GuptiMiner Exploits eScan to Distribute Miners and Backdoors

Avast researchers recently uncovered GuptiMiner, an aged malware. It leverages the eScan antivirus update system to surreptitiously implant backdoors and cryptocurrency mining software into users’ computers and extensive corporate networks. This discovery underscores cybercriminals’ efforts to circumvent contemporary security protocols. Let’s delve deeper into this development.

GUPTIMINER EXPLOITS

Avast experts examined GuptiMiner, a malware active since 2018, targeting corporate networks with backdoors and concealed cryptomining. Employing a multi-stage infection process, the malware initiates by intercepting antivirus updates via man-in-the-middle (MitM) assaults, enabling attackers to replace authentic updates with malicious ones.

Avast alerted eScan and India CERT about the discovered vulnerability, successfully patched on July 31, 2023. However, as users seldom employ multiple antivirus programs, it hampers the ability to fully detect and analyze GuptiMiner’s operations.

The malware employs a sophisticated infection process. Initially, it intercepts eScan antivirus updates. During the download process, an attacker intervenes, replacing the legitimate update with a malicious version. Subsequently, eScan decompresses and downloads the package, initiating a chain of infection via a DLL. This DLL facilitates further downloads and code execution by the virus.

Following this, GuptiMiner employs a sideloading method to insert malicious code into trusted processes, ensuring its invisibility to antivirus systems. Additionally, the malware communicates with remote command and control (C2) servers to receive instructions and updates. This grants attackers control over infected systems, enabling the execution of further malicious activities or cryptocurrency mining operations.

HOW GUPTIMINER OPERATES

The GuptiMiner analysis unveiled its utilization of sophisticated methods to install and conceal its presence on systems. Key techniques encompassed sideloading DLL, altering system files, and employing forged digital signatures to feign legitimacy.

Furthermore, GuptiMiner’s distinguishing trait is its capacity to modularize infections, involving DNS queries to the attacker’s DNS servers and extracting data from seemingly innocuous images. In addition to its primary function of installing backdoors, GuptiMiner unexpectedly disseminates the XMRig miner for Monero cryptocurrency mining.

The malware is potentially associated with Kimsuky, a prominent North Korean hacking group, suggesting potential state sponsorship and highly organized attacks. Given North Korean hackers’ previous interest in cryptocurrency, this revelation isn’t entirely unexpected.

During GuptiMiner analysis, researchers uncovered two distinct types of backdoors, each tailored to serve specific functions within a meticulously orchestrated and expansive campaign targeting corporate networks.

The initial type of backdoor, a modified PuTTY Link, scans SMBs on the local network. This enables lateral movement, granting access to potentially vulnerable systems running Windows 7 and Windows Server 2008, thus exploiting vulnerabilities in legacy operating systems.

The second type of backdoor is multifunctional and modular, receiving commands from the attacker to install extra modules. Its focus lies in locating and pilfering locally stored private keys and cryptocurrency wallets. This tactic enables attackers to surveil infected systems over extended periods and trigger supplementary malicious functionalities as needed.

Indicators of Compromise

Domains 

Mutexes 

Stage 0 – Installation Process 

Stage 1 – PNG Loader 

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!