Coinminer.SH.MALXMR.ATNP

This Coinminer arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Coinminer arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This Coinminer connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.70.143:8888

Process Termination

This Coinminer terminates the following processes if found running in the affected system's memory:

• processes with the following strings in its command:
  
  • {BLOCKED}.moneropool.com
  • {BLOCKED}.t00ls.ru
  • {BLOCKED}.crypto-pool.fr:8080
  • {BLOCKED}.crypto-pool.fr:3333
  • {BLOCKED}bcn@yahoo.com
  • {BLOCKED}hash.com
  • /tmp/a7b104c270
  • {BLOCKED}.crypto-pool.fr:6666
  • {BLOCKED}.crypto-pool.fr:7777
  • {BLOCKED}.crypto-pool.fr:443
  • {BLOCKED}.f2pool.com:8888
  • {BLOCKED}ool.eu
  • xiaoyao
  • xiaoxue
  • stratum
• processes with process name:
  
  • jenkins
  • {digit numbers} -c
  • biosetjenkins
  • Loopback
  • apaceha
  • cryptonight
  • stratum
  • mixnerdx
  • performedl
  • JnKihGjn
  • irqba2anc1
  • irqba5xnc1
  • irqbnc1
  • ir29xc1
  • conns
  • irqbalance
  • crypto-pool
  • minexmr
  • XJnRj
  • mgwsl
  • pythno
  • jweri
  • lx26
  • NXLAi
  • BI5zj
  • askdljlqw
  • minerd
  • minergate
  • Guard.sh
  • ysaydh
  • bonns
  • donns
  • kxjd
  • Duck.sh
  • bonn.sh
  • conn.sh
  • kworker34
  • kw.sh
  • pro.sh
  • polkitd
  • acpid
  • icb5o
  • nopxi
  • irqbalanc1
  • minerd
  • i586
  • gddr
  • mstxmr
  • ddg.2011
  • wnTKYg
  • deamon
  • disk_genius
  • sourplum
  • polkitd
  • nanoWatch
  • zigw
• processes found in /tmp or with more than 40% cpu usage and does not contain any of the following in its command line:
  
  • devtool
  • update.sh
  • systemctI

Download Routine

This Coinminer accesses the following websites to download files:

• http://{BLOCKED}.{BLOCKED}.70.143:8506/IOFoqIgyC0zmf2UR/config.json

It connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}.{BLOCKED}.70.143:8506/IOFoqIgyC0zmf2UR/devtool
• http://{BLOCKED}.{BLOCKED}.70.143:8506/IOFoqIgyC0zmf2UR/update.sh
• http://{BLOCKED}.{BLOCKED}.70.143:8506/IOFoqIgyC0zmf2UR/systemctI

It saves the files it downloads using the following names:

• /etc/config.json or /tmp/config.json -> config for Coinminer.Linux.MALXMR.UWEIS
• /etc/devtool or /tmp/devtool -> detected as Coinminer.Linux.MALXMR.UWEIS
• /etc/systemctI or /tmp/systemctI -> detected as Trojan.Linux.GOSCAN.AA

Other Details

This Coinminer does the following:

• Add a specific authorized keys to root account
• Empties out the following files:
  
  • /var/spool/mail/root
  • /var/log/wtmp
  • /var/log/secure
  • /root/.bash_history
• Creates a user or root crontab to enable automatic execution of /etc/update.sh or /tmp/update.sh every 10 minutes:
  
  • /usr/bin/crontab
  • /var/spool/cron/{user}
  • crontab content: */10 * * * * sh (/etc/update.sh or /tmp/update.sh) >/dev/null 2>&1
• disables SELINUX
• Clear PageCaches
• Renames the following files:
  
  • /usr/bin/wgen to /usr/bin/get
  • /usr/bin/curl to /usr/bin/url
• Deletes crontab of current user
• Sets the following files to be immutable:
  
  • /etc/devtool* or /tmp/devtool*
  • /etc/config.json* or /tmp/config.json*
  • /etc/update.sh* or /tmp/update.sh*
  • /root/.ssh/authorized_keys*
  • /etc/systemctI or /tmp/systemctI*
• Prevents TCP packets which uses the following ports from going out:
  
  • 3333
  • 5555
  • 7777
  • 9999