Firewall rules added by WebFreer installer<\/figcaption><\/figure>\n3.1 Digging deeper<\/h3>\n
Let’s analyze in details these files.<\/p>\n
WebClientService.exe<\/h4>\n
As was mentioned before, the launch of this executable file occurs via the WebClientService service created during the installation of the browser. It is obvious that authors of malware tried to hide using similar name with a legitimate WebClient service. A usual user won\u2019t notice a dirty trick, even if he decides to see the list of processes manually.<\/p>\n
Static analysis leads us to conclude that the file was written by C ++. Obviously, the application does not have a graphical interface.<\/p>\n![\"WebClientService.exe](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/11.png\" "\\"\\"")
WebClientService.exe written in C++<\/figcaption><\/figure>\nIt is worth paying attention to the import of functions. In addition to the standard ones, the use of the curl library is obvious. Obviously, in the future we will see the interaction of service with the Internet.<\/p>\n![\"Service](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/23.png\" "\\"\\"")
Service uses curllib<\/figcaption><\/figure>\nIn the further analysis, some variables and functions have been renamed for easier perception. They, as well as comments, are listed in the screenshots below.<\/p>\n
Further analysis shows that file has standard main function, in which the internal function is associated with the WebClientService service by WinAPI\u2019s StartServiceCtrlDispatcher function.<\/p>\n![\"Service\u2019s](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/12.png\" "\\"\\"")
Service\u2019s start function is standard<\/figcaption><\/figure>\nLet’s take a closer look at the function that is executed in conjunction with the service. We immediately see the registration of the control handler function (via RegisterServiceCtrlHandler), as it should be.<\/p>\n![\"Service\u2019s](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/14-1024x449.png\" "\\"\\"")
Service\u2019s main function<\/figcaption><\/figure>\nLet’s not rush things and analyze the function of processing control code. The control codes processing function itself is of no interest and can only accept SERVICE_CONTROL_STOP code. Accordingly, service can\u2019t be suspended.<\/p>\n
An interesting point is that in the case of receiving the SERVICE_CONTROL_STOP code, the processing function returns in response to SERVICE_STOP_PENDING, and the service execution does not stop immediately (but the service will be forcibly terminated by SCM after the expiration of the time limit). Malware authors don\u2019t specify the parameter dwWaitHint, which should be passed in case of the return of code SERVICE_STOP_PENDING. Though it doesn\u2019t affect the main functionality of the malicious service.<\/p>\n![\"Service\u2019s](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/13.png\" "\\"\\"")
Service\u2019s control handler function<\/figcaption><\/figure>\nAfter registering the handler of the control codes, we see the standard preparation for the launch of service. After creating the service completion event, you can notice an interesting function that for convenience of analysis was called by us GetHedgeCoinData. It runs twice: if the first start was unsuccessful, the malicious one waits for 60 seconds (Sleep (60000)), then makes a second attempt.<\/p>\n
Let’s look at the function itself to understand what functions it is doing.<\/p>\n![\"GetHedgeCoinData](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/15.png\" "\\"\\"")
GetHedgeCoinData function is small yet interesting<\/figcaption><\/figure>\n![\"Nested](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/16.png\" "\\"\\"")
Nested CheckAvailability function uses curl library<\/figcaption><\/figure>\nMalware uses the curl library to connect to the URL hXXps: \/\/sites.google.com\/site\/hedgecoin. After the request was made, the response code and return data are checked. The GetHedgeCoinData function succeeds if the query was executed.<\/p>\n
As you can see, the site is disabled by Google right now, so it is not possible to retrieve the data that was on this domain.<\/p>\n![\"Google](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/17.png\" "\\"\\"")
Google disables malicious site. Nice job!<\/figcaption><\/figure>\nHowever, as we didn\u2019t get information from the specified web address, the malware uses the predefined (hardcoded) parameters:
\n-a cryptonight -o stratum+tcp:\/\/mine.anybt.com:1111 -u 478WNYwHN4SQs8j89P8QJY4DKm2c6JhCQizi5ucjooKuFQirbtEsafJinSXLwZcysnN1L98r2vocKjGjKoXRrEiRGpmyErc -p x -t 1<\/p>\n
Obviously, these parameters are used for cryptocurrency mining. Specifically, the algorithm cryptonight and the domain mine.anybt.com, located on the hosting GoDaddy.com (based on whois information) is in use.<\/p>\n![\"WhoIs](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/22.png\" "\\"\\"")
WhoIs information about anybt.com domain<\/figcaption><\/figure>\nRemember these settings, they will be used below. The next function we named CheckWebProxyFiles , that processed files used by malware.<\/p>\n![\"Checking](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/18.png\" "\\"\\"")
