{"id":5568,"date":"2018-03-12T02:57:53","date_gmt":"2018-03-12T02:57:53","guid":{"rendered":"https:\/\/www.legitgambling.com\/news\/?p=5568"},"modified":"2018-03-12T02:57:53","modified_gmt":"2018-03-12T02:57:53","slug":"identify-computer-affected-trojan-mining-electroneum-etn","status":"publish","type":"post","link":"https:\/\/www.legitgambling.com\/news\/identify-computer-affected-trojan-mining-electroneum-etn\/","title":{"rendered":"How to Identify A Computer Affected With Trojan Mining Electroneum?"},"content":{"rendered":"

\"\"Microsoft has announced that it has successfully defended a massive attempt <\/a>to deploy a sophisticated trojan program aimed at mining Electroneum (ETN)<\/a> without the known of user. Until now, most of the trojans were used to mine Monero (XMR).<\/p>\n

Microsoft stated that Windows 10, Windows 8.1, and Windows 7 users running Windows Defender AV or Microsoft Security Essentials are all protected from this latest outbreak.<\/p>\n

How does the trojan work?<\/h2>\n

The trojan uses advanced cross-process injection techniques, persistence mechanisms, and evasion methods to install itself on the victim\u2019s computer. These trojans are new variants of Dofoil (also known as Smoke Loader) and carry a Electroneum coin miner program. Dofoil is the latest malware family to incorporate coin miners in attacks. Scammers are adding coin mining scripts in tech support scam websites.<\/p>\n

The torjan performs process hollowing on explorer.exe. Process hollowing is a code injection technique that involves spawning a new instance of legitimate process (in this case c:\\windows\\syswow64\\explorer.exe) and then replacing the legitimate code with malware. The hollowed explorer.exe process then spins up a second malicious instance, which drops and runs a coin mining malware masquerading as a legitimate Windows binary, wuauclt.exe. Even though it uses the name of a legitimate Windows binary, it runs from the wrong location. The command line is anomalous compared to the legitimate binary. Additionally, the network traffic from this binary will be suspicious. Dofoil uses a customized mining application. Based on its code, the coin miner supports NiceHash, which means it can mine different cryptocurrencies. The samples analyzed by Microsoft indicated that the program mined Electroneum coins.<\/p>\n

To stay hidden, Dofoil modifies the registry. The hollowed explorer.exe process creates a copy of the original malware in the Roaming AppData folder and renames it to ditereah.exe. It then creates a registry key or modifies an existing one to point to the newly created malware copy. In the sample Microsoft analyzed, the malware modified the OneDrive Run key.<\/p>\n

How Microsoft crushed the attack?<\/h2>\n

Just before noon on March 6 (PST), Windows Defender Antivirus blocked more than 80,000 instances of several sophisticated trojans that exhibited advanced cross-process injection techniques, persistence mechanisms, and evasion methods. Behavior-based signals coupled with cloud-powered machine learning models uncovered this new wave of infection attempts. Within the next 12 hours, more than 400,000 instances were recorded, 73% of which were in Russia. Turkey accounted for 18% and Ukraine 4% of the global encounters.
\nWindows Defender AV initially flagged the attack\u2019s unusual persistence mechanism through behavior monitoring, which immediately sent this behavior-based signal to Microsoft\u2019s cloud protection service.
\n1. Within milliseconds, multiple metadata-based machine learning models in the cloud started blocking these threats at first sight.
\n2. Seconds later, Microsoft\u2019s sample-based and detonation-based machine learning models also verified the malicious classification. Within minutes, detonation-based models chimed in and added additional confirmation.
\n3. Within minutes, an anomaly detection alert notified us about a new potential outbreak.<\/p>\n

Identifying computer affected by Trojan mining Electroneum<\/h2>\n

After analysis, Microsoft\u2019s response team updated the classification name of this new surge of threats to the proper malware families. People affected by these infection attempts early in the campaign would have blocks under machine learning names like Fuery, Fuerboos, Cloxer, or Azden. Later blocks show as the proper family names, Dofoil or Coinminer.<\/strong><\/p>\n

With the rise in valuation of cryptocurrencies, cybercriminal groups are launching more and more attacks to infiltrate networks and quietly mine for coins. Malware operators see the opportunity to include coin mining components in their attacks. Therefore, exploit kits are now delivering coin miners instead of ransomware.<\/p>\n

Windows Defender Advanced Threat Protection (Windows Defender ATP) flags malicious behaviors related to installation, code injection, persistence mechanisms, and coin mining activities.<\/p>\n

Windows 10 S, a special configuration of Windows 10, helps protect against coin miners and other threats. Windows 10 S works exclusively with apps from the Microsoft Store and uses Microsoft Edge as the default browser, providing Microsoft verified security.<\/p>\n","protected":false},"excerpt":{"rendered":"

