Worm.Win32.MALXMR.TIAOODFW

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• {Malware Directory}\Packet.dll
• {Malware Directory}\wpcap.dll
• %User Temp%\npf.sys
• %User Temp%\.{Random Characters}\[kthreaddi].exe -> xmrig
• %User Temp%\.{Random Characters}\config.json -> xmrig config

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

Agrega los procesos siguientes:

• %System%\cmd.exe /c "sc stop npf"
• %System%\cmd.exe /c "sc delete npf"
• %System%\cmd.exe /c "sc create npf type= kernel start= auto binpath= %User Temp%\npf.sys"
• %System%\cmd.exe /c "sc start npf"
• route print 0.0.0.0
• %System%\cmd.exe /c start %User Temp%\.{Random Characters}\[kthreaddi].exe

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) y 10(64-bit) en C:\Windows\System32).

Finalización del proceso

Finaliza los procesos siguientes si detecta que se ejecutan en la memoria del sistema afectado:

• apaceha.exe
• apachiii.exe
• cpuset.exe
• crond64.exe
• cryptonight.exe
• devtool.exe
• devtools.exe
• haveged.exe
• irqbalanc1.exe
• jawa.exe
• kdevtmpfsi.exe
• kinsing.exe
• ksoftirqds.exe
• kthrotlds.exe
• kworker34.exe
• kworkerds.exe
• linux32.exe
• Loopback.exe
• miner-cpu.exe
• miner-notls.exe
• miner.exe
• minerd.exe
• minergate.exe
• mixnerdx.exe
• monerohash.exe
• mstxmr.exe
• nanoWatch.exe
• netdns.exe
• nginxk.exe
• nqscheduler.exe
• nullcrew.exe
• performedl.exe
• phpguard.exe
• phpupdate.exe
• pnscan.exe
• pythno.exef
• redis2.exe
• solrd.exe
• sourplum.exe
• stratum.exe
• suppoie.exe
• sustse.exe
• sustse3.exe
• svcguard.exe
• svcupdate.exe
• svcupdates.exe
• sysguard.exe
• sysstats.exe
• systemctI.exe
• systemten.exe
• systemxlv.exe
• sysupdate.exe
• vmlinuz.exe
• voltuned.exe
• watchbog.exe
• watchd0g.exe
• watchdogs.exe
• xmr-stak.exe

Otros detalles

Hace lo siguiente:

• It uses the following default details on its coin mining routine (from config.json):
  • Algo: rx/0
  • Url: xmr-eu1.nanopool.org:14444
  • User: 49dnvYkWkZNPrDj3KF8fR1BHLBfiVArU6Hu61N9gtrZWgbRptntwht5JUrXX17ZeofwPwC6fXNxPZfGjNEChXttwWE3EGUEa.W
  • Password: x
• If exploitation is successful, connects to the following URL to download and execute a malicious file:
  • http://{BLOCKED}.{BLOCKED}.227.21
• It may use the following exploits to aid its propagation:
  • XXL-JOB unauthorized access
  • WebLogic Unauthorized Access (CVE-2020-14882)
  • ThinkPhp5Rce
  • Hadoop unauthorized access
  • Jupyter unauthorized access
  • Nexus unauthorized access
  • Tomcat unauthorized access
  • WordPress unauthorized access
  • Jenkins RCE
  • CVE-2017-11610
  • CVE-2019-10758
  • CVE-2020-16846
  • CVE-2021-3129
• It scans the following ports to be used in exploitation and propagation:
  • 8088
  • 8081
  • 7001
  • 9001
• It uses the following credentials to bruteforce a system:
  • Username:
    • admin1234
    • admin@123
    • Admin@123
    • admin
    • Admin123
    • mfgproadmin
    • root
    • test
    • user
    • tomcat
  • Password:
    • 12345678
    • 123456
    • Admin123
    • P@ssw0rd
    • admin123
    • password
    • admin
    • tomcat
    • root
    • test
    • user
    • secret
    • tomcat123
    • oracle
• It tries to bruteforce the following systems:
  • Wordpress
  • Tomcat
  • Nexus
  • Jupyter
  • Jenkins