Monero Hidden Miner was Detected in WAV Audio Files

Research has shown that some of WAV files contain a code, which is connected with XMRig Monero CPU miner. Others include Metasploit code, used for creation of back shell. Both loads were detected in the same environ, which implies a two-stage campaign to introduce malware in order to obtain financial benefits and organize remote access to the victim’s network.

WAV file downloaders can be grouped into the following three categories, allocated by BlackBerry Cylance developers:

1. Loaders, which use insignificant bit steganography (LSB) to decode and execute PE file.
2. Loaders, which use the rand-based decoding algorithm () to decode and execute PE file.
   
3. Loaders, which use the rand-based decoding algorithm () to decode and execute shellcode.
   

Each approach allows attackers to compose a code from another harmless file format. These methods show that executable content theoretically can be hidden inside any type of file, if attacker does not damage the structure and processing of the container format. Adoption of this strategy creates an additional level of confusion, because the main code is found only in memory. As experts emphasized, that's why the detection of the virus becomes more difficult.