Author: Joshua Paul Ignacio   

 

HEUR:HackTool.Linux.XHide.a (KASPERSKY), PUA.Linux.Hacktool, PUA.Linux.Hacktool, PUA.Linux.Hacktool (IKARUS)

 PLATFORM:

Linux

 OVER ALL RISK RATING:
 DAMAGE POTENTIAL::
 DISTRIBUTION POTENTIAL::
 REPORTED INFECTION:
 INFORMATION EXPOSURE:
Low
Medium
High
Critical

  • Threat Type:
    Trojan

  • Destructiveness:
    No

  • Encrypted:
    No

  • In the wild::
    Yes

  OVERVIEW

INFECTION CHANNEL: Eliminado por otro tipo de malware

Puede haberlo descargado otro malware/grayware/spyware desde sitios remotos.

Elimina archivos para impedir la ejecución correcta de programas y aplicaciones.

Requiere que su componente principal lleve a cabo correctamente la rutina deseada. Este malware se elimina tras la ejecución.

  TECHNICAL DETAILS

File size: 4,551,919 bytes
File type: , Other
Memory resident: Yes
INITIAL SAMPLES RECEIVED DATE: 06 de stycznia de 2020
PAYLOAD: Connects to URLs/IPs, Collects system information, Steals information

Detalles de entrada

Puede haberlo descargado el siguiente malware/grayware/spyware desde sitios remotos:

Instalación

Agrega los procesos siguientes:

  • .bin/run
  • .bin/startMSR

Otras modificaciones del sistema

Elimina los archivos siguientes:

  • /dev/shm/.bin/x
  • /dev/shm/.bin/run
  • cron.d
  • dir.dir
  • *.txt
  • /dev/shm/.bin/startMSR

Robo de información

Recopila los siguientes datos:

  • Current Directory
  • Username
  • System Time and Date
  • Kernel Information
  • Number of Processing Units
  • List of Display Interface

Información sustraída

Este malware envía la información recopilada a la siguiente URL a través de HTTP POST:

  • http://{BLOCKED}ter.com/assets/.style/remote/info.php

Otros detalles

Requiere que su componente principal lleve a cabo correctamente la rutina deseada.

Hace lo siguiente:

  • It contains the following folder:
    • .bin/
  • It contains the following files:
    • .bin/config.txt
    • .bin/cpu.txt
    • .bin/pools.txt
    • .bin/h32 - detected as HackTool.Linux.XHide.GA
    • .bin/h64 - detected as HackTool.Linux.XHide.GA
    • .bin/run - detected as Trojan.SH.MALXMR.UWEJW
    • .bin/startMSR - detected as Trojan.SH.MALXMR.UWEJW
    • .bin/x - detected as Trojan.SH.MALXMR.UWEJW
    • .bin/x.pl - executes x
    • .bin/xmr-stak - detected as Coinminer.Linux.MALXMR.UWEKF
    • .bin/xmrig - detected as Coinminer.Linux.MALXMR.SMDSL64
  • xmr-stak accepts the following parameters:
    • -h, --help show this help
    • -v, --version show version number
    • -V, --version-long show long version number
    • -c, --config FILE common miner configuration file
    • -C, --poolconf FILE pool configuration file
    • --benchmark BLOCKVERSION ONLY do a benchmark and exit
    • --benchwait WAIT_SEC ... benchmark wait time
    • --benchwork WORK_SEC ... benchmark work time
    • --noCPU disable the CPU miner backend
    • --cpu FILE CPU backend miner config file
    • -i --httpd HTTP_PORT HTTP interface port
    • -o, --url URL pool url and port, e.g. pool.{BLOCKED}ool.com:3333
    • -O, --tls-url URL TLS pool url and port, e.g. pool.usxmrpool.com:10443
    • -u, --user USERNAME pool user name or wallet address
    • -r, --rigid RIGID rig identifier for pool-side statistics (needs pool support)
    • -p, --pass PASSWD pool password, in the most cases x or empty ""
    • --use-nicehash the pool should run in nicehash mode
    • --currency NAME currency to mine
    • Supported coin options:
      • - aeon7
      • - bbscoin
      • - bittube
      • - cryptonight
      • - cryptonight_bittube2
      • - cryptonight_masari
      • - cryptonight_haven
      • - cryptonight_heavy
      • - cryptonight_lite
      • - cryptonight_lite_v7
      • - cryptonight_lite_v7_xor
      • - cryptonight_r
      • - cryptonight_superfast
      • - cryptonight_turtle
      • - cryptonight_v7
      • - cryptonight_v8
      • - cryptonight_v8_double
      • - cryptonight_v8_half
      • - cryptonight_v8_reversewaltz
      • - cryptonight_v8_zelerius
      • - cryptonight_v7_stellite
      • - cryptonight_gpu
      • - cryptonight_conceal
      • - freehaven
      • - graft
      • - haven
      • - lethean
      • - masari
      • - monero
      • - qrl
      • - ryo
      • - stellite
      • - turtlecoin
      • - plenteum
      • - zelerius
      • - xcash
  • xmrig accepts the following parameters:
    • Network:
      • -o, --url=URL URL of mining server
      • -a, --algo=ALGO mining algorithm https://{BLOCKED}g.com/docs/algorithms
      • --coin=COIN specify coin instead of algorithm
      • -u, --user=USERNAME username for mining server
      • -p, --pass=PASSWORD password for mining server
      • -O, --userpass=U:P username:password pair for mining server
      • -k, --keepalive send keepalived packet for prevent timeout (needs pool support)
      • --nicehash enable {BLOCKED}sh.com support
      • --rig-id=ID rig identifier for pool-side statistics (needs pool support)
      • --daemon use daemon RPC instead of pool for solo mining
      • --daemon-poll-interval=N daemon poll interval in milliseconds (default: 1000)
      • --self-select=URL self-select block templates from URL
      • -r, --retries=N number of times to retry before switch to backup server (default: 5)
      • -R, --retry-pause=N time to pause between retries (default: 5)
      • --user-agent set custom user-agent string for pool
      • --donate-level=N donate level, default 5%% (5 minutes in 100 minutes)
      • --donate-over-proxy=N control donate over xmrig-proxy feature

