Nitrokod Crypto Miner Disguises as Free Software Apps

The campaign

• The campaign serves malware via free software hosted on sites such as Uptodown and Softpedia.
• The executable starts a four-stage attack sequence, each dropper further pulling the next one. This eventually leads to the download of actual malware (XMRig) dropping in the seventh stage.
• The campaign victims are located in different countries such as the U.K, Sri Lanka, the U.S., Greece, Australia, Israel, Turkey, Cyprus, Mongolia, Poland, and Germany.

More insights

• The stage 3 dropper runs after a gap of five days, while the fourth stage dropper further creates four scheduled tasks with an interval of 1 to 15 days. After the creation of these tasks, the stages are deleted.
• This makes it very challenging for the investigators to identify the attack and trace it back to the fake installer.
• Further, the malware establishes a connection to a remote C2 server to get a configuration file to start the mining activity using XMRig.

Conclusion