{
  "timestamp": "2025-02-05T22:46:30.346288",
  "model": "deepseek/deepseek-r1-distill-llama-70b",
  "request": {
    "messages": [
      {
        "role": "system",
        "content": "You are a cybersecurity expert specializing in company websites and product documentation.\n        Analyze the content and classify it into the given categories.\n        Return only the applicable categories as a comma-separated list, nothing else."
      },
      {
        "role": "user",
        "content": "\n        Categories to choose from:\n        product_security_features, end_user_security, compliance_certifications, security_best_practices, data_protection, access_management, threat_prevention, incident_response, privacy_policy, technical_documentation\n        \n        Content to classify:\n        Search Free Trial Get Demo Its Back! Facebook Cryptominer Worm Reemerges May 20, 2019 Digmine Campaign Redux Back in 2017, we wrote a blog about a malware spreading on Facebook, which, it turns out, continues to be relevant todayreferring to both the blog and the malware. At the time we had set ourselves the task of analyzing part of the 2017 Digmine campaign that installed a cryptominer payload, and lo and behold! just last month this campaign re-emerged on Facebook with a new variant that also uses the files section of Facebook groups, and on the face of it employs tactics similar to those used two years ago. We decided to monitor a sample and do a breakdown in order to discover if there is any new behavior we might alert you to. Figure 1  Screenshot of new Digmine malware variant, which masquerades as a video in a Facebook groups files The earliest sample from this new campaign we came across video_47368.bz  6fc606d08ffd45da89a52d873f489274b3ced6502998f2b2a608ae2cb34e9a0b Cyren detects as W32AutoIt.IM.gen!Eldorado, and was uploaded on April 20. It was very similar to the second variant we studied in 2017, with we have discovered a few added checks done before downloading the payload. The specific step-by-step of this new variant is Checks if its PID is not equal to AutoItPID Pings google.com in intervals of 500 secs until it sucessfully gets ping response Checks if the filename of the executed malware contains the following strings updater video play app Checks its active window title to see if it has the following strings Start cmd.exe Program Manager ChecksCreates registry entry HKCUSoftwareUnzip , Installed , Yes as part of its installation routine Sends out system information to its CC server hxxpsusu.icuapplogin.php User-Agent  Unzip Active window title File name of executed malware OS version CPU Architecture Installation status Creates directory APPDATAUSERNAME Downloads the following Via unzip response header 7za.exe  legitimate 7z standalone executable Via zip response header files.7z  password protected 7z archive containing malware components Chrome extension component manifest.json background.js  detected by Cyren as JSKromAgent.B!Eldorado Crypto miner component update-x86.exe  detected by Cyren as W32CoinMiner.AR!Eldorado update-x64.exe  detected by Cyren as W64CoinMiner.AR!Eldorado config.json Extracts malware components using downloaded 7za.exe with password hardcoded in the AutoIt executable Copies itself to APPDATAUSERNAMEapp.exe Finds active Chrome windows and closes them Forcefully terminates chrome processes Performs registry modifications HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations, LowRiskFileTypes  .exe HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations, LowRiskFileTypes  .exe Installs auto-start registry entry RegWriteHKCUSoftwareMicrosoftWindowsCurrentVersionRun, Google Updater, REG_SZ, APPDATAUSERNAMEapp.exe Executes chrome.exe with the following arguments to load its own chrome extension from the downloaded 7z archive ShellExecutechrome.exe, enable-automation disable-infobars load-extensionAPPDATAUSERNAME, , SW_MAXIMIZE Searches for Chrome applications shortcuts and updates them to include the above chrome parameters Executes the extracted update-x86.exeupdate-x64.exe depending on the machines architecture, which is a crypto miner application Changes in the new campaign Reviewing some of the uploaded samples, aside from changing the CC server it connects to, some minor changes were made to the initial downloader. Some of the CC it is using during this new campaign are hxxpfusu.icuapplogin.php hxxpsusu.icuapplogin.php hxxpkeke.icuapplogin.php hxxpqoqo.icuapplogin.php hxxpluru.icuapplogin.php hxxpgaga.icuapplogin.php hxxpnini.icuapplogin.php We also note that a new registry check was added HKCUSoftwareUnzip , Trust , yesno They also created some minor changes in the obfuscation of the AutoIt script. StringLen,StringMid and StringInStr functions were not obfuscated in the variant in 2017. These functions were used to deobfuscate the script used in the Execute function. In this new update, the developers have hidden these strings and added more arrays for obfuscation. The 2017 script and the 2019 script are shown below for comparison. Earlier script Updated script Campaigns temporary end? A second variant of this new campaign video_23150.bz  d09c1ec8f75d13b08d50d23002b3e69229d21678866eb0a11062d7504c016337, which is detected by Cyren as W32Dropper.DE.gen!Eldorado, connects to hxxpwhizzup.icu and now uses AHK_Request as the User-Agent. This second variant is no longer a compiled Autoit executable, but now a compiled AutoHotKey executable. It writesmodifies the following registry keys HKCUSoftwareMicrosoftWindowsCurrentVersionRunExtension_Service CUsersActive UserAppDataRoamingServiceApp.exe -b HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem EnableLUA, 0 HKLMSYSTEMControlSet001servicesgupdate Start,4 HKLMControlSet001servicesgupdatem Start,4 HKLMSYSTEMControlSet001servicesGoogleChromeElevationService Start,4 HKLMSOFTWAREPoliciesMicrosoftWindows Defender DisableAntiSpyware,1 Drop files in the APPDATA folder ServiceApp.exe  detected by Cyren as W32Dropper.DE.gen!Eldorado, malware copy pZip.dll  non-malicious component Downloads ServiceApp.zip, which contains the following Manifest.json Background.js  detected by Cyren as JSKromAgent.C!Eldorado, a chrome extension which downloads a file in hxxpwhizzup.icubibgohlo The bibgohlo is a script used to propagate malware through Facebook, which Cyren detects as JSKromAgent.C. Here is an image of the code it uses to upload Additional CC for this variant hxxpnameking.icu hxxpncdn.space Behavior Overview Weve included a map below of the behavior described above that you can click on to expand and view Want to learn more about cloud-based email security and archiving ? Contact us here ! Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Phishing Targeting Real Estate Firms A view from the exhibition floor three takeaways from Infosecurity Europe Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443\n        "
      }
    ],
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  },
  "response": {
    "content": "threat_prevention, technical_documentation",
    "usage": {
      "prompt_tokens": 1501,
      "completion_tokens": 500,
      "total_tokens": 2001
    },
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  }
}