Trojan.Linux.MALXMR.UWEJS

Wird möglicherweise von anderer Malware/Grayware/Spyware von externen Sites heruntergeladen.

Löscht Dateien, so dass Programme und Anwendungen nicht ordnungsgemäß ausgeführt werden.

Die Hauptkomponente muss die vorgesehene Routine erfolgreich ausführen. Löscht sich nach der Ausführung selbst.

Übertragungsdetails

Wird möglicherweise von der folgenden Malware/Grayware/Spyware von externen Sites heruntergeladen:

• Trojan.SH.MALXMR.UWEJS

Installation

Fügt die folgenden Prozesse hinzu:

• .bin/run
• .bin/startMSR

Andere Systemänderungen

Löscht die folgenden Dateien:

• /dev/shm/.bin/x
• /dev/shm/.bin/run
• cron.d
• dir.dir
• *.txt
• /dev/shm/.bin/startMSR

Datendiebstahl

Folgende Daten werden gesammelt:

• Current Directory
• Username
• System Time and Date
• Kernel Information
• Number of Processing Units
• List of Display Interface

Entwendete Daten

Sendet die gesammelten Daten über HTTP-POST an den folgenden URL:

• http://{BLOCKED}ter.com/assets/.style/remote/info.php

Andere Details

Die Hauptkomponente muss die vorgesehene Routine erfolgreich ausführen.

Es macht Folgendes:

• It contains the following folder:
  
  • .bin/
• It contains the following files:
  
  • .bin/config.txt
  • .bin/cpu.txt
  • .bin/pools.txt
  • .bin/h32 - detected as HackTool.Linux.XHide.GA
  • .bin/h64 - detected as HackTool.Linux.XHide.GA
  • .bin/run - detected as Trojan.SH.MALXMR.UWEJW
  • .bin/startMSR - detected as Trojan.SH.MALXMR.UWEJW
  • .bin/x - detected as Trojan.SH.MALXMR.UWEJW
  • .bin/x.pl - executes x
  • .bin/xmr-stak - detected as Coinminer.Linux.MALXMR.UWEKF
  • .bin/xmrig - detected as Coinminer.Linux.MALXMR.SMDSL64
• xmr-stak accepts the following parameters:
  
  • -h, --help show this help
  • -v, --version show version number
  • -V, --version-long show long version number
  • -c, --config FILE common miner configuration file
  • -C, --poolconf FILE pool configuration file
  • --benchmark BLOCKVERSION ONLY do a benchmark and exit
  • --benchwait WAIT_SEC ... benchmark wait time
  • --benchwork WORK_SEC ... benchmark work time
  • --noCPU disable the CPU miner backend
  • --cpu FILE CPU backend miner config file
  • -i --httpd HTTP_PORT HTTP interface port
  • -o, --url URL pool url and port, e.g. pool.{BLOCKED}ool.com:3333
  • -O, --tls-url URL TLS pool url and port, e.g. pool.usxmrpool.com:10443
  • -u, --user USERNAME pool user name or wallet address
  • -r, --rigid RIGID rig identifier for pool-side statistics (needs pool support)
  • -p, --pass PASSWD pool password, in the most cases x or empty ""
  • --use-nicehash the pool should run in nicehash mode
  • --currency NAME currency to mine
  • Supported coin options:
    
    • - aeon7
    • - bbscoin
    • - bittube
    • - cryptonight
    • - cryptonight_bittube2
    • - cryptonight_masari
    • - cryptonight_haven
    • - cryptonight_heavy
    • - cryptonight_lite
    • - cryptonight_lite_v7
    • - cryptonight_lite_v7_xor
    • - cryptonight_r
    • - cryptonight_superfast
    • - cryptonight_turtle
    • - cryptonight_v7
    • - cryptonight_v8
    • - cryptonight_v8_double
    • - cryptonight_v8_half
    • - cryptonight_v8_reversewaltz
    • - cryptonight_v8_zelerius
    • - cryptonight_v7_stellite
    • - cryptonight_gpu
    • - cryptonight_conceal
    • - freehaven
    • - graft
    • - haven
    • - lethean
    • - masari
    • - monero
    • - qrl
    • - ryo
    • - stellite
    • - turtlecoin
    • - plenteum
    • - zelerius
    • - xcash
• xmrig accepts the following parameters:
  
