Loading malware…
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Digmine is coded in AutoIt, and sent to would-be victims posing as a video file but is actually an AutoIt executable script.
While extensions can only be loaded and hosted from the Chrome Web Store, the attackers bypassed this by launching Chrome (loaded with the malicious extension) via command line.
It will search and launch Chrome then load a malicious browser extension that it retrieves from the C&C server.
Digmine will also perform other routines such as installing a registry autostart mechanism as well as system infection marker.
Digmine will also perform other routines such as installing a registry autostart mechanism as well as system infection marker.
Digmine is coded in AutoIt, and sent to would-be victims posing as a video file but is actually an AutoIt executable script.
Digmine will also perform other routines such as installing a registry autostart mechanism as well as system infection marker.
Digmine will also perform other routines such as installing a registry autostart mechanism as well as system infection marker.
Both the downloader and mining management component use specific HTTP headers to communicate with the C&C server.
Digmine is a downloader that will first connect to the C&C server to read its configuration and download multiple components.
If Chrome is already running, the malware will terminate and relaunch Chrome to ensure the extension is loaded.
A known modus operandi of cryptocurrency-mining botnets, and particularly for Digmine (which mines Monero), is to stay in the victim’s system for as long as possible.
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.