Adylkuzz

Overview

Worm:Win32/Adylkuzz is a massive, stealthy cryptomining botnet that gained notoriety for exploiting the MS17-010 (EternalBlue) vulnerability (`T1210`) *before* the infamous WannaCry ransomware outbreak. While WannaCry caused global disruption by encrypting data, Adylkuzz operators preferred to stay hidden, quietly hijacking CPU resources (`T1496`) across tens of thousands of infected machines to mine Monero (XMR).

Understanding Adylkuzz (Resource Hijacking)
To an end-user, an Adylkuzz infection manifests as severe system sluggishness, high CPU utilization, and fan noise, as the malware consumes processing power. For an enterprise, it represents a massive theft of computing resources, increased power costs, and a critical vulnerability (SMBv1 exposure) that could have been exploited by far worse payloads.

Execution and Propagation Mechanics
Adylkuzz does not require user interaction. It operates as a worm (`T1090`), scanning the internet and local subnets for machines exposing vulnerable SMBv1 ports (445). It uses the EternalBlue exploit to gain SYSTEM-level access, then uses the DoublePulsar backdoor (`T1505.003`) to download and execute the cryptominer payload. Notably, once Adylkuzz infects a machine, it actively *closes* the SMB port to prevent other malware (like WannaCry) from infecting its host and competing for CPU resources (`T1562.004`), effectively 'patching' the machine for its own benefit.

Indicators of Compromise & Impact
The primary impact is resource degradation and increased operational costs. Host-based IoCs include persistent CPU utilization nearing 100% by unknown or renamed processes (like `svchost.exe` or random strings), and the presence of DoublePulsar backdoor artifacts in memory. Network IoCs are distinct: constant outbound connections to Monero mining pools (often over port 4444 or 14444) and aggressive outbound SMB scanning on port 445 as the worm attempts to spread.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_ADYLKUZZ {
    meta:
        description = "Detects Adylkuzz (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "adylkuzz" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Adylkuzz Activity
id: f3ac49328d4a6df012230c53785a51bf
status: experimental
description: Detects generic indicators of the adylkuzz malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*adylkuzz*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately apply the MS17-010 patch to all Windows systems enterprise-wide; this is the primary propagation vector.
2. Disable SMBv1 globally across the network, as it is obsolete and highly vulnerable.
3. Isolate infected machines and terminate the heavily obfuscated mining processes.
4. Block known cryptocurrency mining pool IP addresses and domains at the perimeter firewall to neutralize the financial incentive for the attackers.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume a machine is safe just because it didn't get hit by WannaCry; Adylkuzz quietly infected many of the exact same vulnerable hosts.
2. Avoid relying solely on CPU monitoring; advanced miners can throttle their usage when a user is active to evade detection.

References & External Analysis

• Search "adylkuzz" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Comisproc
• Pajetbin
• Genericrxbz
• Zapinit
• Loveletter

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/adylkuzz.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.