When it
comes to cybercrime one does not necessarily have to be good to be successful
as is being demonstrated by the cryptomining campaign Vivin.

Cisco Talos
first came across samples of Vivin’s activity in November 2019, but upon
further research found this mining activity had been ongoing since at least 2017.
The fact it remained under the industry’s radar for so long enabling its operators
to mine thousands of dollars’ worth of Monero is curious because Vivin exhibits
poor operational security.

“Vivin makes
a minimal effort to hide their actions, making poor operational security
decisions such as posting the same Monero wallet address found in our
observable samples on online forms and social media,” Talos
wrote, adding that organizations need to be aware of bottom feeders along with
more sophisticated operations as there is still money to be made mining cryptocurrency.

The threat
actor also makes the same mistake of many people when it comes to protecting
their security and reuses the same or similar usernames for a number of online
accounts, including services used in the execution chains of the cryptomining
malware.

The malware
used is a variant of XMRig which is set up to use up to 80 percent of the
victim’s processing power for mining.

The Vivin
crew infects computers by posing their cryptominer as pirated software hoping to
lure a victim looking to save a few bucks. It also spreads a very wide net giving
the notion that creator is more interested in hitting a volume, as opposed to,
a few more lucrative targets.

“Many of the
samples are packed as self-extracting RAR files which extract and install what
appears to be the actual software and covertly drop malicious files. The
pirated software from our observed sample run contains a second stage payload
that is written to AppDataLocalTemp as “setup.exe.” Upon
successful execution, the observed samples dropped both a JavaScript
(“setup.js”) and VBScript (“dllm.vbs”) file to the victim
host’s AppDataLocalTemp and WindowsStart MenuProgramsStartup folders,”
Talos said.

Despite Vivin’s
seemingly lackadaisical attitude in opsec, the creators due take some
precautions. Talos found a fair amount of obfuscation and evasion techniques
employed, including actually downloading some of the expected pirated software.
For persistence it sets Windows Scheduler to to create the job
“anydesk” to execute setup JavaScript every 30 minutes.