AhnLab EDR Detects CoinMiner Propagated via USB in South Korea

This AhnLab analysis details a CoinMiner campaign that propagates through infected USB drives, hides user files, and executes via generated .vbs/.bat dropper files. The malware creates a misleading "C:\Windows (space)\System32" folder to facilitate privilege escalation, uses DLL side‑loading and PowerShell to add Windows Defender exclusion paths, and maintains persistence through a registered service and scheduled tasks; the report includes EDR detection names and MD5 indicators for detection and investigation.