Malware (XMRig, OrcusRAT, etc.) disguised as MS Office crack
Essential information
- Published
- 10/05/2024 13:45
- Modified
- 10/05/2024 14:25
- Tags
- 2024-05-05 2024-05-06 2024-05-07 2024-05-08 2024-05-09 2024-05-10 3proxy antiav cryptominer obfuscation orcusrat persistence purecrypter rat xmrig
- Related entities
- 12 observables, 9 techniques (mitre), 3 malware
Description
The report details an ongoing malware campaign targeting South Korean users, which disguises malicious payloads as cracked versions of Microsoft Office and other popular software. The attackers are distributing a variety of malware, including downloaders, coin miners, remote access tools (RATs), proxies, and anti-antivirus components. These are installed persistently through scheduled tasks and utilise encoded PowerShell commands for updates. The primary malware families identified include Orcus RAT for system control, XMRig cryptominer, 3Proxy for creating a proxy network, and components to evade security products.