Coinminer.Linux.KINSING.D

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Führt Befehle eines externen, böswilligen Benutzers aus, wodurch das betroffene System gefährdet wird.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Ordner hinzu:

• /tmp/.ICEd-unix

Schleust die folgenden Dateien ein:

• /tmp/.ICEd-unix/uuid

Schleust die folgenden Dateien ein und führt sie aus:

• /tmp/kdevtmpfsi

Backdoor-Routine

Führt die folgenden Befehle eines externen, böswilligen Benutzers aus:

• Download and execute a file
• Update downloaded files
• Execute a command
• Execute a command and send output to server
• Create an HTTP request
• Create a TCP request
• Brute-force Redis instances
• Execute MASSCAN IP Port Scanner
  • Drops firewire.sh to download and execute the masscan tool

Prozessbeendigung

Beendet die folgenden Prozesse, wenn sie im Speicher des betroffenen Systems ausgeführt werden:

• kdevtmpfsi

Datendiebstahl

Folgende Daten werden gesammelt:

• OS Version
• OS Name
• OS Architecture
• Product Name
• Product Version
• Product Serial
• Product UUID
• Board Vendor
• Board Name
• Board Version
• Board Serial
• Board Asset Tag
• Chassis Vendor
• Chassis Type
• Chassis Version
• Chassis Serial
• Chassis Asset Tag
• Bios Vendor
• Bios Version
• Bios Date
• Sys Vendor
• Kernel Version

Andere Details

Es macht Folgendes:

• This backdoor checks for the connection to the following URL to choose which C2 server to send and receive information:
  • {BLOCKED}.53.140
  • {BLOCKED}102.77
  • {BLOCKED}48.183
  • {BLOCKED}77.79
  • {BLOCKED}179.88
  • {BLOCKED}154.208
  • {BLOCKED}.150.99
  • {BLOCKED}46.81
  • {BLOCKED}2.107
  • {BLOCKED}.224.182
  • {BLOCKED}.179.225
  • {BLOCKED}.224.21
  • {BLOCKED}.23.210
  • {BLOCKED}238.176
  • {BLOCKED}159.2
  • {BLOCKED}220.193
• This backdoor receives its commands via HTTP GET to the following URL:
  • {Server}/GET