How does the trojan function?
Researchers from Yandex discovered the MonsterInstall downloader trojan, who then reported it to Doctor Web's research team for further analysis. Doctor Web researchers analyzed the trojan sample and revealed the following insights.
The cryptomining module
The cryptomining module loads the malicious executable ‘xmrig.exe’. The executable sends system information to its C&C server and gets back the miner configuration in the form of a JSON file.
Once the miner configuration file is loaded, it will automatically execute and start mining the TurtleCoin cryptocurrency.
“Developers of this malware own several websites with game cheats, which they use to spread the malware, but they also infect other similar websites with the same trojan. According to SimilarWeb’s statistics, users browse these websites at least 127,400 times per month,” Doctor Web researchers said.