Microsoft has announced that it has successfully defended a massive attempt to deploy a sophisticated trojan program aimed at mining Electroneum (ETN) without the known of user. Until now, most of the trojans were used to mine Monero (XMR). Microsoft stated that Windows 10, Windows 8.1, and Windows 7 users running Windows Defender AV or […]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[68],"tags":[],"class_list":["post-5568","post","type-post","status-publish","format-standard","hentry","category-cryptocurrency"],"yoast_head":"\nHow to Identify A Computer Affected With Trojan Mining Electroneum?<\/title>\n<meta name=\"description\" content=\"Microsoft has announced that it has successfully defended a massive attempt to deploy a sophisticated trojan program aimed at mining Electroneum (ETN) without the known of user. Until now, most of the trojans were used to mine Monero (XMR).\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.legitgambling.com\/news\/identify-computer-affected-trojan-mining-electroneum-etn\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Identify A Computer Affected With Trojan Mining Electroneum?\" \/>\n<meta property=\"og:description\" content=\"Microsoft has announced that it has successfully defended a massive attempt to deploy a sophisticated trojan program aimed at mining Electroneum (ETN) without the known of user. Until now, most of the trojans were used to mine Monero (XMR).\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.legitgambling.com\/news\/identify-computer-affected-trojan-mining-electroneum-etn\/\" \/>\n<meta property=\"article:published_time\" content=\"2018-03-12T02:57:53+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.legitgambling.com\/news\/wp-content\/uploads\/2018\/02\/electroneum.jpg\" \/>\n<meta name=\"author\" content=\"Cameron Bishop\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Cameron Bishop\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/identify-computer-affected-trojan-mining-electroneum-etn\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/identify-computer-affected-trojan-mining-electroneum-etn\\\/\"},\"author\":{\"name\":\"Cameron Bishop\",\"@id\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/#\\\/schema\\\/person\\\/0e2e077765174748afc2362c890e3f91\"},\"headline\":\"How to Identify A Computer Affected With Trojan Mining Electroneum?\",\"datePublished\":\"2018-03-12T02:57:53+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/identify-computer-affected-trojan-mining-electroneum-etn\\\/\"},\"wordCount\":659,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/identify-computer-affected-trojan-mining-electroneum-etn\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/wp-content\\\/uploads\\\/2018\\\/02\\\/electroneum.jpg\",\"articleSection\":[\"Cryptocurrency\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/identify-computer-affected-trojan-mining-electroneum-etn\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/identify-computer-affected-trojan-mining-electroneum-etn\\\/\",\"url\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/identify-computer-affected-trojan-mining-electroneum-etn\\\/\",\"name\":\"How to Identify A Computer Affected With Trojan Mining Electroneum?\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/identify-computer-affected-trojan-mining-electroneum-etn\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/identify-computer-affected-trojan-mining-electroneum-etn\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/wp-content\\\/uploads\\\/2018\\\/02\\\/electroneum.jpg\",\"datePublished\":\"2018-03-12T02:57:53+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/#\\\/schema\\\/person\\\/0e2e077765174748afc2362c890e3f91\"},\"description\":\"Microsoft has announced that it has successfully defended a massive attempt to deploy a sophisticated trojan program aimed at mining Electroneum (ETN) without the known of user. Until now, most of the trojans were used to mine Monero (XMR).\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/identify-computer-affected-trojan-mining-electroneum-etn\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/identify-computer-affected-trojan-mining-electroneum-etn\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/wp-content\\\/uploads\\\/2018\\\/02\\\/electroneum.jpg\",\"contentUrl\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/wp-content\\\/uploads\\\/2018\\\/02\\\/electroneum.jpg\",\"width\":380,\"height\":250},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/\",\"name\":\"\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/#\\\/schema\\\/person\\\/0e2e077765174748afc2362c890e3f91\",\"name\":\"Cameron Bishop\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f635e871248df28d6828ec38af2b48c04796e65e714639cfa0c2d3d1c91b0bc7?s=96&d=monsterid&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f635e871248df28d6828ec38af2b48c04796e65e714639cfa0c2d3d1c91b0bc7?s=96&d=monsterid&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f635e871248df28d6828ec38af2b48c04796e65e714639cfa0c2d3d1c91b0bc7?s=96&d=monsterid&r=g\",\"caption\":\"Cameron Bishop\"},\"description\":\"Cameron works tirelessly behind the scenes ensuring his many US news stories are factual, informative and brought to you in a timely fashion before most other media outlets have them. He is an investigative journalist at heart who also has a fond interest in the money and business markets too.