Checking files and copying them<\/figcaption><\/figure>\nAs you can see from the code, there can be 3 identical malicious files on the user’s system:<\/p>\n
\n- %commonappdata%\\_iocache_.dat<\/li>\n
- %system%\\webproxy.exe<\/li>\n
- %programfiles%\\WebFreer\\webproxy.exe<\/li>\n<\/ol>\n
If any of the last two files will be removed, service will restore from a copy in %commonappdata%\\_iocache_.dat.<\/p>\n
Let’s return to the main function. After the above operations with files, the following function is executed, that is intended for launching webproxy.exe.<\/p>\n![\"Finally](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/19.png\" "\\"\\"")
Finally launching webproxy.exe with needed parameters<\/figcaption><\/figure>\nThe service checks the presence of %system%\\webproxy.exe or %programfiles%\\WebFreer\\webproxy.exe file (it\u2019s enough at least one of them), and then generates the startup parameters (the ones we saw above). After that it creates the process, saving its ProcessID. The constant bCreateProtectedProcess, hidden into the application code, attracts attention. If its value is 76 (0x4C), then the process is started as a protected one. In the sample analyzed by us this value was equal to 76.<\/p>\n
The further behavior of the service depends on the success of launching the webproxy.exe process. If the process couldn\u2019t be started, the service is shut down.<\/p>\n![\"Further](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/20.png\" "\\"\\"")
Further behavior depends on process start\u2019s result<\/figcaption><\/figure>\nIf the webproxy.exe process is successfully launched, the service is marked as started and it creates an endless stream, in which the integrity of the files (CheckWebProxyFiles) is checked and the process of webproxy.exe is restarted, if necessary.<\/p>\n![\"Every](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/21.png\" "\\"\\"")
Every 5 seconds service keeps an eye on webproxy process<\/figcaption><\/figure>\nSo, it’s time to sum up.<\/p>\n
Service WebClientService:<\/p>\n
\n- refers to a file %system%\\WebClientService.exe;<\/li>\n
- starts automatically when the system starts up;<\/li>\n
- executes a request to the URL hXXps:\/\/sites.google.com\/site\/hedgecoin;<\/li>\n
- has built-in parameters for mining (but does not do mining itself);<\/li>\n
- It starts a protected process at startup %system%\\webproxy.exe or %programfiles%\\WebFreer\\webproxy.exe;<\/li>\n
- performs file copying operations %commonappdata%\\_iocache_.dat, %system%\\webproxy.exe and %programfiles%\\WebFreer\\webproxy.exe;<\/li>\n
- after startup it monitors every 5 seconds the status of the webproxy.exe process and, if necessary, starts it again;<\/li>\n
- after startup it monitors every 5 seconds the presence of %commonappdata%\\_iocache_.dat, %system%\\webproxy.exe and %programfiles%\\WebFreer\\webproxy.exe. If necessary, restores them from copies.<\/li>\n<\/ol>\n
webproxy.exe<\/h4>\n
When parsing the WebClientService service, we repeatedly encountered the mention of another malicious file – webproxy.exe. Due to information already received, we can safely assume that this file is a coin miner. Let\u2019s check this hypothesis.<\/p>\n![\"PE](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/24.png\" "\\"\\"")
PE Header tells us it is a 64-bit EXE<\/figcaption><\/figure>\nInformation from the PE header tells us that this file is executed on 64-bit systems. It is very strange for a malware, because this can potentially reduce the number of infected systems, although most computers in the world work on modern OS with 64-bit width. At least Windows x86 users can sleep peacefully, this coin miner won\u2019t even launch on their systems.<\/p>\n![\"Packed](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/25.png\" "\\"\\"")
Packed with UPX. Boring<\/figcaption><\/figure>\nData about the sections in the PE header tells us that we face a packed UPX file in front of us.<\/p>\n
After the routine unpacking procedure, we get the usual executable console file written in C.<\/p>\n![\"We](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/26.png\" "\\"\\"")
We got non-packed 64-bit executable<\/figcaption><\/figure>\nLet’s check the string constants in the file and, perhaps, we will find something interesting.<\/p>\n![\"Yep.](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/27.png\" "\\"\\"")
Yep. CPUMiner-Multi is used<\/figcaption><\/figure>\nIndeed, we have found an interesting fact. Let’s allow the proposition that we are dealing with the original cpuminer-multi. The malware authors did not remove the string constants from the file, so we even got the GitHub of the coin miner’s author (not a malicious program, but the legitimate utility for mining – cpuminer-multi). We found cpuminer-multi-version 1.3.1 on GitHub without problems. The only thing left to do is just to compare our files with those found.<\/p>\n![\"So,](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/28.png\" "\\"\\"")
So, webproxy.exe is actually cpuminer-gw64-core2.exe<\/figcaption><\/figure>\nNow it is clear why webproxy.exe is a 64-bit application, regardless of the OS bitness on which WebFreer is installed: cpuminer-multi version 1.3.1 exists only in 64-bit version.<\/p>\n![\"Mining](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/30.png\" "\\"\\"")
