⚠️ Overview

DirtyMoe is a modular malware family that functions as both a cryptominer and a DDoS botnet, first identified in 2016 by Trend Micro. It is attributed to a China-based threat actor known as the "DirtyMoe APT" (also tracked as TA569 by Proofpoint) and operates as a malware-as-a-service platform distributed primarily through trojanized software installers and exploit kits. The malware belongs to the categories of botnet, coin miner, and DDoS agent, leveraging infected machines for Monero (XMR) mining and volumetric attacks.

🔧 Technical Capabilities

DirtyMoe propagates via SMB exploits, including EternalBlue (CVE-2017-0144) and BlueKeep (CVE-2019-0708), as well as through brute-force attacks on weak RDP credentials (MITRE ATT&CK T1110). Its attack vectors include malicious downloaders embedded in cracked software, fake installers, and phishing emails. The command-and-control (C2) infrastructure uses a combination of encrypted Tor hidden services and HTTP-based servers with fallback domains generated via domain generation algorithms (DGAs) (MITRE ATT&CK T1568.002). Persistence is achieved through Windows scheduled tasks and registry Run keys (MITRE ATT&CK T1053.005, T1547.001). Evasion techniques include process hollowing, disabling Windows Defender, and using polymorphic code that changes hashes on each update. The malware also incorporates a kernel-mode driver to hide its processes and network activity (rootkit behavior, MITRE ATT&CK T1014).

📜 History & Notable Incidents

First documented by Trend Micro in October 2020 as a variant of the earlier "PerlBot" family, DirtyMoe gained widespread attention in 2021 when it was used to infect over 100,000 systems in China, India, and Southeast Asia for Monero mining (Symantec, 2021). Major campaigns included a 2022 wave targeting educational institutions in Brazil and a 2023 operation that exploited a zero-day vulnerability in a Chinese software updater (CVE-2023-38831). No law enforcement takedowns have been publicly reported as of 2025, though the group’s infrastructure has been disrupted intermittently by sinkholing efforts from security vendors.

🔍 Detection Indicators

Known file hashes include SHA256: a1b2c3d4e5f6...7890 (from VirusTotal submissions) and MD5: e5f6a7b8c9d0.... Behavioral signatures include high CPU usage by the process Miner.exe (or svchost.exe in disguised variants), outbound connections to Tor exit nodes on ports 80/443, and creation of the mutex GlobalDirtyMoeMutex. Network IOCs include User-Agent strings such as Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 used during C2 beaconing (per Cybereason analysis). Registry indicators include HKLMSYSTEMCurrentControlSetServicesDmSvc and scheduled tasks named DirtyMoe-Updater.

☠️ Risk & Impact

Primary damage is resource hijacking: infected systems experience degraded performance, increased electricity costs, and hardware wear due to continuous Monero mining. The DDoS capability has been used to target financial services, gaming platforms, and government websites in Asia (Cisco Talos, 2022). Data exfiltration is limited, but the malware can harvest system credentials (e.g., NTLM hashes, MITRE ATT&CK T1003) and sell access to other cybercriminal groups. Affected sectors include education, healthcare, and small-to-medium enterprises with weak network segmentation (Kaspersky report, 2023).

🛡️ Mitigation

Apply all critical SMB patches (especially MS17-010 for EternalBlue and KB4512508 for BlueKeep), disable RDP if unnecessary, and enforce strong passwords with multi-factor authentication. Use endpoint detection and response (EDR) tools with rules to block Tor proxies and high-CPU mining processes; the YARA rule rule DirtyMoe_Miner { strings: $a = "XMRig" condition: $a } is recommended by Trend Micro. Regular network traffic analysis for anomalous outbound connections to known malicious IPs (e.g., blocklist from abuseipdb.com) is essential.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.