ESET LoudMiner June 2019

LoudMiner used a script to gather the IP address of the infected machine before sending to the C2.

LoudMiner has obfuscated various scripts.

LoudMiner has encrypted DMG files.

LoudMiner used the ps command to monitor the running processes on the system.

LoudMiner used a batch script to run the Linux virtual machine as a service.

LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.

LoudMiner deleted installation files after completion.

LoudMiner has monitored CPU usage.

LoudMiner used SCP to update the miner from the C2.

LoudMiner is typically bundled with pirated copies of Virtual Studio Technology (VST) for Windows and macOS.

LoudMiner used an MSI installer to install the virtualization software.

LoudMiner harvested system resources to mine cryptocurrency, using XMRig to mine Monero.

LoudMiner can automatically launch a Linux virtual machine as a service at startup if the AutoStart option is enabled in the VBoxVmService configuration file.

LoudMiner adds plist files with the naming format com.[random_name].plist in the /Library/LaunchDaemons folder with the RunAtLoad and KeepAlive keys set to true.

LoudMiner has set the attributes of the VirtualBox directory and VBoxVmService parent directory to "hidden".

LoudMiner has used QEMU and VirtualBox to run a Tiny Core Linux virtual machine, which runs XMRig and makes connections to the C2 server for updates.

LoudMiner launched the QEMU services in the /Library/LaunchDaemons/ folder using launchctl. It also uses launchctl to unload all Launch Daemons when updating to a newer version of LoudMiner.

LoudMiner started the cryptomining virtual machine as a service on the infected machine.