New MintsLoader Employs Domain Generation Algorithm & Anti-VM Techniques for Sophistication

The cybersecurity landscape has witnessed a significant evolution with the emergence of MintsLoader, a sophisticated malware loader that employs advanced techniques to evade detection and enhance its operational effectiveness.

Discovered by eSentire’s Threat Response Unit (TRU), MintsLoader is primarily delivered through spam emails containing links to malicious JScript files, leading to the deployment of secondary payloads like StealC and the BOINC client.

MintsLoader utilizes a Domain Generation Algorithm (DGA), which generates a plethora of domain names that serve as communication channels between the malware and its command-and-control (C2) servers.

The DGA in MintsLoader is particularly noteworthy, it combines the current day of the month with a constant to create a unique seed value.

This method allows the malware to produce new domains dynamically, making it difficult for security systems to block them effectively.

For instance, MintsLoader can generate up to 15 new domains daily, significantly complicating detection efforts by cybersecurity tools as noted by the analysts at eSentire.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free

Infection Process

The infection process begins when a victim clicks on a link in a phishing email, triggering the download of a JScript file that matches specific regex patterns.

The script then executes PowerShell commands to retrieve subsequent stages of MintsLoader, all while employing obfuscation techniques to conceal its true intentions.

One such command uses curl to fetch the next stage from a generated domain, further complicating analysis by deleting itself post-execution.

In addition to its DGA capabilities, MintsLoader incorporates anti-virtual machine (anti-VM) techniques designed to prevent analysis by security researchers.

These techniques include checks for virtual machine indicators such as specific hardware configurations and system properties. For example, MintsLoader queries the WMI for properties indicating whether the environment is virtualized.

If detected, it can alter its behavior or cease execution entirely, thus evading detection in commonly used analysis environments.

The malware’s ability to adapt and evade detection is underscored by its use of obfuscated PowerShell scripts that decode instructions only when necessary.

This obfuscation extends to its communications with C2 servers, where responses are similarly encoded using complex algorithms that require decryption before execution.

The implications of MintsLoader’s sophisticated design are profound, particularly for organizations in critical sectors such as electricity and legal services in the U.S. and Europe.

As cybercriminals increasingly adopt advanced techniques like DGAs and anti-VM measures, traditional security protocols may struggle to keep pace.

To combat these emerging threats, cybersecurity experts recommend implementing robust email filtering systems and enhancing endpoint detection capabilities.

Organizations should also conduct regular training sessions for employees on recognizing phishing attempts and suspicious links.

In summary, MintsLoader represents a significant advancement in malware sophistication, leveraging both DGA and anti-VM techniques to maintain persistence and evade detection in an ever-evolving threat landscape.

Integrating Application Security into Your CI/CD Workflows Using Jenkins & Jira -> Free Webinar