    • CPU backend:
      • --no-cpu disable CPU mining backend
      • -t, --threads=N number of CPU threads
      • -v, --av=N algorithm variation, 0 auto select
      • --cpu-affinity set process affinity to CPU core(s), mask 0x3 for cores 0 and 1
      • --cpu-priority set process priority (0 idle, 2 normal to 5 highest)
      • --cpu-max-threads-hint=N maximum CPU threads count (in percentage) hint for autoconfig
      • --cpu-memory-pool=N number of 2 MB pages for persistent memory pool, -1 (auto), 0 (disable)
      • --cpu-no-yield prefer maximum hashrate rather than system response/stability
      • --no-huge-pages disable huge pages support
      • --asm=ASM ASM optimizations, possible values: auto, none, intel, ryzen, bulldozer
      • --randomx-init=N threads count to initialize RandomX dataset
      • --randomx-no-numa disable NUMA support for RandomX
      • --randomx-mode=MODE RandomX mode: auto, fast, light
      • --randomx-1gb-pages use 1GB hugepages for dataset (Linux only)
      • --randomx-wrmsr=N write value (0-15) to Intel MSR register 0x1a4 or do nothing (-1) (Linux only)

    • API:
      • --api-worker-id=ID custom worker-id for API
      • --api-id=ID custom instance ID for API
      • --http-host=HOST bind host for HTTP API (default: {BLOCKED}.{BLOCKED}.0.1)
      • --http-port=N bind port for HTTP API
      • --http-access-token=T access token for HTTP API
      • --http-no-restricted enable full remote access to HTTP API (only if access token set)

    • OpenCL backend:
      • --opencl enable OpenCL mining backend
      • --opencl-devices=N comma separated list of OpenCL devices to use
      • --opencl-platform=N OpenCL platform index or name
      • --opencl-loader=PATH path to OpenCL-ICD-Loader (OpenCL.dll or libOpenCL.so)
      • --opencl-no-cache disable OpenCL cache
      • --print-platforms print available OpenCL platforms and exit

    • CUDA backend:
      • --cuda enable CUDA mining backend
      • --cuda-loader=PATH path to CUDA plugin (xmrig-cuda.dll or libxmrig-cuda.so)
      • --cuda-devices=N comma separated list of CUDA devices to use
      • --cuda-bfactor-hint=N bfactor hint for autoconfig (0-12)
      • --cuda-bsleep-hint=N bsleep hint for autoconfig
      • --no-nvml disable NVML (NVIDIA Management Library) support

    • Logging:
      • -S, --syslog use system log for output messages
      • -l, --log-file=FILE log all output to a file
      • --print-time=N print hashrate report every N seconds
      • --health-print-time=N print health report every N seconds
      • --no-color disable colored output
      • --verbose verbose output

    • Misc:
      • -c, --config=FILE load a JSON-format configuration file
      • -B, --background run the miner in the background
      • -V, --version output version information and exit
      • -h, --help display this help and exit
      • --dry-run test configuration and exit

Este malware se elimina tras la ejecución.

  SOLUTION

Minimum scan engine: 9.850
First VSAPI Pattern File: 15.608.03
First VSAPI Pattern Release Date: 08 de stycznia de 2020
VSAPI OPR PATTERN-VERSION: 15.609.00
VSAPI OPR PATTERN DATE: 09 de stycznia de 2020

Explorar el equipo con su producto de Trend Micro para eliminar los archivos detectados como Trojan.Linux.MALXMR.UWEJS En caso de que el producto de Trend Micro ya haya limpiado, eliminado o puesto en cuarentena los archivos detectados, no serán necesarios más pasos. Puede optar simplemente por eliminar los archivos en cuarentena. Consulte esta página de Base de conocimientos para obtener más información.


Did this description help? Tell us how we did.