Coinminer.SH.MALXMR.ATNE

This Coinminer arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Coinminer arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Coinminer adds the following processes:

• xm.service

Process Termination

This Coinminer terminates the following processes if found running in the affected system's memory:

• xmrig
• proc
• xmr-stak
• minergate-cli
• bashd.service -> also disabled from starting automatically

Download Routine

This Coinminer accesses the following websites to download files:

• http://{BLOCKED}.{BLOCKED}.219.163/k.php
• http://{BLOCKED}.{BLOCKED}.219.163/data.cfg
• http://{BLOCKED}.{BLOCKED}.219.163/xm
• http://{BLOCKED}.{BLOCKED}.219.163/xm.service
• http://{BLOCKED}.{BLOCKED}.219.163/test.sh
• http://{BLOCKED}.{BLOCKED}.219.163/test3.sh

It saves the files it downloads using the following names:

• {Malware Path}/data.cfg
• {Malware Path}/xm
• {Malware Path}/test.sh
• {Malware Path}/test3.sh
• /etc/systemd/system/xm.service

Other Details

This Coinminer does the following:

• Creates users "richard" and "frank" then grant them root privileges
• Reconfigure the secure socket shell (SSH) daemon to allow password authentication, and restart the SSH daemon
• Make the downloaded scripts executable
• Scan all networks seen from the host w/ scan rate of 50,000 packets per second for open ports 2375 and 2376 and save the result into local.txt file
• Spread laterally by automatically replicating the tools to the hosts found in previous reconnaissance scans
• Check the persistence of the Monero-mining process and start the process, it if it is not running
• Install the following packages:
  • systemd
  • masscan
  • iproute2

However, as of this writing, the said sites are inaccessible.