#DOGECOIN CORE MALWARE SOFTWARE#

If DynDNS () receives a complaint about abuse of the current URL, Ngrok members simply initiate a new transaction, determine the subdomain value, create a new DynDNS account, and use the correct subdomain.Įxperts note that this mechanism is very effective in preventing the seizure of the Doki backend infrastructure, because for this, law enforcement officers would need to take control of the Dogecoin wallet owned by hackers, and this is hardly possible without the appropriate cryptographic key. For example, you get an address of the format 6d77335c4f23DdnsNĮssentially, hackers can change the address of their C&C server from which Doki receives commands by simply executing a transaction from their Dogecoin wallet. As a result, the address of the command and control server is formed by adding to the resulting subdomain.

The first 12 characters of the obtained hexadecimal value will be the subdomain name.The malware requests the API for the amount that was sent (spent) from a hard-coded wallet, which is under the control of attackers.Typically, other malware refers to specific IP addresses or hard-coded URLs for this, but Doki uses the domain generation algorithm (DGA) and the Dogecoin cryptocurrency API to determine the address of its C&C server. The point is that the malware detects the URL of its C&C server in a very interesting way”, – note Intezer Labs note experts. However, from a technical point of view, Doki is very different from other similar backdoors. It syncs by downloading it, providing a solid-working Dogecoin wallet.

For example, attackers abuse the Docker API to deploy new servers in the victim company’s cloud infrastructure, and then these servers running Alpine Linux become infected with mining malware and Doki.īased on the samples uploaded to VirusTotal, Doki has been present since January 2020, but the malware still goes unnoticed by most of the scanners featured on VirusTotal.ĭoki’s primary mission is simple, so that hackers can seamlessly control their Alpine Linux servers and monitor mining operations. Dogecoin Core, on the other hand, is a 'full' wallet.

#DOGECOIN CORE MALWARE SOFTWARE#

It targets Docker configuration via ports and allows criminals to run their software undisturbed. Intezer Labs researchers say that the latest Ngrok campaign targets poorly secured Docker installations where the API is publicly available. The malware, nicknamed Doki, is not detected by any of the more than 60+ malware tracking engines, despite being analyzed in January this year. The group got this name due to the fact that it often used the eponymous Ngrok service to host its control servers. Researchers say that the Ngrok group, which has been active at least since 2018, is behind the creation of this backdoor Trojan. According to their report, the Doki malware exploits the Dogecoin API to communicate with C&C servers. Intezer Labs discovered Doki, new Linux malware, targeting poorly secured Docker installations.

Dogecoin core malware