The cryptocurrency mining group 8220 Gang has been observed using a new crypter called ScrubCrypt to carry out their cryptojacking operation, according to Fortinet FortiGuard Labs. Crypters are a type of software that can encrypt, obfuscate, and manipulate malware with the goal of evading detection by security programs.
ScrubCrypt, which is advertised for sale by its author, comes with features to bypass Windows Defender protections as well as check for the presence of debugging and virtual machine environments. "ScrubCrypt is a crypter used to secure applications with a unique BAT packing method," security researcher Cara Lin said in a technical report. "The encrypted data at the top can be split into four parts using backslash '\.'"
The crypter, in the final stage, decodes and loads the miner payload in memory, thereby launching the miner process. The threat actor has a track record of taking advantage of publicly disclosed vulnerabilities to infiltrate targets, and the latest findings are no different.