Legitimate PDF Software  - y6ipm1537408593 - Hackers Injecting Crypto-mining Malware into Legitimate PDF Software

Cybercriminals using a new type of called Evil clone to inject Cryptocurrency into software to Mine cryptocurrency with the help of CoinHive miner.

Cryptocurrency malware is dramatically increasing this year to compromise various victims and an attacker generates huge revenue by illegally running miner using victims system resource.

Attackers abusing legitimate PDFescape software application installer to modify the package in order to delivery the crypto-mining malware.

PDFescape is a web-based PDF editor program written in JavaScript, HTML, CSS and ASP. Many Peoples using this software for PDF editing, form filling, page arrangement, printing, saving, and form publishing.

- pdfescape 1 - Hackers Injecting Crypto-mining Malware into Legitimate PDF Software

Cybercriminals always using legitimate software to perform malicious activities by applying various modification even though legitimate software’s are secure to use.

In this case, the Attacker went to a depth into the legitimate PDF software PDFescape and create a evil clone.

Malware Injecting Process

Initially, attacker created the similar infrastructure on a server which is controlled by an attacker same as legitimate software vendor infrastructure.

Later they copied all the MSI file from the PDFescape software (installer package file for Windows) and placed it into the newly created infrastructure.

An attacker then decompiled and modified one of MSI and also added the additional malicious files which is represented the coin miner source code that turns the original installer of PDFescape into a malicious one.

- pdf desktop - Hackers Injecting Crypto-mining Malware into Legitimate PDF Software

This new installer redirect victims into malicious website and downloads the payload with the hidden file.

Attackers spreading this malicious package(pdfescape-desktop-Asian-and-extended-font-pack) in various form, once victim download and execute this malicious file then it drops malicious binary xbox-service.exe.

- xboxservice - Hackers Injecting Crypto-mining Malware into Legitimate PDF Software

Then it runs malicious DLL under rundll32 with the name setup.log using the command line:

rundll32 C:WindowsSystem32setup.log.dll

- rundull32c - Hackers Injecting Crypto-mining Malware into Legitimate PDF Software

Researchers from Comodo Cybersecurity performed a static analysis that reveals after the DLL file runs malicious process xbox-service.exe,  DLL payload tries to modify the Windows HOSTS file to prevent the infected machine from communication with update servers of various PDF-related and security software. Thus malware tries to avoid a remote cleaning and remediation of affected machines.

- DLL malicious file - Hackers Injecting Crypto-mining Malware into Legitimate PDF Software

finally, the malicious DLL contains a dangerous browser script with an embedded link http://carma666.byethost12.com/32.html.

- link - Hackers Injecting Crypto-mining Malware into Legitimate PDF Software

Once the embedded link will be executed then it downloads JavaScript of coinminer named CoinHive that utilize the infected system resource and generate the revenue.

Also Read:

Malware Abuse Google Ads to Injecting Coinhive Cryptocurrency Miner

Chinese Threat Actors Rocke Launching Sophisticated Crypto-mining Malware to Mine Monero Cryptocurrency



Source link

LEAVE A REPLY

Please enter your comment!
Please enter your name here