MyKings Botnet Still Affective and Making Enormous Amount of Money

The MyKings botnet also known as Smominru or DarkCloud is still affecting spreading; making enormous amounts of money in crypto, five years after it first appeared in the wild.

Being one of the most examined botnets in modern history, MyKings is particularly interesting to researchers thanks to its vast infrastructure and versatile features, including bootkits, miners, droppers, clipboard stealers, and more. The latest team of researchers to look into MyKings is Avast Threat Labs, which gathered 6,700 unique samples to analyze since the beginning of 2020.

During the same period, Avast actively stopped over 144,000 attacks MyKings against its customers, most of them based in Russia, India, and Pakistan.   

MyKings-Botnet-Still-Affective-and-Making-Enormous-Amount-of-Money-image1

Who is affected by Botnet?

The botnet utilizes many cryptocurrency wallet addresses, with the stability in some of them remaining quite high. Avast considers that these wallets’ cryptocurrency was amassed by the clipboard stealer and the crypto mining elements.

The earnings shown in the wallet addresses connected to MyKings are around $24.7 million. However, considering the botnet uses more than 20 cryptocurrencies in total, this amount is only a part of its total financial gains.

MyKings-Botnet-Still-Affective-and-Making-Enormous-Amount-of-Money-image2

To protect the hardcoded wallet address value from extraction and analysis, the malware encrypts it with a simple ROT cipher. In general, though, no notable upgrades have been spotted on that front in the recent samples.

Current URL Replacement tricks

Apart from the wallet address substitution that diverts transactions, Avast has also spotted a new monetization technique used by MyKings operators involving the Steam gaming platform.

MyKings-Botnet-Still-Affective-and-Making-Enormous-Amount-of-Money-image3

The latest versions of the malware also feature a new URL manipulation system in the clipboard stealer module, which the attackers created to hijack Steam item trade transactions. The module changes the trade offer URL, so the actor is placed at the receiving end, stealing valuable in-game items, etc.

Similar functionality was added for the Yandex disk storage cloud service, with MyKing manipulating the URLs sent by users to their acquaintances. The modified links point to Yandex storage addresses containing RAR or ZIP archives named “photos,” which deliver a copy of the MyKings malware to these machines.

In 2018, MyKings was growing steadily, with the malware reaching 520,000 infections and making millions of dollars for its operators. Today, it appears that the botnet has grown to new proportions while still managing to remain hidden and free from law enforcement crackdowns.

Leave a Reply