Coinminer.Linux.KINSING.D

This Coinminer arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It uses the system's central processing unit (CPU) and/or graphical processing unit (GPU) resources to mine cryptocurrency.

Arrival Details

This Coinminer arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Coinminer adds the following folders:

• /tmp/.ICEd-unix

It drops the following files:

• /tmp/.ICEd-unix/uuid

It drops and executes the following files:

• /tmp/kdevtmpfsi

Backdoor Routine

This Coinminer executes the following commands from a remote malicious user:

• Download and execute a file
• Update downloaded files
• Execute a command
• Execute a command and send output to server
• Create an HTTP request
• Create a TCP request
• Brute-force Redis instances
• Execute MASSCAN IP Port Scanner
  • Drops firewire.sh to download and execute the masscan tool

Process Termination

This Coinminer terminates the following processes if found running in the affected system's memory:

• kdevtmpfsi

Information Theft

This Coinminer gathers the following data:

• OS Version
• OS Name
• OS Architecture
• Product Name
• Product Version
• Product Serial
• Product UUID
• Board Vendor
• Board Name
• Board Version
• Board Serial
• Board Asset Tag
• Chassis Vendor
• Chassis Type
• Chassis Version
• Chassis Serial
• Chassis Asset Tag
• Bios Vendor
• Bios Version
• Bios Date
• Sys Vendor
• Kernel Version

Other Details

This Coinminer does the following:

• This backdoor checks for the connection to the following URL to choose which C2 server to send and receive information:
  • {BLOCKED}.53.140
  • {BLOCKED}102.77
  • {BLOCKED}48.183
  • {BLOCKED}77.79
  • {BLOCKED}179.88
  • {BLOCKED}154.208
  • {BLOCKED}.150.99
  • {BLOCKED}46.81
  • {BLOCKED}2.107
  • {BLOCKED}.224.182
  • {BLOCKED}.179.225
  • {BLOCKED}.224.21
  • {BLOCKED}.23.210
  • {BLOCKED}238.176
  • {BLOCKED}159.2
  • {BLOCKED}220.193
• This backdoor receives its commands via HTTP GET to the following URL:
  • {Server}/GET

It uses the system's central processing unit (CPU) and/or graphical processing unit (GPU) resources to mine cryptocurrency. This behavior makes the system run abnormally slow.