ZombieBoy, a new crypto-mining family, recently clocked in at 43 KH/s — or $1,000 per month at current Monero prices.

Independent security researcher James Quinn described ZombieBoy, a new family of crypto-mining malware, in AlienVault on July 18. The name comes from the ZombieBoyTools kit the malware uses to drop its first dynamic link library (DLL) file. Much like MassMiner, ZombieBoy is a highly infectious worm, but it uses WinEggDrop rather than MassScan to identify new hosts.

Before recently shutting down one of its addresses on Monero mining pool MineXMR, the crypto-mining malware was raking in approximately $1,000 worth of the digital currency every month, according to Quinn. Based on its use of the Simplified Chinese language, ZombieBoy likely originates from China.

ZombieBoy Exploits Multiple CVEs to Beat Security Defenses

ZombieBoy leverages multiple vulnerabilities to compromise networks, including CVE-2017-9073, a remote desktop protocol (RDP) vulnerability on XP and Server 2003, and Server Message Block (SMB) exploits CVE-2017-0143 and CVE-2017-0146. It then uses DoublePulsar and EternalBlue to create multiple backdoors, both increasing the chance of compromise and making it harder for IT teams to eliminate infections.

The crypto-mining malware is encrypted with Themdia and won’t run on virtual machines (VMs). This makes it hard to both capture and reverse engineer, limiting the efficacy and development of countermeasures.

ZombieBoyTools is linked to other Chinese malware like IRON TIGER APT (itself a variant of Gh0st RAT). This suggests not only persistence but also continued evolution. ZombieBoy’s double backdoors could pave the way for crypto-mining malware and leave the gate open for ransomware, keyloggers and other malicious tools.

How Can Companies Combat Crypto-Mining Malware?

While it’s tough to stop threats like ZombieBoy outright, companies can take action to limit risk. IBM security researchers recommend blocking command-and-control (C&C) traffic that exploits like DoublePulsar and EternalBlue rely on using signatures such as SMB_EternalBlue_Implant_CnC and SMB_DoublePulsar_Implant_CnC.

Security experts also recommend building intelligent, integrated immune systems capable of responding to multiple threats, including crypto-mining, ransomware and distributed denial-of-service (DDoS) attacks. This ecosystem of solutions should include two-factor authentication (2FA), advanced web application firewalls and the ability to limit or disable unused ports and services.

Source: Alien Vault