A cryptominer and a Gh0st RAT come along for the ride
The malicious T-SQL commands deploy a loader that retrieves additional executables from the attackers’ FTP infrastructure, including a Monero cryptocurrency miner and a variant of the Gh0st RAT.
FortiGuard observed a payload, MicrosoftEdgeUpdate.exe, posing as a legitimate browser update but actually turning out to be an XMRig-based cryptocurrency miner. It uses the compromised server’s CPU resources to mine Monero and communicates with mining pools using a wallet address embedded in its configuration.
The Gh0st RAT variant was delivered through “Winlogon.exe.” The researchers identified functionality for keylogging, file management, data theft, remote shell execution, and process management, alongside more than 30 control commands. Its capabilities also include screen capture and remote desktop access through plugins.
