The latest bitcoin rally has not only bring the crypto market come to life but also hackers. Tencent Security reported on April 23 that the Blouiroet mining Trojan has been detected active in many countries, among which Russia, Ukraine and China are the hardest hit.

Blouiroet is a trojan with the ability to establish remote access connections, keylog, collect system information, download/upload files, and drop further malware on the infected system

The security firm monitored Blouiroet was scripted in Delphi. When Blouiroet runs, it will firstly end all other mining Trojan processes and monopolize the system resources to run Monero mining. It was also detected that the hacker group behind Blouiroet has updated infrastructures such as IP and domain names, even set up multiple mining pools themselves.

Blouiroet-controlled zombie computers are distributed in many countries, with Russia and Ukraine seriously affected. Some computer systems in China also fell its victims.

Tencent Security suggests one should shut down unnecessary ports like 445, 135, 139, etc, but only allow whitelist IPs to connect and log in, make sure that systems are patched or updated with the latest software and keep alert if abnormal increase in system resource consumption is found.

For those whose computers have been compromised, it is suggested to

delete following files,

C:/Users/Public/nw.exe
C:/Windows/SysWOW64/svchosts.exe
C:/Windows/SysWOW64/AutoCloseExe.txt
C:/Windows/SysWOW64/parameters.ini
C:/Windows/SysWOW64/blockpro.txt
C:/Windows/SysWOW64/updater.txt
C:/Windows/SysWOW64/desinf.bat
C:/Windows/SysWOW64/update.bat
C:/Windows/SysWOW64/processlist.txt
C:/Windows/SysWOW64/restart.bat
C: /Program Files/Common Files/System/mainer.zip
C: /Program Files/Common Files/System/iexplorer.exe
C: /ProgramData/lsass2.exe

delete registry service

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AudioServer

IOCs

IP

62.76.74.245
62.76.74.170
151.106.2.140

URLs
hxxp://hs-fileserver.info/token.key
hxxp://hs-fileserver.info/
hxxp://hs-fileserver.info/HS_Svc.exe
hxxp://hashserver1.tmweb.ru/pocket/HS_Svc.exe
hxxp://vivacomandante.ml/nw.exe
hxxp://vivacomandante.ml/rundll.sfx.exe
hxxp://vivacomandante.ml/bin.sfx.exe
hxxp://vivacomandante.ml/a.rar
hxxp://vivacomandante.ml/c.rar
hxxp://atskiysatana.tk/xmrig64.zip
hxxp://atskiysatana.tk/xmrig32.zip
hxxp://atskiysatana.tk/a.rar
hxxp://atskiysatana.tk/x64.exe
hxxp://atskiysatana.tk/c.rar
hxxp://atskiysatana.tk/b.rar

Domain
yomatherfucker.ml
km1.crazyhohol.icu
km2.crazyhohol.icu
km3.crazyhohol.icu
slavaukraini.crazyhohol.icu
schpillivilli.ml
schpillivilli.cf
schpillivilli.gq
schpillivilli.ga
halligalli.ga
halligalli.ml
halligalli.tk
halligalli.cf
halligalli.gq
illbeback.ml
vivacomandante.ml
vivacomandante.cf
vivacomandante.ga
atskiysatana.tk

Mining pools
schpillivilli.gq:3333
halligalli.gq:4444
slavaukraini.crazyhohol.icu:4444

MD5
5ca65d59d5b9c74c0ac95d9f49b52794
310aebd720f478f7ef1620493f415184
e39470ee8949d380c9aa335e954d6523
ee4dc521b15102ae682ce62c3b864557
2fcddbe185878dd586c2885da375deac
6f40a99a6d9f2b39290c4fb664598e99
133a6b7f2720a16a5b2fbadd65b5e65c
d2a96b0e33a63546b156aaff3f4909af
8aa982bac930dbc5f62665a6b161e05e
0f39cf8afabbf9178887267d03ff7455
cb2cb95ca44cf0f63467899b0a84c25f
12fba5ff8c886ec0df9e3caceb4648ea
5682e39e472764b07fc5d0319e50c897
71ea72f6c287003690b06458b4ade1f8
5b9f638f7f1bc2319a1a434aafd8c872
8f24e72f1aad818ac460b2d04bfc9677
3b7699c3282a9188c8ea4abb07e0ae72
a20754e9d236cb04f4136def77c7b9ee
4680bc21194a4c5a9e8624f3595375cf
81b474e80816f2a5cba9219277b9a46d
195679ba0ff6c0c0a043960b955b497a
249b6ea0f0127e74b63597cd931582a9
2ab593cba91da115502e113b15fe4fb9
4005ea79534fa316d8e505df667b6c7b
4acf9b1006a4d2d66cb6e72553e586b4
4d5b43fa547a852cb9ca4d15c1f6f399
4f422c27150a1e00d8787820b69835ba
500c8d8ff2e9bb85a1dc8c00c6082d79
6094ac379e1c5afc845e510cd148fdf6
683711e6d5c8e4bb3c24be5baf433d98
708a6c068948dba1838b28cda9d85e07
7637bbe9f411425bb61012f8239c162d
7a35300280effeda72024087c6681d48
7c74b6674b51ec268d6779e308917a17
8ccd54e55e01492a4f2f0ae08fa3c9f7
92e5a2f072eb904166f59bad0f8102cb
c185300634b530ce54e4b7dd176b4368
ce02eee72dcbf63991d87f26eea88749