Trend Micro is currently warning Digmine as a special kind of Christmas greeting. The victims allegedly received a video that was intended to hide in a four-digit archive. In fact, this is an executable file that should install a Chrome extension and then redistribute to all Facebook contacts. The infected PCs are abused to mine the crypto currency Monero.
The victims received a private message from their Facebook contacts as a file called video_xxxx.zip, where xxxx stands for any four-digit number. Instead of the Christmas greeting in the form of a video, which are currently widely distributed, it hides behind a malicious software for all computers that are operated with the Windows operating system. So far, Trend Micro has not been able to find any variation for Linux distributions or Mac OS X. The functionality of the new malicious software was described for the first time by the South Korean security researcher Constant.
On all smartphones the execution of the file has no consequences. “Digmine” works only in the desktop area and only if the Facebook Messenger has been opened with the Google Chrome browser. After the infection, the program is added to the Windows startup mechanism so that the Monero Miner automatically runs in the background after each Windows startup. For the moment, a further spread is not possible because Facebook has adapted their messenger for security reasons.
Safety first: better ignore offered files from friends!
Between the years countless Christmas messages are sent in the form of videos via WhatsApp or Facebook. Since the senders are our contacts, their messages appear trustworthy and lead the recipients to start executables from third parties themselves. This trust has been exploited by cybercriminals at Digmine. It does not have to be a contaminated PDF file or a prepared .exe. For example, malware can also be hidden in Matroska container format with the extension .mkv, .mka, .mks, or .mk3d, in contrast to Digmine actually a video is played. Of course, this does not change the infection in the background.
Check out our mining system: Free Registration! (One Click)