89 points by crypto_sleuthhound 1 year ago flag hide 18 comments
crypt0anal1st 1 year ago next
Fascinating deep dive into the world of Bitcoin mining malware. Great job!
securitygeek 1 year ago next
Indeed, it's alarming to see how sophisticated these malware variants have become. Kudos to the researchers for highlighting this concerning trend.
crypt0anal1st 1 year ago prev next
@b1tc0inmin3r: Yes, there have been reports of at least two of these malware families found in the wild, infecting unsuspecting users.
b1tc0inmin3r 1 year ago prev next
Have any of these malware families been found in the wild yet? Or are they just theoretical explanations?
redteamleader 1 year ago prev next
What kind of hardware and software requirements are needed for analyzing these malware samples?
crypt0anal1st 1 year ago next
@redteamleader: Standard systems with virtualization capabilities, 4-8GB of RAM, and sandboxing solutions like Cuckoo should suffice.
whiteh4tguy 1 year ago prev next
Do you recommend any specific antivirus or EDR solutions for detecting and preventing these infections?
crypt0anal1st 1 year ago next
@whiteh4tguy: I've had positive experiences with free solutions like ClamAV and good luck in your endeavors. Additionally, EDRs like CrowdStrike and Carbon Black are quite effective.
cyb3rsleuth 1 year ago prev next
Have any of the analyzed malware families targeted other crypto networks, or is it strictly Bitcoin-specific?
crypt0anal1st 1 year ago next
@cyb3rsleuth: Surprisingly, all of these families have remained Bitcoin-specific so far. Other crypto networks may face similar threats soon, though.
osintn00b 1 year ago prev next
It's interesting to see so many variants of coin miners employing multi-stage loading for evasion. What are general trends in evasion techniques, and which evasion techs have you seen most frequently?
crypt0anal1st 1 year ago next
@OSintN00B: The most frequent evasion techniques found in our analysis include anti-virtualization checks, anti-sandboxing, and anti-debugging techniques. We also noticed that some coin miners incorporated self-deletion capabilities.
thr33hun73r 1 year ago prev next
Are there any open-source tools or standard frameworks you've used during malware analysis? Would you mind listing some just for reference purposes?
crypt0anal1st 1 year ago next
@Thr33Hun73r: Definitely! Popular open-source tools include Cuckoo Sandbox, Volatility, and Radare2 for dynamic and memory analysis. For static analysis, IDA Pro and Ghidra stand out.
backd00rninj4 1 year ago prev next
I can't help but notice the lack of Linux-based malware variants mentioned in the analysis. Have any notable ones popped up during your research, and if so, do they share the same evasion techniques as their Windows counterparts?
crypt0anal1st 1 year ago next
@Backd00rNinj4: Linux-based malware is still relatively uncommon, but it's definitely growing. We observed a small number of samples, and they did share some common evasion techniques like anti-virtualization. Nonetheless, Windows-based crypto mining malware remains more prevalent.
malwareexplor3r 1 year ago prev next
Great research. I think it might be interesting to explore implementations of machine learning and AI algorithms to combat such emerging threats.
crypt0anal1st 1 year ago next
@MalwareExplor3r: Absolutely! Machine learning and AI can significantly improve detection and response capabilities. We'll surely consider it for future research!