English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Skypemageddon by bitcoining

Dmitry Bestuzhev
Kaspersky Lab Expert
Posted April 04, 08:45  GMT
Tags: Botnets, Social Engineering, Skype
0.3
 

Is it a Skype day? Or maybe a Bitcoin one? Or maybe just both?

I say this because right after I published my previous post about malware ongoing campaign on Skype, a mate from Venezuela sent me a screenshot of her Skype client with a similar campaign in terms or propagation but different in origins and purposes. Here is the original screenshot:

(Translation from Spanish: “this is my favorite picture of you”)

This campaign is born right today and is ongoing too:

An average clicking is also pretty high with more than 2k clicks per hour. Most of potential victims live in Italy then Russia, Poland, Costa Rica, Spain, Germany, Ukraine and others.

The initial dropper is downloaded from a server located in India. The detection rate on VirusTotal is low. Once the machine is infected it drops to the system many other pieces of malware. Downloads come from the Hotfile.com service. At the same time the malware connects to its C2 server located in Germany.

The IP address of C2 is 213.165.68.138:9000

So what does malware do? To be honest many things but one of the most interesting is it turns the infected machine to a slave of the bitcoin generator. The usage of CPU grows up significantly. Here is an example:

The mentioned process runs with the command “bitcoin-miner.exe -a 60 -l no -o http://suppp.cantvenlinea.biz:1942/ -u XXXXXX0000001@gmail.com -p XXXXXXXX” (sensitive data was replaced by XXXXXX) It abuses the CPU of infected machine to mine Bitcoins for the criminal.

As I said the campaign is quite active. If you see your machine is working hard, using all available CPU resources, you may be infected.

The initial dropper is detected by Kaspersky as Trojan.Win32.Jorik.IRCbot.xkt.

Follow me on twitter: @dimitribest


3 comments

Oldest first
Threaded view
 

mark117

2013 Apr 05, 11:27
0
 

Skypemageddon

Hi Dmitry Bestuzhev

Thank you for another intresting read,
and especially the information that you can get from this site on the virus/malware issues that can blight the computer users of today.
Thank You
mark117

Reply    

sultan mahmud

2013 Apr 09, 06:15
-2
 

Football Most Fans In The World

Thank you.
Please visit http://footballworld2013.blogspot.com

Reply    

Guest

2013 Apr 20, 09:20
0
 

How does this infect the target system? I guess you have to not just click the link but also download and "open" (execute) the file you have downloaded.

Thus just clicking on the link is no problem.
Or am I wrong here? Does this use some exploit which makes the browser execute the code without the user opening the file?

Reply    
If you would like to comment on this article you must first
login


Bookmark and Share
Share

Analysis

Blog