Remove DirtyMoe Malware

The DirtyMoe Malware is a malicious project that has been rapidly picking up its pace over the past couple of months. Currently, there are over 100,000 active infections with the DirtyMoe Malware worldwide, and the computers of these victims are used to mine for cryptocurrency or to execute distributed-denial-of-service (DDoS) attacks. The rapidly growing botnet of the DirtyMoe Malware may turn out to be a serious issue soon since this implant enables its operators to deploy additional payloads onto compromised machines. This means that if the criminals decide to do so, they could install ransomware, infostealers, and other high-profile threats on the infected machines.

While the DirtyMoe Malware does not shine with anything special in terms of functionality, it excels when it comes to being stealthy and evasive. The criminals have developed a malicious Windows driver, which serves as a rootkit that grants the DirtyMoe Malware persistence. The fake driver in question is able to mask DirtyMoe Malware's presence in the registry, services, and even the list of drivers. The command-and-control server's address is also dynamic, so it would be impossible to simply block out the IP range that DirtyMoe Malware relies on to be controlled – it will be switched out to a working one immediately.

It is worth noting that DirtyMoe Malware's creators are relying heavily on the EternalBlue exploit, which was first reported in 2017. Although users and administrators have had four years to upgrade and patch their systems, there are still over 9 million devices vulnerable to the EternalBlue exploit. The majority of DirtyMoe Malware's active instances are located in Russia (65,000) - followed closely by Europe and Asia.

Once deployed, the DirtyMoe Malware makes various changes to the compromised system – it will disable Microsoft Defender Antivirus, as well as Windows File Protection. It also stops the Server Message Block (SMB) service to prevent other malware from infected the compromised system.

After this, the infected system's hardware resources are continuously harvested to mine for cryptocurrency. Just recently, researchers also noticed that the DirtyMoe Malware network was used for DDoS attacks as well. While this has not happened yet, it is possible for the malware's operators to run additional malware on the compromised systems.

The DirtyMoe Malware operation is still ongoing, and the infection rate has increased greatly over the past couple of months. You can protect your network by applying the latest updates and patches, as well as by using reputable antivirus software.