Poisoned peer-to-peer app kicked off Dofoil coin miner outbreak - Microsoft Security Blog
Tags
cmtmf-attack-pattern: Code Injection Process Injection
attack-pattern: Model Models Code Injection - T1540 Dns - T1071.004 Dns - T1590.002 Domains - T1583.001 Domains - T1584.001 Malware - T1587.001 Malware - T1588.001 Process Hollowing - T1055.012 Process Injection - T1631 Server - T1583.004 Server - T1584.004 Software - T1592.002 Process Hollowing - T1093 Process Injection - T1055 Third-Party Software - T1072
Show in Graph
Common Information
Type Value
UUID 615ef94e-e897-4d3d-a378-f73f45f3026b
Fingerprint 859189dbd03626d2
Analysis status DONE
Considered CTI value 2
Text language
Published March 13, 2018, 3:27 p.m.
Added to db Feb. 17, 2023, 9:37 p.m.
Last updated Nov. 19, 2024, 10:09 a.m.
Headline Poisoned peer-to-peer app kicked off Dofoil coin miner outbreak
Title Poisoned peer-to-peer app kicked off Dofoil coin miner outbreak - Microsoft Security Blog
Detected Hints/Tags/Attributes 57/2/16
Source URLs
Redirection Url
Details Source https://cloudblogs.microsoft.com/microsoftsecure/2018/03/13/poisoned-peer-to-peer-app-kicked-off-dofoil-coin-miner-outbreak/
Details Source https://www.microsoft.com/en-us/security/blog/2018/03/13/poisoned-peer-to-peer-app-kicked-off-dofoil-coin-miner-outbreak/
URL Provider
Details Provider Source level domain
Details microsoft.com www.microsoft.com
Details microsoft.com cloudblogs.microsoft.com
Attributes
Details Type #Events CTI Value
Details Domain 1 
mediaget.com
Details Domain 1 
goshan.online
Details File 2 
mediaget.exe
Details File 1 
my.dat
Details File 1 
%localappdata%\mediaget2\mediaget.exe
Details File 175 
update.exe
Details File 1 
%temp%\my.dat
Details File 41 
wuauclt.exe
Details sha1 1 
3e0ccd9fa0a5c40c2abb40ed6730556e3d36af3c
Details sha1 1 
5022efca9e0a9022ab0ca6031a78f66528848568
Details sha1 1 
1038d32974969a1cc7a79c3fc7b7a5ab8d14fd3e
Details sha1 1 
4f31a397a0f2d8ba25fdfd76e0dfc6a0b30dabd5
Details sha1 1 
513a1624b47a4bca15f2f32457153482bedda640
Details sha1 1 
fda5e9b9ce28f62475054516d0a9f5a799629ba8
Details sha1 1 
d84d6ec10694f76c56f6b7367ab56ea1f743d284
Details sha1 1 
88eba5d205d85c39ced484a3aa7241302fd815e3