  • Network:
    
    • -o, --url=URL URL of mining server
    • -a, --algo=ALGO mining algorithm https://{BLOCKED}g.com/docs/algorithms
    • --coin=COIN specify coin instead of algorithm
    • -u, --user=USERNAME username for mining server
    • -p, --pass=PASSWORD password for mining server
    • -O, --userpass=U:P username:password pair for mining server
    • -k, --keepalive send keepalived packet for prevent timeout (needs pool support)
    • --nicehash enable {BLOCKED}sh.com support
    • --rig-id=ID rig identifier for pool-side statistics (needs pool support)
    • --daemon use daemon RPC instead of pool for solo mining
    • --daemon-poll-interval=N daemon poll interval in milliseconds (default: 1000)
    • --self-select=URL self-select block templates from URL
    • -r, --retries=N number of times to retry before switch to backup server (default: 5)
    • -R, --retry-pause=N time to pause between retries (default: 5)
    • --user-agent set custom user-agent string for pool
    • --donate-level=N donate level, default 5%% (5 minutes in 100 minutes)
    • --donate-over-proxy=N control donate over xmrig-proxy feature
    
    
  • CPU backend:
    
    • --no-cpu disable CPU mining backend
    • -t, --threads=N number of CPU threads
    • -v, --av=N algorithm variation, 0 auto select
    • --cpu-affinity set process affinity to CPU core(s), mask 0x3 for cores 0 and 1
    • --cpu-priority set process priority (0 idle, 2 normal to 5 highest)
    • --cpu-max-threads-hint=N maximum CPU threads count (in percentage) hint for autoconfig
    • --cpu-memory-pool=N number of 2 MB pages for persistent memory pool, -1 (auto), 0 (disable)
    • --cpu-no-yield prefer maximum hashrate rather than system response/stability
    • --no-huge-pages disable huge pages support
    • --asm=ASM ASM optimizations, possible values: auto, none, intel, ryzen, bulldozer
    • --randomx-init=N threads count to initialize RandomX dataset
    • --randomx-no-numa disable NUMA support for RandomX
    • --randomx-mode=MODE RandomX mode: auto, fast, light
    • --randomx-1gb-pages use 1GB hugepages for dataset (Linux only)
    • --randomx-wrmsr=N write value (0-15) to Intel MSR register 0x1a4 or do nothing (-1) (Linux only)
    
    
  • API:
    
    • --api-worker-id=ID custom worker-id for API
    • --api-id=ID custom instance ID for API
    • --http-host=HOST bind host for HTTP API (default: {BLOCKED}.{BLOCKED}.0.1)
    • --http-port=N bind port for HTTP API
    • --http-access-token=T access token for HTTP API
    • --http-no-restricted enable full remote access to HTTP API (only if access token set)
    
    
  • OpenCL backend:
    
    • --opencl enable OpenCL mining backend
    • --opencl-devices=N comma separated list of OpenCL devices to use
    • --opencl-platform=N OpenCL platform index or name
    • --opencl-loader=PATH path to OpenCL-ICD-Loader (OpenCL.dll or libOpenCL.so)
    • --opencl-no-cache disable OpenCL cache
    • --print-platforms print available OpenCL platforms and exit
    
    
  • CUDA backend:
    
    • --cuda enable CUDA mining backend
    • --cuda-loader=PATH path to CUDA plugin (xmrig-cuda.dll or libxmrig-cuda.so)
    • --cuda-devices=N comma separated list of CUDA devices to use
    • --cuda-bfactor-hint=N bfactor hint for autoconfig (0-12)
    • --cuda-bsleep-hint=N bsleep hint for autoconfig
    • --no-nvml disable NVML (NVIDIA Management Library) support
    
    
  • Logging:
    
    • -S, --syslog use system log for output messages
    • -l, --log-file=FILE log all output to a file
    • --print-time=N print hashrate report every N seconds
    • --health-print-time=N print health report every N seconds
    • --no-color disable colored output
    • --verbose verbose output
    
    
  • Misc:
    
    • -c, --config=FILE load a JSON-format configuration file
    • -B, --background run the miner in the background
    • -V, --version output version information and exit
    • -h, --help display this help and exit
    • --dry-run test configuration and exit

Löscht sich nach der Ausführung selbst.