This virus hides for a month in your PC and then starts mining cryptocurrencies

Malware of all kinds is always trying to enter our systems and infect them. For instance, a brand-new malware was recently identified that installs itself on computers under the pretext of Google Translate or other Mp3 music downloaders in order to mine cryptocurrency from afflicted PCs.

The digital world contains both positive and negative aspects. One of them is the variety of bogus apps that are disseminated through various trustworthy freeware stores up until the point at which they become aware that they conceal malware and are taken down. We should always use extreme caution when deciding what to really install on our PCs because of this.

The program that hides malware

Check Point Research recently made the discovery of this specific virus. They have outlined the precise behavior of this specific infection in their research. In essence, their report claims that a programmer by the name of “Nitrokod” created the virus. At first sight, the software it downloads on the computer appears to be devoid of infection and allows us to use the feature it promised.

However, a month after the program is set up on the computer, the issue first manifests itself. mostly because the software purposefully postpones the installation of the several malware components until a month later in order to escape detection by the different antivirus products that consumers may use. The infection was able to mine cryptocurrency at that time without the victim being aware of it.

Since 2019, it has claimed almost 111,000 lives in the following 11 nations: the UK, the US, Sri Lanka, Greece, Israel, Germany, Turkey, Cyprus, Australia, Mongolia, and Poland. Additionally, this kind of virus has managed to infiltrate well-known websites like Softpedia and Uptodown. Yandex Translate, Microsoft Translate, YouTube Music, MP3 Download Manager, and Pc Auto Shutdown were among the services that were utilized to deceive customers but do not have a desktop PC application.

How does this virus work?

Regardless of the software that was downloaded (with this developer’s signature), the user who wished to install it got a password-protected.rar file with an executable that had the application’s name in it. Once it was run on the computer, a four-stage countdown would start in which the essential components would be installed so that the virus could be fully deployed.

On the fifth day of the infection after execution, the malware activated a dropper from another encrypted.rar file downloaded using Wget. After the virus had finished its work, a connection was made to a remote command and control (C2) server, from which a configuration file was acquired to begin cryptocurrency mining on the compromised PC.

As a result, downloading other software that the original developer has not officially released, as was the case with Google Translator, is the only method to protect ourselves from this form of infection. By doing this, we can keep ourselves out of the clutches of these developers.