TIAOODAM Cryptocurrency Miner

A new cryptocurrency miner, known as TIAOODAM, has been observed using multiple evasion techniques, including being delivered through a Windows Installer (MSI) package and the WiX packer, as part of its infection process.

Threat ID:: CC-2779
Category:: Cryptocurrency
Threat Severity:: Low
Threat Vector:: Download
Published:: 13 November 2018 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

Microsoft Windows - All versions

Threat details

At the time of publication, it is unclear how the malware is being distributed, however it may be through fake software downloads. When launched, the MSI file can bypass security features by posing as a legitimate installer that initially runs a script to copy files into a local user directory. The files include a ZIP file cloaked as a decoy icon file, icon.ico, that is unpacked to install extra modules for cryptocurrency mining and obfuscation. It will also attempt to create copies of system kernel files in order to prevent detection of the malware’s APIs.

It will inject its malicious code into three newly spawned svchost.exe processes. The first two are used for persistence to re-download the Windows Installer with a PowerShell command if any of the injected processes are terminated. The third process is used for the miner module. The malware is also equipped with a self-wiping mechanism which deletes every file under its installation directory and will remove any trace of its presence on the system.

Remediation advice

To prevent and detect an infection, ensure that:

Remediation steps

Type	Step
	A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails. All operating systems, anti-virus and other security products are kept up-to-date. Regular anti-virus and security scans are performed on your organisation’s estate. All day-to-day computer activities such as email and internet are performed using non-administrative accounts. Strong password policies are in place. Network, proxy and firewall logs should be monitored for suspicious activity. User accounts accessed from affected devices should be reset on a clean computer. Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the 10 Steps to Cyber Security.

Type

Step

A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails.
All operating systems, anti-virus and other security products are kept up-to-date.
Regular anti-virus and security scans are performed on your organisation’s estate.
All day-to-day computer activities such as email and internet are performed using non-administrative accounts.
Strong password policies are in place.
Network, proxy and firewall logs should be monitored for suspicious activity.
User accounts accessed from affected devices should be reset on a clean computer.
Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the 10 Steps to Cyber Security.

Last edited: 17 February 2020 12:55 pm