New malware discovered to mine cryptocurrencies

Two days ago, Microsoft came across fast-spreading encrypted malware, which infected nearly 500, 000 computers in just 12 hours and largely blocked it.

Microsoft detected this malware infecting almost 500, 000 computers

Dubbed Dofoil, aka Smoke Loader, was the one that found and discovered malware in a cryptocurrency mining app. The malware infected almost 500, 000 Windows computers and the application basically took out coins from Electroneum.

On March 6, Windows Defender suddenly detected more than 80, 000 instances of various Dofoil variants that raised the alarm in Microsoft's Windows Defender investigation department, and in the next 12 hours, more than 400, 000 incidents were reported.

The investigative team found that all of these cases were spreading rapidly across Russia, Turkey and Ukraine. The malware present in a mining application was disguised as a legitimate Windows binary to evade detection.

Microsoft has not mentioned how these incidents occurred so massively and in such a short period of time. Dofoil uses a custom mining application that can mine different coins, but this time, the malware was programmed to mine Electroneum coins only from the affected computers.

According to the researchers, the Dofoil Trojan uses an old code injection technique called “Process Hollowing” which consists of generating a new instance of a legitimate process with a malicious one so that the second code is executed instead of the original monitoring tools. processes and antivirus. A method that seems that it was not very effective that we say this time.

TheHackerNews Font