This Cryptomining Malware Launches Linux VMs On Windows and macOS

Cybersecurity researchers from at least two firms today unveiled details of a new strain of malware that targets Windows and macOS systems with a Linux-based cryptocurrency mining malware.

It may sound strange, but it's true.

Dubbed "

LoudMiner

" and also "

Bird Miner,

" the attack leverages command-line based virtualization software on targeted systems to silently boot an image of Tiny Core Linux OS that already contains a hacker-activated cryptocurrency mining software in it.

Isn't it interesting, i.e., using emulation to run single-platform malware on cross-platforms?

Spotted by researchers at

ESET

and

Malwarebytes

, attackers are distributing this malware on the Internet and via Torrent network since August 2018, which comes bundled with pirated and cracked copies of VST (Virtual Studio Technology) software.

VST applications contain sounds, effects, synthesizers, and other advanced editing features that allow tech-centric audio professionals to create music.

"Regarding the nature of the applications targeted, it is interesting to observe that their purpose is related to audio production; thus, the machines that they are installed on should have the good processing power and high CPU consumption will not surprise the users," ESET researchers said.

Researchers have found various malicious versions of nearly 137 VST-related applications, where 42 of them are for Windows and 95 for macOS platform, including Propellerhead Reason, Ableton Live, Sylenth1, Nexus, Reaktor 6 and AutoTune.

For macOS systems, the software runs multiple shell scripts and uses the open-source Quick Emulator (QEMU) utility to launch the virtual Linux OS, and on Windows targets, it relies on VirtualBox.

Once Installed and activated, the malware also gains persistence on the system by installing additional files and then launch virtual machines in the background.

These Linux OS images have already been pre-configured by attackers to lunch cryptocurrency mining software automatically on the startup without ever needing a user to log in and also connect to the hacker's command-and-control servers.

"OVF file included in the Linux image describes the hardware configuration of the virtual machine: it uses 1GB of RAM and 2 CPU cores (with maximum usage of 90%)," ESET researchers said.

"The Linux image is Tiny Core Linux 9.0 configured to run XMRig, as well as some files and scripts to keep the miner updated continuously."

The malware "can run two images at once, each taking 128 MB of RAM and one CPU core" to mine simultaneously.

"Further, the fact that the malware runs two separate miners, each running from their own 130 MB Qemu image file, means that the malware consumes far more resources than necessary," Malwarebytes said.

The attack is another good reason why you should never trust unofficial and pirated software available on the Internet.

from The Hacker News http://bit.ly/2WV3gmw