Sebastian Sinclair

<div id="highlights-block_630f28259bd10" class="highlights">
 <ul>
 <li>Nitrokod is currently featured at the top of Google search results for popular apps, including Translate</li>
 <li>The malware maliciously mines monero using users&#8217; computer resources, echoing once-prolific CoinHive</li>
 </ul>
 
</div>



An insidious malware campaign targeting users searching for Google applications has infected thousands of computers globally to mine <a href="https://cms.blockworks.co/crypto-mixers-and-privacy-coins-can-they-resist-censorship/">privacy-focused crypto</a> monero (XMR).



You’ve probably never heard of Nitrokod. Israeli-based cyber intelligence firm Check Point Research (CPR) stumbled upon the malware last month.&nbsp;



In a <a href="https://research.checkpoint.com/2022/check-point-research-detects-crypto-miner-malware-disguised-as-google-translate-desktop-and-other-legitimate-applications/" target="_blank" rel="noreferrer noopener">report on Sunday</a>, the firm said Nitrokod initially masks itself as a free software, having found remarkable success at the top of Google search results for “Google Translate desktop download.”



Also known as cryptojacking, mining malware has been used to infiltrate unsuspecting user’s machines since at least 2017, when they rose to prominence alongside crypto’s popularity.



CPR previously detected well-known cryptojacking malware CoinHive, which also mined XMR, in November of that year. CoinHive was said to be stealing <a href="https://www.checkpoint.com/press/2017/cryptocurrency-mining-presents-new-threat-business-says-check-point/" target="_blank" rel="noreferrer noopener">65% of an end-user’s total CPU resources</a> without their knowledge. Academics <a href="https://thenextweb.com/news/coinhive-mining-monero-profits" target="_blank" rel="noreferrer noopener">calculated</a> the malware was generating $250,000 per month at its peak, with the bulk of it going to less than a dozen individuals.



As for Nitrokod, CPR believes it was deployed by a Turkish-speaking entity sometime in 2019. It operates across seven stages as it moves along its path to avoid detection from typical antivirus programs and system defenses.&nbsp;



“The malware is easily dropped from software found on top Google search results for legitimate applications,” the firm wrote in its report. 



Softpedia and Uptodown were found to be two major sources of fake applications. Blockworks has reached out to Google to learn more about how it filters these kinds of threats.



<figure class="wp-block-image size-full"><img loading="lazy" decoding="async" width="935" height="445" src="https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp" alt="" class="wp-image-29655" srcset="https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=935 935w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=300 300w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=768 768w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=428 428w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=470 470w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=389 389w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=80 80w, https://cms.blockworks.co/wp-content/uploads/2022/08/Picture1-1.webp?w=50 50w" sizes="auto, (max-width: 935px) 100vw, 935px" /><figcaption>Image source: <a href="https://research.checkpoint.com/2022/check-point-research-detects-crypto-miner-malware-disguised-as-google-translate-desktop-and-other-legitimate-applications/" target="_blank" rel="noreferrer noopener">Check Point Research</a></figcaption></figure>



After downloading the application, an installer executes a delayed dropper and continuously updates itself on every restart. On the fifth day, the delayed dropper extracts an encrypted file.&nbsp;



The file then initiates Nitrokod’s final stages, which sets about scheduling tasks, clearing logs and adding exceptions to antivirus firewalls once 15 days have ticked by.



Finally, crypto mining malware “powermanager.exe” is surrepticiously dropped onto the infected machine and sets about generating crypto using open source Monero-based CPU miner XMRig (the same one used by CoinHive).



“After the initial software installation, the attackers delayed the infection process for weeks and deleted traces from the original installation,” the firm wrote in its report. “This allowed the campaign to successfully operate under the radar for years.”



Details of how to clean machines infected with Nitrokod can be found at the <a href="https://research.checkpoint.com/2022/check-point-research-detects-crypto-miner-malware-disguised-as-google-translate-desktop-and-other-legitimate-applications/" target="_blank" rel="noreferrer noopener">end of CPR&#8217;s threat report</a>.



Learn More: <a href="https://cms.blockworks.co/crypto-mixers-and-privacy-coins-can-they-resist-censorship/">Can Crypto Mixers and Privacy Coins Resist Censorship?</a> 



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

google translate

Newsletter

Blockworks Research