Trojan.Linux.MALXMR.UWEJS

This Trojan may be downloaded by other malware/grayware from remote sites.

It requires its main component to successfully perform its intended routine. It deletes itself after execution.

Arrival Details

This Trojan may be downloaded by the following malware/grayware from remote sites:

• Trojan.SH.MALXMR.UWEJS

Installation

This Trojan adds the following processes:

• .bin/run
• .bin/startMSR

Other System Modifications

This Trojan deletes the following files:

• /dev/shm/.bin/x
• /dev/shm/.bin/run
• cron.d
• dir.dir
• *.txt
• /dev/shm/.bin/startMSR

Information Theft

This Trojan gathers the following data:

• Current Directory
• Username
• System Time and Date
• Kernel Information
• Number of Processing Units
• List of Display Interface

Stolen Information

This Trojan sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}ter.com/assets/.style/remote/info.php

Other Details

This Trojan connects to the following URL(s) to get the affected system's IP address:

• http://{BLOCKED}ter.com/assets/.style/remote/info.php

It requires its main component to successfully perform its intended routine.

It does the following:

• It contains the following folder:
  
  • .bin/
• It contains the following files:
  
  • .bin/config.txt
  • .bin/cpu.txt
  • .bin/pools.txt
  • .bin/h32 - detected as HackTool.Linux.XHide.GA
  • .bin/h64 - detected as HackTool.Linux.XHide.GA
  • .bin/run - detected as Trojan.SH.MALXMR.UWEJW
  • .bin/startMSR - detected as Trojan.SH.MALXMR.UWEJW
  • .bin/x - detected as Trojan.SH.MALXMR.UWEJW
  • .bin/x.pl - executes x
  • .bin/xmr-stak - detected as Coinminer.Linux.MALXMR.UWEKF
  • .bin/xmrig - detected as Coinminer.Linux.MALXMR.SMDSL64
• xmr-stak accepts the following parameters:
  
  • -h, --help show this help
  • -v, --version show version number
  • -V, --version-long show long version number
  • -c, --config FILE common miner configuration file
  • -C, --poolconf FILE pool configuration file
  • --benchmark BLOCKVERSION ONLY do a benchmark and exit
  • --benchwait WAIT_SEC ... benchmark wait time
  • --benchwork WORK_SEC ... benchmark work time
  • --noCPU disable the CPU miner backend
  • --cpu FILE CPU backend miner config file
  • -i --httpd HTTP_PORT HTTP interface port
  • -o, --url URL pool url and port, e.g. pool.{BLOCKED}ool.com:3333
  • -O, --tls-url URL TLS pool url and port, e.g. pool.usxmrpool.com:10443
  • -u, --user USERNAME pool user name or wallet address
  • -r, --rigid RIGID rig identifier for pool-side statistics (needs pool support)
  • -p, --pass PASSWD pool password, in the most cases x or empty ""
  • --use-nicehash the pool should run in nicehash mode
  • --currency NAME currency to mine
  • Supported coin options:
    
    • - aeon7
    • - bbscoin
    • - bittube
    • - cryptonight
    • - cryptonight_bittube2
    • - cryptonight_masari
    • - cryptonight_haven
    • - cryptonight_heavy
    • - cryptonight_lite
    • - cryptonight_lite_v7
    • - cryptonight_lite_v7_xor
    • - cryptonight_r
    • - cryptonight_superfast
    • - cryptonight_turtle
    • - cryptonight_v7
    • - cryptonight_v8
    • - cryptonight_v8_double
    • - cryptonight_v8_half
    • - cryptonight_v8_reversewaltz
    • - cryptonight_v8_zelerius
    • - cryptonight_v7_stellite
    • - cryptonight_gpu
    • - cryptonight_conceal
    • - freehaven
    • - graft
    • - haven
    • - lethean
    • - masari
    • - monero
    • - qrl
    • - ryo
    • - stellite
    • - turtlecoin
    • - plenteum
    • - zelerius
    • - xcash
• xmrig accepts the following parameters:
  
  • Network:
    
