currency Relatively high mining profit returns Strong anonymity features Number one currency for web based mining Many open source easy to use tools BsidesTLV – 2018 - @GeloSnake - @fr0gger_ The Rise of CoinMiners
  • 7. InfectionVectors Traditional malware Adding mining functionality Malicious documents and spams Trojanized software and plugins Worms Exploiting web and local vulnerabilities Using brute force WebMining Highjacking legitimate website Iframe and redirects via advertisement BsidesTLV – 2018 - @GeloSnake - @fr0gger_ The Rise of CoinMiners Source: McAfee
  • 8. What’s the big deal? BsidesTLV – 2018 - @GeloSnake - @fr0gger_ The Rise of CoinMiners Source: Comino.com
  • 9. Evasion techniques can be define as follow: BsidesTLV – 2018 - @GeloSnake - @fr0gger_ CoinMiners are Evasive (1) All the digital techniques used by a (mal||soft)ware to avoid, static, dynamic, automatic, human analysis in order to understand its behavior. (2) All the digital techniques used by a malware to avoid (1) and to evade security solutions, security configuration as well human detection to perform malicious action the longer on the infected machines. (3) Evasion techniques are classified as follow: Anti-Sandboxing, Antivirus Evasion, Anti-Debugging, Anti-Monitoring, Packers, Anti- Disassembly, Process Injection, Network Evasion, Obfuscation (encoding, encryption…), Morphism, Anti-Forensic, Anti-Machine Learning.
  • 10. Comes in trojanized online gaming modes Uses Google Drive to host the malicious components Source code found on Pastebin BsidesTLV – 2018 - @GeloSnake - @fr0gger_ WaterMiner | Modified video games on Russian forum tainted with CoinMiner Source: Minerva
  • 11. Impersonate Intel or Oracle software XMRig commands are Embedded in the payload Stop mining when monitoring program executes BsidesTLV – 2018 - @GeloSnake - @fr0gger_ WaterMiner | Hiding in a plain sight
  • 12. Selling on blackmarket Packed samples Watching the clipboard to replace wallet address (LTC, BTC, XMR…) BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Evrial | Watch over what you type Source: McAfee
  • 13. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Evrial | Watch over what you type Bitcoin Stealer Cookie Stealer Source: McAfee
  • 14. Spreads via eternal blue SMB exploit Run parallel to Wannacry Managed to stay under the radar BsidesTLV – 2018 - @GeloSnake - @fr0gger_ UIWIX | Evasive Miner Exploiting ETERNALBLUE
  • 15. Avoid running in virtual machines Look for debuggers and forensics tools Avoid running in eastern Europe countries Look for cuckoo sandbox Look for debuggers and forensics tools BsidesTLV – 2018 - @GeloSnake - @fr0gger_ UIWIX | For i in EvasionTactics: copy/paste i
  • 16. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ XIAOBA | Redirecting security websites XIAOBA Ransomware previously encrypted data now deploy CoinMiner Use fake icon Infect HTML file with Coinhive link to mine Redirect AV website to localhost Disable safe mode, Registry Delete .ISO and .GHO files Infect others PE on the system to run the miner <fail>Crash the system by infecting every exe</fail> Inject Coinhive script Redirect AV websites Remove Backup file Inject into EXE
  • 17. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ XIOBA CoinMiner EvasiveTechniques Fake 360Safe AV Edit etchosts Html file modified Registry disabled Disable Safe Boot XIAOBA | Redirecting security websites
  • 18. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Killing Competition Mining requires resources Some malware remove other threats Some other patches the system
  • 19. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ GhostMiner | Fileless powershell worm Spread via exploits Oracle’s WebLogic – CVE-2017-10271 MSSQL – bruteforce phpMyAdmin bruteforce
  • 20. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ GhostMiner | Fileless killer Improved evasion over time Switched to Powershell Payload improved to only run in- memory Gen.1 Gen.2
  • 21. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ GhostMiner | Anti-competition features Eliminate competitors Kill running miner process Stop and delete miner services Delete miner schedule tasks
  • 22. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ GhostMiner | MinerKiller
  • 23. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ GhostMiner | MinerKiller
  • 24. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Adylkuzz | Patching away competition Adylkuzz used EternalBlue to spread but not directly embedded Patched the vulnerability after infection An old variant spreaded differently April 2017 Variant June 2017 Variant Source: McAfee
  • 25. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ EvasiveTechniques CoinMiner are also using the following techniques: Limit the CPU utilization Enable mining on specific hours Enable mining process when user is inactive Hide behind taskbar (Pop under techniques) Source: Minerva
  • 26. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ EvasiveTechniques CoinMiners continue to evolve by implementing evasion tricks Miners studied implement only some of the evasion tricks Most techniques used are Packers, Injection andAnti-Monitoring Packer Fake App Anti-monitoring Anti-av Anti-sandbox Replace wallet Anti-dbg Anti-forensic Fileless Injection Waterminer X X Evrial X X UIWIX X X X X X XIAOBA X X X X X GhostMiner X X X Adylkuzz X
  • 27. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Detect theThreat Monitoring high CPU activity Miner killer https://github.com/MinervaLabsResearch/BlogPosts/blob/ma ster/MinerKiller/MinerKiller.ps1 Detect withYara Rules https://github.com/advanced-threat- research/IOCs/blob/master/MoneroMiner.yar Monitoring traffic Cryptocurrency Transaction Mining traffic Used CoinblockerList for websites https://github.com/ZeroDot1/CoinBlockerLists
  • 28. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Detect theThreat | CoinblockerList
  • 29. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Detect theThreat
  • 30. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ What to expect in the future? Crypto Miner is a growing threat and could dominate theThreat Landscape. Other targets (SmartTV, IOT, ConnectedCar…?) BankingTrojans targeting Cryptocurrencies (Dridex,Trickbot…) MajorityAttack with Botnet Miners (Verge, BTCGold…) Attack on internal Blockchain implementation (Sybil Attack)
  • 31. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Raise of Botnet Miner Exploitation of weak ADB port (ADBMiner) Open Port 5555 Source: Shodan
  • 32. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Majority Attack Influence Blockchain integrity by forging block Botnet that get control over 51% of the network Generating block faster than the rest of the network Creating its own block Previous attack (Verge Coin, BTC Gold) Honest Miner 49% Malicious Miner 51% Block n Block n+1 Block n+2 Block n+3 Block n+4 Block n+3 Block n+4 Block n+5 Abandonned Blocks Malicious Blocks
  • 33. BsidesTLV – 2018 - @GeloSnake - @fr0gger_ Quick Recap Review of the CryptoMinerThreat Landscape Review of the Malware EvasionTechniques Look into the CryptoMiners Competition Offered defensive tactics Exploring future trends
  • 34. Thank you! Omri SEGEV MOYAL Co-Founder &VP Research @GeloSnake MINERVA Labs Thomas ROCCIA Security Researcher,AdvancedThreat Research @fr0gger_ Q/A

Editor's Notes

  1. Coin miner botnet is growing threat here is an example.