Norman Cryptominer Employs Sophisticated Obfuscation Tactics

[silversurfer]

A never-before-seen cryptomining variant, dubbed “Norman” after one of its executable files, has been spotted in the wild using various techniques to hide and avoid discovery. The levels of obfuscation are notable for their sheer depth, according to an analysis.
 
Varonis uncovered an initial sample after investigating an ongoing malware infection that had spread to nearly every server and workstation at a midsize company. Much of the malware consisted of generic cryptominers, password-harvesting tools and hidden PHP shells – and Norman too at first seemed to be a generic miner hiding itself as “svchost.exe,” the researchers said. But further investigation told a different story.

“Norman is an XMRig-based cryptominer, a high-performance miner for Monero cryptocurrency,” researchers said in an analysis on Wednesday. “Unlike other miner samples we have collected, Norman employs evasion techniques to hide from analysis and avoid discovery.”

Read more here: https://threatpost.com/norman-cryptomini...on/147310/