Analysis of a Miner-Worm
To thoroughly analyze a compound cryptomining-worm threat, analysts drove AVL Code with a single natural-language instruction, closing the loop from malicious sample to a complete analysis report.
Built with AVL Code + the Landi model
Overview
Facing an 804KB, 32-bit Windows malware sample combining Monero mining with SMB-worm propagation, analysts drove AVL Code with one natural-language instruction to reverse-engineer it in depth: identifying its "worm competition" behavior — using IPSec firewall policy to block ports 135/137/138/139/445 while keeping port 445 open as the attacker's own remote channel — reconstructing its Monero mining-pool communication, multi-component dropping, registry persistence and self-deletion, and building a 6-stage kill chain from initial execution through lateral movement to persistence. It produced a report with a complete IOC list, YARA detection rules, and a three-tier (host/network/network-wide) response plan, classified as High-risk.
Key results
- Fully reverse-engineered the 804KB 32-bit Windows malware, identifying its compound threat combining Monero mining with SMB-worm propagation
- Reconstructed the IPSec firewall-policy "worm competition" behavior — blocking ports 135/137/138/139/445 to shut out competing worms while keeping port 445 open as the attacker's own remote channel
- Extracted a complete IOC list (4 file hashes, 3 C2 addresses, 1 mining-pool domain, 5 file paths) and generated deployment-ready YARA detection rules
- Built a 6-stage kill chain (initial execution → firewall-policy deployment → C2 communication → mining execution → lateral movement → persistence), producing a three-tier host/network/network-wide response plan, classified as High-risk
Technical highlights
Practical value
Helps security operations rapidly identify and respond to compound cryptomining-worm threats, provides end-to-end guidance from detection to remediation, strengthens detection and handling of malware combining mining, worm propagation and firewall evasion, and effectively protects enterprise network resources and compute assets.
Artifacts
Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model