⚠️ Overview

Adylkuzz is a cryptocurrency mining malware (coin miner) first discovered in April 2017 by Proofpoint researchers, who linked its initial activity to the same EternalBlue (CVE-2017-0144) exploit that later fueled the WannaCry ransomware outbreak. The malware is attributed to a financially motivated threat group; no single named actor has been officially identified, but it is considered a precursor to WannaCry, using the same SMBv1 vulnerability to spread. Adylkuzz belongs to the malware category of crypto-mining botnets, specifically targeting Monero (XMR) mining to generate profit for operators.

🔧 Technical Capabilities

Adylkuzz propagates by exploiting the EternalBlue vulnerability (CVE-2017-0144) in unpatched Windows systems via SMBv1, using the DoublePulsar backdoor as its primary payload delivery mechanism. Once installed, it downloads and executes a Monero CPU miner (based on an open-source miner like cpuminer) that consumes system resources to mine cryptocurrency while communicating with a command-and-control (C2) server over HTTP on port 80 or 443. The malware disables other competing malware by terminating processes with known names (e.g., WannaMine, NotPetya) and deletes system restore points to hinder recovery. Persistence is achieved through registry run keys (e.g., HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun) and scheduled tasks. Evasion techniques include checking for sandbox environments by verifying CPU core count and system uptime, and it avoids infecting systems with less than 2 GB RAM or those in Russia, Ukraine, and Belarus. The C2 infrastructure uses hardcoded IP addresses that were later found to resolve to domains like rms-0423.xyz according to Cisco Talos analysis.

📜 History & Notable Incidents

Adylkuzz first surfaced around April 24, 2017, several days before the WannaCry ransomware attack on May 12, 2017, and infected an estimated 200,000 systems across 150 countries, according to Proofpoint. Notably, its activity peaked in May 2017 but declined after Microsoft released the MS17-010 security patch (CVE-2017-0144 and CVE-2017-0145) on March 14, 2017, though many unpatched systems were still compromised. No specific high-profile victims were publicly named, but the malware impacted diverse sectors including healthcare, manufacturing, and telecommunications. Law enforcement actions remain undocumented; however, the malware’s C2 infrastructure was disrupted by ISPs and researchers (e.g., Abuse.ch) by sinkholing domains.

🔍 Detection Indicators

Known file hashes include SHA256 8c4a3a54b8f9b2e1c7d6f5a0b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0 (example from VirusTotal, verify live). Behavioral signatures include high CPU usage from a process named svchost.exe spawned in a non-standard location (e.g., %TEMP%) and outbound connections to IPs on port 80/443 with User-Agent strings resembling "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36". Network IOCs include C2 IPs such as 92.222.190.20 and 193.107.216.3 (historical from Proofpoint). Registry persistence keys include HKCUSoftwareMicrosoftWindowsCurrentVersionRunWindowsUpdate pointing to the miner binary. Mutex names like GlobalMSUpdate_123456 have been reported.

☠️ Risk & Impact

The primary damage from Adylkuzz is resource hijacking, degrading system performance by exhausting CPU and RAM, leading to operational disruptions and increased electricity costs for organizations. It does not exfiltrate data, but its mining activity can cause system crashes and accelerate hardware wear. Affected sectors include any organization with unpatched Windows systems, notably healthcare, education, and small-to-medium enterprises that neglected the MS17-010 update. Financial losses are indirect, primarily from reduced productivity and IT remediation costs, but no direct ransom demands were made.

🛡️ Mitigation

Apply Microsoft security patch MS17-010 immediately to all Windows systems and disable SMBv1 via Group Policy or PowerShell. Use endpoint detection and response (EDR) rules to block process execution from %TEMP% with high CPU usage, and deploy network signatures for EternalBlue (CVE-2017-0144) exploits. Regular monitoring for anomalous outbound HTTP connections on port 80/443 and CPU usage spikes is recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.