From prodefence.org
A miner malware that uses a number of techniques that includes EternalBlue, Powershell abuse, pass-the-hash technique, Windows admin tools, and brute force to infect windows machine and to drop a Monero miner.
According to Trend Micro telemetry, the threat actors behind the campaign expands botnet to other countries that include Australia, Taiwan, Vietnam, Hong Kong, and India.
Miner Malware Propagation
The primary malware propagation involves using the weak credentials to gain access to the computer that connected with the same network. It uses a firewall and port forwarding settings to schedule a task and to execute the malware.
Next one uses passes the hash method, in which the malware acquires the passwords hashed in the system by using Get-PassHashes command. Once it acquires the hashes it uses malware utilizes Invoke-SMBClient to share the file.
“Once a machine is infected via one of the methods, the malware acquires the MAC address and collects information on the anti-virus products installed in the machine. It downloads another obfuscated PowerShell script from the C&C server,” reads TrendMicro report.