    • -o, --url=URL URL of mining server
    • -a, --algo=ALGO mining algorithm https://{BLOCKED}g.com/docs/algorithms
    • --coin=COIN specify coin instead of algorithm
    • -u, --user=USERNAME username for mining server
    • -p, --pass=PASSWORD password for mining server
    • -O, --userpass=U:P username:password pair for mining server
    • -k, --keepalive send keepalived packet for prevent timeout (needs pool support)
    • --nicehash enable {BLOCKED}sh.com support
    • --rig-id=ID rig identifier for pool-side statistics (needs pool support)
    • --daemon use daemon RPC instead of pool for solo mining
    • --daemon-poll-interval=N daemon poll interval in milliseconds (default: 1000)
    • --self-select=URL self-select block templates from URL
    • -r, --retries=N number of times to retry before switch to backup server (default: 5)
    • -R, --retry-pause=N time to pause between retries (default: 5)
    • --user-agent set custom user-agent string for pool
    • --donate-level=N donate level, default 5%% (5 minutes in 100 minutes)
    • --donate-over-proxy=N control donate over xmrig-proxy feature
    
    
  • CPU backend:
    
    • --no-cpu disable CPU mining backend
    • -t, --threads=N number of CPU threads
    • -v, --av=N algorithm variation, 0 auto select
    • --cpu-affinity set process affinity to CPU core(s), mask 0x3 for cores 0 and 1
    • --cpu-priority set process priority (0 idle, 2 normal to 5 highest)
    • --cpu-max-threads-hint=N maximum CPU threads count (in percentage) hint for autoconfig
    • --cpu-memory-pool=N number of 2 MB pages for persistent memory pool, -1 (auto), 0 (disable)
    • --cpu-no-yield prefer maximum hashrate rather than system response/stability
    • --no-huge-pages disable huge pages support
    • --asm=ASM ASM optimizations, possible values: auto, none, intel, ryzen, bulldozer
    • --randomx-init=N threads count to initialize RandomX dataset
    • --randomx-no-numa disable NUMA support for RandomX
    • --randomx-mode=MODE RandomX mode: auto, fast, light
    • --randomx-1gb-pages use 1GB hugepages for dataset (Linux only)
    • --randomx-wrmsr=N write value (0-15) to Intel MSR register 0x1a4 or do nothing (-1) (Linux only)
    
    
  • API:
    
    • --api-worker-id=ID custom worker-id for API
    • --api-id=ID custom instance ID for API
    • --http-host=HOST bind host for HTTP API (default: {BLOCKED}.{BLOCKED}.0.1)
    • --http-port=N bind port for HTTP API
    • --http-access-token=T access token for HTTP API
    • --http-no-restricted enable full remote access to HTTP API (only if access token set)
    
    
  • OpenCL backend:
    
    • --opencl enable OpenCL mining backend
    • --opencl-devices=N comma separated list of OpenCL devices to use
    • --opencl-platform=N OpenCL platform index or name
    • --opencl-loader=PATH path to OpenCL-ICD-Loader (OpenCL.dll or libOpenCL.so)
    • --opencl-no-cache disable OpenCL cache
    • --print-platforms print available OpenCL platforms and exit
    
    
  • CUDA backend:
    
    • --cuda enable CUDA mining backend
    • --cuda-loader=PATH path to CUDA plugin (xmrig-cuda.dll or libxmrig-cuda.so)
    • --cuda-devices=N comma separated list of CUDA devices to use
    • --cuda-bfactor-hint=N bfactor hint for autoconfig (0-12)
    • --cuda-bsleep-hint=N bsleep hint for autoconfig
    • --no-nvml disable NVML (NVIDIA Management Library) support
    
    
  • Logging:
    
    • -S, --syslog use system log for output messages
    • -l, --log-file=FILE log all output to a file
    • --print-time=N print hashrate report every N seconds
    • --health-print-time=N print health report every N seconds
    • --no-color disable colored output
    • --verbose verbose output
    
    
  • Misc:
    
    • -c, --config=FILE load a JSON-format configuration file
    • -B, --background run the miner in the background
    • -V, --version output version information and exit
    • -h, --help display this help and exit
    • --dry-run test configuration and exit

It deletes itself after execution.