{"id":31539,"date":"2018-04-05T11:20:41","date_gmt":"2018-04-05T03:20:41","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=31539"},"modified":"2018-04-05T11:20:41","modified_gmt":"2018-04-05T03:20:41","slug":"philippines-among-top-3-countries-infected-by-coin-mining-trojan","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2018\/04\/05\/philippines-among-top-3-countries-infected-by-coin-mining-trojan\/","title":{"rendered":"Philippines among top 3 countries infected by coin mining Trojan"},"content":{"rendered":"

\"\"<\/a>For the past few months, Unit 42 researchers have investigated a relatively unknown coin mining Trojan that goes by the name \u2018Rarog\u2019.<\/p>\n

Rarog has been sold on various underground forums since June 2017 and has been used by countless criminals since then. To date, Palo Alto Networks has observed roughly 2,500 unique samples, connecting to 161 different command and control (C2) servers.<\/p>\n

Rarog has been seen primarily used to mine the\u00a0Monero<\/a>\u00a0cryptocurrency, however, it has the capability to mine others.\u00a0 It comes equipped with a number of features, including providing mining statistics to users, configuring various processor loads for the running miner, the ability to infect USB devices, and the ability to load additional DLLs on the victim.<\/p>\n

Rarog is in line with the overall trends we\u2019ve seen regarding the rapidly increasing use of cryptocurrency miners. Additionally, Rarog provides an affordable way for new criminals to gain entry into this particular type of malware.<\/p>\n

To date, we have confirmed over 166,000 Rarog-related infections worldwide. The majority of these occur in the Philippines, Russia, and Indonesia. While a large number of infections have been recorded by various criminals who have used this mining Trojan, we have seen very little recorded profits: the highest profits we have observed amount to roughly US $120.<\/p>\n

The Trojan itself is likely named after a \u201cRar\u00f3g<\/a>\u201d, a fire demon that originates in Slavic mythology and is typically represented as a fiery falcon.<\/p>\n

Rarog on the Underground<\/strong><\/p>\n

The Rarog Trojan originated on various Russian-speaking criminal underground sites in June 2017, as shown in the image below:<\/p>\n

\"\"<\/a><\/p>\n

The malware sells for 6,000 Rubles, or roughly US $104 at today\u2019s exchange rates. Additionally, a guest administration panel is provided to allow potential buyers the chance to do a \u201ctest drive\u201d by interacting with the interface. This interface may be seen below:<\/p>\n

\"\"<\/a>

Figure 2 Rarog administration panel <\/em><\/strong><\/p><\/div>\n

Note the two Twitter handles shown in the administration panel above. The first handle, \u201carsenkooo135\u201d, is the same handle used in various postings for this malware family, including the one shown in Figure 1. We observed the second handle, \u201cfoxovsky\u201d, interacting with other security researchers online. We also tied this handle to a GitHub repository with the same handle that hosts various other malware families. Evidence suggests that these two individuals are the ones behind this threat.<\/p>\n

dditionally, we have seen the \u201cfoxovsky\u201d account on GitHub host the Rarog malware family on his or her GitHub account.<\/p>\n

Rarog Malware Family<\/strong><\/p>\n

At a very high level, the Rarog Mining Trojan performs the following actions:<\/p>\n

\"\"<\/a>

Rarog flow of execution<\/em><\/strong><\/p><\/div>\n

The malware comes equipped with a number of features. It uses multiple mechanisms to maintain persistence on the victim\u2019s machine, including the use of the Run registry key, scheduled tasks, and shortcut links in the startup folder. At its core, Rarog is a coin mining Trojan and gives the attackers the ability to not only download mining software but configure it with any parameters they wish. They\u2019re also able to easily throttle the mining software based on the victim machine\u2019s characteristics.<\/p>\n

In addition to coin mining, Rarog also employs a number of botnet techniques. It allows the attackers to perform a number of actions, such as downloading and executing other malware,\u00a0levying DDoS attacks against others, and updating the Trojan, to name a few. Throughout the malware\u2019s execution, a number of HTTP requests are made to a remote C2 server. An overview of all of these URIs and their description may be found below:<\/p>\n

\"\"<\/a><\/p>\n

Victim Telemetry<\/b><\/p>\n

We identified a total of 161 C2 servers communicating with the Rarog malware family. A full list may be found in the\u00a0Appendix.<\/a>\u00a0Looking at the geographic distribution of these C2 servers, we see a high concentration of them located in Russia and Germany.<\/p>\n

The distribution rate of new Rarog samples has varied in the past nine months, with a large spike occurring between late August to late September of 2017. At its peak, we encountered 187 unique Rarog samples during the week of September 11, 2017.<\/p>\n

These samples confirm at least 166,000 victims spread across the globe. While infections occur in most regions of the world, high concentrations occur in the Philippines, Russia, and Indonesia, as seen in the figure below:<\/p>\n

\"\"<\/a>

Rarog infections across the globe<\/em><\/strong><\/p><\/div>\n

Rarog is able to provide telemetry those that have purchased it using the third-party MinerGate mining service. A number of MinerGate API keys were able to be retrieved, however, the profits made by these attackers were minimal at best. The most profitable attacker was found to generate roughly 0.58 Monero (XMR), and 54 ByteCoin (BCN). By today\u2019s exchange rates, this amounts to $123.68 total. After factoring in the cost of the malware itself at $104, the attackers in question have generated very little income. In most cases, they\u2019ve lost money.<\/p>\n

Ties to Previous Malware Families<\/strong><\/p>\n

In late October 2017, Kaspersky\u00a0wrote a blog post<\/a>\u00a0about a malware family named \u2018DiscordiaMiner\u2019. In this blog post, they describe a cryptocurrency miner that shared a number of characteristics with Rarog. Upon further inspection, they mention the author of the program, who is none other than the previously mentioned \u201cfoxovsky\u201d user. Indeed, when looking at this user\u2019s GitHub account in Figure 4, we saw the source code to this mining Trojan. The last time the source code to this particular malware was updated was on May 25th<\/sup>, 2017.<\/p>\n

Looking at the source code to DiscordiaMiner, we see a large number of similarities with Rarog. So many in fact, that we might reach the conclusion that Rarog is an evolution of Discordia. Kaspersky\u2019s blog post discussed some drama concerning this particular malware family on various underground forums. Accusations were made against the Trojan\u2019s author with substituting customer\u2019s cryptocurrency wallet addresses with his own. This dispute is what ultimately led foxovsky to open-source the DiscordiaMiner program on GitHub. The timeline of when Rarog was first advertised in June 2017, as well as the time DiscordiaMiner was last updated in May 2017, paints, and interesting picture. Based on this information, as well as the heavy code overlap made between the malware families, I suspect that foxovsky rebranded DiscordiaMiner to Rarog and continued development on this newly named malware family. This re-branding allowed him to get away from the negativity that was associated with DiscordiaMiner.<\/p>\n

Conclusion<\/strong><\/p>\n

The Rarog malware family represents a continued trend toward the use of cryptocurrency miners and their demand on the criminal underground. While not incredibly sophisticated, Rarog provides an easy entry for many criminals into running a cryptocurrency mining botnet. The malware has remained relatively unknown for the past nine months barring a few exceptions. As the value of various cryptocurrencies continues to remain high, it is likely that we\u2019ll continue to see additional malware families with mining functionality surface.<\/p>\n

Palo Alto Networks customers are protected against this threat in the following ways:<\/p>\n