{"id":74265,"date":"2017-05-17T15:40:28","date_gmt":"2017-05-17T22:40:28","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=74265"},"modified":"2025-05-27T20:11:26","modified_gmt":"2025-05-28T03:11:26","slug":"adylkuzz-coinminer-spreading-like-wannacry","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/adylkuzz-coinminer-spreading-like-wannacry\/","title":{"rendered":"Adylkuzz CoinMiner Spreading Like WannaCry"},"content":{"rendered":"

The last few days have been very busy for security teams all around the globe due to the nasty ransomware WannaCry, which spread widely using an exploit for a Server Message Block v1 vulnerability (MS17-010) leaked by the ShadowBroker team a few weeks ago. We have reported on this malware in our previous blog<\/a> and in a few others<\/a> by our fellow McAfee researchers.<\/p>\n

Malware Variants<\/h2>\n

Today we learned that another malware family is using the same exploit to spread itself to vulnerable machines. The malware Adylkuzz is a CoinMiner malware, which means that it employs\u2014without user consent\u2014machine resources to mine coins for virtual currencies. This specific variant was used to mine Monero coins<\/a>.<\/p>\n

This CoinMiner is not a new variant. We have seen samples as old as October 2014, but it has increased in usage since April. Online reports mention that this malware have infected machines after a successful exploitation of the MS17-010 vulnerability followed by the installation of the backdoor malware EternalBlue\/DoublePulsar.<\/p>\n

Adylkuzz has not changed much in all these years, as we can see by comparing the code among the different waves. For example, the following graphs represent code differences between the October 2014 variant and the first wave starting in April this year:<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

The number of functions that changed was very small:<\/p>\n