A sophisticated cryptojacking campaign is deploying a custom XMRig miner using advanced techniques to ensure both high infection rates and stealthy persistence. According to a Trellix technical report, the malware features worm-like capabilities and a time-based logic bomb for automated decommissioning. 

Core Components & Tactics

• Worm-like Spreading: The malware can spread across external storage devices, allowing it to move laterally and potentially infect systems even in air-gapped environments.
• BYOVD Exploit: It utilizes the Bring Your Own Vulnerable Driver (BYOVD) technique by dropping a vulnerable driver (e.g., WinRing0x64.sys) and exploiting CVE-2020-14979 to gain kernel-level privileges. This allows it to bypass security controls and maintain high-priority access to system resources.
• Time-Based Logic Bomb: The infection is programmed with a hardcoded “kill date” of December 23, 2025.
  • Before the date: The malware installs persistence modules and runs the XMRig miner.
  • After the date: It triggers a self-destruct sequence (launched with the argument barusu) to terminate all components and delete malicious files, effectively “cleaning up” after the campaign.
• Infection Vector: Victims are typically lured through social engineering decoys, such as pirated software bundles for office productivity suites or free premium applications. 

Malware Lifecycle Management

The central binary acts as a modular “nerve center,” taking on various roles depending on the execution argument:

• 002 Re:0: Initial phase for dropping payloads, starting the miner, and entering a monitoring loop.
• 016: Watchdog mode that restarts the miner process if it is killed.
• barusu: Cleaner mode that performs a controlled decommissioning of the infection.