Researchers at Fortinet have discovered a new Bitcoin Miner Malware being spread via very famous botnet called Andromeda. Researchers found that the earlier version of Andromeda i.e. v2.06 is found to be leveraged by the cyber criminals and used to spread Bitcoin Miner malware.
About Andromeda 2.06
According to Fortinet, The network traffic of most Andromeda variants are very similar. On a comparison between sent and received data it was found that, the sent data was Base64-encoded and the received data was in binary.
After decoding the message that was sent to the C&c Server, it was found that the data has integrated the current bot version.
id:1020634358|bid:1697716224|bv:518|sv:1281|pa:0|la:167772687|ar:1
In the decrypted data above, bv means build version. When the following number, 518 was converted to its hex value, the number 206 was found.
The build version number is also hardcoded in the binary.
Comparison of Cracked version with Original one
Researchers found several nop codes in the bianry, which are found in the location of some critical codes in the original version of Andromeda 2.06.
The left side of the figure above is the original code, and the left side is the cracked one. As we can see, the author removed the call to the RC4 subroutine, which the original version of the bot used to encrypt/decrypt certain portions of the bot's code. The author might have done this in order to make it much easier to update the encrypted data, such as the URL of the C&C server and the corresponding RC4 key for encrypting the network traffic.
Fortinet people suspect that the Cyber criminals cracked this version as they didn't have access to the source code of Andromeda. The malware is detected as W32/Kryptik.AFJS!tr.
Spread of Bitcoin Miner
Researches captured following command that the C&C Server delivered to the bot. In the figure below, we can see that there is a download link for a file which is actually a Bitcoin miner binary. The miner, detected as Riskware/BitCoinMiner, could exhaust the victim's resources once executed.
Fortinet researchers also captured the Bitcoin Miner network traffic.
Conclusion
Researchers at Fortinet, raise concerns about the use of botnets by the cyber criminals. It is not only restricted to buying of the botnets from underground market, but this report reveals new ways of spread of malware using cracked versions of botnets.