\",\"url\":\"https:\\\/\\\/www.legitgambling.com\\\/news\\\/author\\\/cameron-bishop\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Identify A Computer Affected With Trojan Mining Electroneum?","description":"Microsoft has announced that it has successfully defended a massive attempt to deploy a sophisticated trojan program aimed at mining Electroneum (ETN) without the known of user. Until now, most of the trojans were used to mine Monero (XMR).","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.legitgambling.com\/news\/identify-computer-affected-trojan-mining-electroneum-etn\/","og_locale":"en_US","og_type":"article","og_title":"How to Identify A Computer Affected With Trojan Mining Electroneum?","og_description":"Microsoft has announced that it has successfully defended a massive attempt to deploy a sophisticated trojan program aimed at mining Electroneum (ETN) without the known of user. Until now, most of the trojans were used to mine Monero (XMR).","og_url":"https:\/\/www.legitgambling.com\/news\/identify-computer-affected-trojan-mining-electroneum-etn\/","article_published_time":"2018-03-12T02:57:53+00:00","og_image":[{"url":"https:\/\/www.legitgambling.com\/news\/wp-content\/uploads\/2018\/02\/electroneum.jpg","type":"","width":"","height":""}],"author":"Cameron Bishop","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Cameron Bishop","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.legitgambling.com\/news\/identify-computer-affected-trojan-mining-electroneum-etn\/#article","isPartOf":{"@id":"https:\/\/www.legitgambling.com\/news\/identify-computer-affected-trojan-mining-electroneum-etn\/"},"author":{"name":"Cameron Bishop","@id":"https:\/\/www.legitgambling.com\/news\/#\/schema\/person\/0e2e077765174748afc2362c890e3f91"},"headline":"How to Identify A Computer Affected With Trojan Mining Electroneum?","datePublished":"2018-03-12T02:57:53+00:00","mainEntityOfPage":{"@id":"https:\/\/www.legitgambling.com\/news\/identify-computer-affected-trojan-mining-electroneum-etn\/"},"wordCount":659,"commentCount":0,"image":{"@id":"https:\/\/www.legitgambling.com\/news\/identify-computer-affected-trojan-mining-electroneum-etn\/#primaryimage"},"thumbnailUrl":"https:\/\/www.legitgambling.com\/news\/wp-content\/uploads\/2018\/02\/electroneum.jpg","articleSection":["Cryptocurrency"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.legitgambling.com\/news\/identify-computer-affected-trojan-mining-electroneum-etn\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.legitgambling.com\/news\/identify-computer-affected-trojan-mining-electroneum-etn\/","url":"https:\/\/www.legitgambling.com\/news\/identify-computer-affected-trojan-mining-electroneum-etn\/","name":"How to Identify A Computer Affected With Trojan Mining Electroneum?","isPartOf":{"@id":"https:\/\/www.legitgambling.com\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.legitgambling.com\/news\/identify-computer-affected-trojan-mining-electroneum-etn\/#primaryimage"},"image":{"@id":"https:\/\/www.legitgambling.com\/news\/identify-computer-affected-trojan-mining-electroneum-etn\/#primaryimage"},"thumbnailUrl":"https:\/\/www.legitgambling.com\/news\/wp-content\/uploads\/2018\/02\/electroneum.jpg","datePublished":"2018-03-12T02:57:53+00:00","author":{"@id":"https:\/\/www.legitgambling.com\/news\/#\/schema\/person\/0e2e077765174748afc2362c890e3f91"},"description":"Microsoft has announced that it has successfully defended a massive attempt to deploy a sophisticated trojan program aimed at mining Electroneum (ETN) without the known of user. Until now, most of the trojans were used to mine Monero (XMR).","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.legitgambling.com\/news\/identify-computer-affected-trojan-mining-electroneum-etn\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.legitgambling.com\/news\/identify-computer-affected-trojan-mining-electroneum-etn\/#primaryimage","url":"https:\/\/www.legitgambling.com\/news\/wp-content\/uploads\/2018\/02\/electroneum.jpg","contentUrl":"https:\/\/www.legitgambling.com\/news\/wp-content\/uploads\/2018\/02\/electroneum.jpg","width":380,"height":250},{"@type":"WebSite","@id":"https:\/\/www.legitgambling.com\/news\/#website","url":"https:\/\/www.legitgambling.com\/news\/","name":"","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.legitgambling.com\/news\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.legitgambling.com\/news\/#\/schema\/person\/0e2e077765174748afc2362c890e3f91","name":"Cameron Bishop","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f635e871248df28d6828ec38af2b48c04796e65e714639cfa0c2d3d1c91b0bc7?s=96&d=monsterid&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f635e871248df28d6828ec38af2b48c04796e65e714639cfa0c2d3d1c91b0bc7?s=96&d=monsterid&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f635e871248df28d6828ec38af2b48c04796e65e714639cfa0c2d3d1c91b0bc7?s=96&d=monsterid&r=g","caption":"Cameron Bishop"},"description":"Cameron works tirelessly behind the scenes ensuring his many US news stories are factual, informative and brought to you in a timely fashion before most other media outlets have them. He is an investigative journalist at heart who also has a fond interest in the money and business markets too.","url":"https:\/\/www.legitgambling.com\/news\/author\/cameron-bishop\/"}]}},"_links":{"self":[{"href":"https:\/\/www.legitgambling.com\/news\/wp-json\/wp\/v2\/posts\/5568","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.legitgambling.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.legitgambling.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.legitgambling.com\/news\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.legitgambling.com\/news\/wp-json\/wp\/v2\/comments?post=5568"}],"version-history":[{"count":0,"href":"https:\/\/www.legitgambling.com\/news\/wp-json\/wp\/v2\/posts\/5568\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.legitgambling.com\/news\/wp-json\/wp\/v2\/media?parent=5568"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.legitgambling.com\/news\/wp-json\/wp\/v2\/categories?post=5568"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.legitgambling.com\/news\/wp-json\/wp\/v2\/tags?post=5568"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}