Attention !!! The mining virus is spread via Facebook.

[DronVR]

Mining virus on Facebook.

If you received a video file (packed compressed in zip archive) a messenger sent by someone to your facebook - just don’t click on it.
Researchers at the Trend Micro cybersecurity company warn users of a new cryptocurrency cryptocurrency mining bot that is distributed via the Facebook messenger and targets Google Chrome users on the desktop to take advantage of the cryptocurrency market situation and a surge in prices.

Dubbed Digmine , the Monero cryptocurrency mining bot disguises itself as a non-embedded video file called video_xxxx.zip (as shown in the screenshot below), but actually contains an executable AutoIt script.
After a “click”, the malware infects the victim’s computer and downloads its components and related configuration files from a remote management server (C & C).

Digimine first installs a cryptocurrency miner, for example Miner.exe - a modified version of the open source Monero miner known as XMRig - which silently miners Monero cryptocurrency in stealth mode for hackers using the processor power of infected computers.

In addition to the cryptocurrency miner, the Digimine bot also installs an autorun mechanism and launches Chrome using a malicious extension that allows attackers to access the victim’s profile on Facebook and distribute the same malicious file to friends from the list via the messenger.

Since Chrome extensions can only be installed through the official Chrome Web Store, “attackers circumvented this by running Chrome (loaded with a malicious extension) through the command line.”

“The extension will read its own configuration from the management server. He may give instructions to extend or continue logging into Facebook, or open a fake page on which the video will play, ”Trend Micro researchers said.

“A bait site that plays videos also serves as part of the management server’s structure. This site is pretending to be a video streaming site, but it also contains many configurations of malware components. ”

It is noteworthy that users who open a malicious video file through the Messenger application on their mobile devices are not affected.

Since the miner is controlled through the management server, Digiminer authors can update their malware to add various features overnight.

Digmine was first spotted when it infected users in South Korea, and has since expanded to Vietnam, Azerbaijan, Ukraine, the Philippines, Thailand, and Venezuela. But since Facebook Messenger is used all over the world, there is an increasing chance that the bot will spread all over the world.

When they were notified by the researchers, Facebook reported that it had removed most of the malicious files from the social networking site.

Facebook spamming is pretty common. Therefore, users are advised to be vigilant when clicking on links and files provided through the platform of the social networking site.