Mining process is in progress\u2026<\/figcaption><\/figure>\nIn total, webproxy.exe is not of much interest for analysis, since it is a copy of the common utility for mining cpuminer-gw64-core2.exe.<\/p>\n
3.2 Was WebFreer always be so?<\/h3>\n
We decided to check whether users of the previous version of the WebFreer browser are at risk. To do this, we downloaded the previous browser version – 1.3.1.0, and compared the contents of the installers.<\/p>\n![\"Not](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/31.png\" "\\"\\"")
Not webproxy.exe neither webclientserver.exe are present<\/figcaption><\/figure>\nAs it turned out, the previous version of the browser WebFreer did not contain any malicious elements, namely – hidden coin miners.<\/p>\n
4.Conclusion<\/h2>\n
Together with you, we have found and analyzed the WebFreer browser, which is installed in a system along with malicious elements. They carry out crypto-currency mining causing harm to your system and computer. Your computer is busy solving the mining tasks. As a result, its performance and speed are reduced, and there may be a problem of a high noise level of cooling systems, overheating, and even breakdown of the computer.<\/p>\n
Whether the malicious minor was included in the WebFreer browser purposefully by its authors or whether a cyberattack was performed on their server, it is impossible to say for sure because there is no digital signature.<\/p>\n
At the end of our analysis, we would like to give you some tips on how to protect yourself and your loved ones.<\/p>\n
\n- Use only the latest versions of the software.<\/li>\n
- Install operating system updates in a timely manner. Most infections can be avoided simply by installing OS updates.<\/li>\n
- Use only trusted browsers.<\/li>\n
- Do not install unknown software from suspicious sources.<\/li>\n
- Check the presence of a digital signature in the programs that you use. This will not be the 100% solution against infection, but it will significantly reduce it.<\/li>\n
- If you notice a slowdown or worsening of your PC performance, scan your system.<\/li>\n<\/ul>\n
Coin miners gain popularity, so dozens of new viruses appear every hour, and usual antiviruses can\u2019t effectively fight them. GridinSoft Anti-Malware updates the virus database hourly, so you can be sure that you have the strongest protection.<\/p>\n","protected":false},"excerpt":{"rendered":"
1. Coin Miner malware gains its popularity Due to rising cost of cryptocurrency recently, Bitcoin particularly (BTC) to 20000 USD, our Analysts Team noticed an increased amount of malicious programs, especially those who focused on the secret mining of cryptocurrency. GridinSoft Anti-malware detect them as Trojan.CoinMiner\/Risk.CoinMiner. For few recent months CoinMiner is one of the […]<\/p>\n","protected":false},"author":2,"featured_media":7080,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","_sitemap_exclude":false,"_sitemap_priority":"","_sitemap_frequency":"","footnotes":""},"categories":[17],"tags":[23,24],"class_list":{"0":"post-2038","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-labs","8":"tag-coin-miner","9":"tag-trojan"},"featured_image_src":"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/Coin-Miner-Investigation.jpg","author_info":{"display_name":"Vladislav Baglay","author_link":"https:\/\/gridinsoft.com\/blogs\/author\/baglay\/"},"_links":{"self":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/2038","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/comments?post=2038"}],"version-history":[{"count":6,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/2038\/revisions"}],"predecessor-version":[{"id":9106,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/2038\/revisions\/9106"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/media\/7080"}],"wp:attachment":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/media?parent=2038"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/categories?post=2038"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/tags?post=2038"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"Most](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/1.png\" "\\"\\"")
![\"CoinMiner](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/2-1-1024x331.png\" "\\"\\"")
![\"System](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/3-1024x452.png\" "\\"\\"")
![\"SecUpdateHost.exe](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/4-1024x588.png\" "\\"\\"")
![\"spoolsv.exe](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/5-1024x716.png\" "\\"\\"")
![\"Microsoft](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/6-1024x246.png\" "\\"\\"")
![\"Suspicious](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/7.png\" "\\"\\"")
![\"Official](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/8-1024x804.png\" "\\"\\"")
![\"Oops!](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/29-1024x804.png\" "\\"\\"")
![\"Setup](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/9.png\" "\\"\\"")
![\"Firewall](\"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2018\/02\/10-1024x332.png\" "\\"\\"")