New Cryptominer Malware variant 'GOLANG'

According to the latest Threat Spotlight report by researchers at Cyber Security firm Barracuda Networks “A new variant of the cryptominer malware known as Golang is targeting both Windows and Linux machines. While the volume of attacks is low because the variant is so new, Barracuda researchers have seen seven source IP addresses linked to this malware so far, all based in China. Instead of targeting end users, this new malware attacks servers.” Here's a closer look at this evolving threat and solutions to help detect, block, and remediate the attacks as penned by Erez Turjeman, Senior Software Engineer and a Security Researcher for Barracuda Labs.

- Barracuda Networks

Highlighted Threat

New variant of “Golang” malware: This new malware variant attacks web application frameworks, application servers, and non-HTTP services such as Redis and MSSQL. Its main goal is to mine Monero cryptocurrency using a known miner, XMRig. The malware spreads as a worm, searching and infecting other vulnerable machines.

According to a blog post, “Earlier variants of this malware targeted only Linux machines, but this new iteration is also attacking Windows machines and uses a new pool of exploits. For example, some of the exploits the malware includes are targeting the ThinkPHP web application framework, which is popular in China. Similar to other families of malware, it is safe to assume this malware will keep evolving, employing more and more exploits.”

The Details

Once the malware infects a machine, it downloads the files (see Figure 1), which are customized based upon the platform being attacked. The attacks follow the same playbook, though, including an initial payload, an update script, a miner, a watchdog, a scanner, and a config file for the crypto miner. For Windows machines, the malware also adds a backdoor user.

Init/update scripts