{"id":92720,"date":"2018-11-14T13:15:31","date_gmt":"2018-11-14T21:15:31","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=92720"},"modified":"2025-08-13T00:31:22","modified_gmt":"2025-08-13T07:31:22","slug":"webcobra-cryptojacking-malware","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/webcobra-cryptojacking-malware\/","title":{"rendered":"Preventing WebCobra Malware From Slithering Onto Your System"},"content":{"rendered":"

Cryptocurrency mining is the way transactions are verified and added to the public ledger, a database of all the transactions made around a particular piece of cryptocurrency. Cryptocurrency miners compile all of these transactions into blocks and try to solve complicated mathematical problems to compete with other miners for bitcoins. To do this, miners need a ton of computer resources, since successful bitcoin mining requires a large amount of hardware. Unfortunately, these miners can be used for more nefarious purposes if they\u2019re included within malicious software. Enter WebCobra<\/a>, a malware that exploits victims\u2019 computers to help cybercriminals mine for cryptocurrencies, a method also known as cryptojacking<\/a>.<\/p>\n

How does WebCobra malware work, exactly? First, WebCobra uses droppers (Trojans designed to install malware onto a victim\u2019s device) to check the computer\u2019s system. The droppers let the malware know which cryptocurrency miner to launch. Then, it silently slithers onto a victim\u2019s device via rogue PUP (potentially unwanted program) and installs one of two miners: Cryptonight or Claymore\u2019s Zcash. Depending on the miner, it will drain the victim\u2019s device of its computer processor\u2019s resources or install malicious file folders that are difficult to find.<\/p>\n

The most threatening part of WebCobra malware is that it can be very difficult to detect. Often times, the only sign of its presence is decreased computer performance. Plus, when the dropper is scanning the victim\u2019s device, it will also check for security products running on the system. Many security products use APIs, or application programming interfaces, to monitor malware behavior \u2013 and WebCobra is able to overwrite some. This means it can essentially unhook the API and disrupt the system\u2019s communication methods, and therefore remain undetected for a long time.<\/p>\n

Tips to Prevent a WebCobra Attack<\/h2>\n

While cryptocurrency mining can be a harmless hobby, users should be cautious of criminal miners with poor intentions. So, what can you do to prevent WebCobra from slithering onto your system? Check out the following tips:<\/p>\n