Analysis by: Mohammed Malubay
ALIASES:

a variant of Linux/CoinMiner.AV potentially unwanted application(NOD32);

 PLATFORM:

Linux

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Worm

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

Infection Channel: Downloaded from the Internet, Dropped by other malware

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes then deletes itself afterward.

  TECHNICAL DETAILS

File Size: 4,338,432 bytes
File Type: ELF
Memory Resident: Yes
Initial Samples Received Date: 01 Apr 2021
Payload: Steals information

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm drops the following files:

  • /tmp/.{random characters}/[kthreaddi]
  • /tmp/.{random characters}/config.json

It adds the following processes:

  • [kthreaddi]

It creates the following folders:

  • /tmp/.{random characters}

It executes then deletes itself afterward.

Process Termination

This Worm terminates the following processes if found running in the affected system's memory:

  • apaceha
  • apachiii
  • cpuset
  • crond64
  • cryptonight
  • devtool
  • devtools
  • haveged
  • irqbalanc1
  • jawa
  • kdevtmpfsi
  • kinsing
  • ksoftirqds
  • kthrotlds
  • kworker34
  • kworkerds
  • linux32
  • Loopback
  • miner-cpu
  • miner-notls
  • miner
  • minerd
  • minergate
  • mixnerdx
  • monerohash
  • mstxmr
  • nanoWatch
  • netdns
  • nginxk
  • nqscheduler
  • nullcrew
  • performedl
  • phpguard
  • phpupdate
  • pnscan
  • pythnof
  • redis2
  • solrd
  • sourplum
  • stratum
  • suppoie
  • sustse
  • sustse3
  • svcguard
  • svcupdate
  • svcupdates
  • sysguard
  • sysstats
  • systemctI
  • systemten
  • systemxlv
  • sysupdate
  • vmlinuz
  • voltuned
  • watchbog
  • watchd0g
  • watchdogs
  • xmr-stak

Other Details

This Worm does the following:

  • If the deployment of the coinminer is successful, it would proceed to delete the created folder and its contents ([kthreaddi] and config.json).
  • It uses the following default details on its coin mining routine (from config.json):
    • Algo: rx/0
    • Url: xmr-eu1.nanopool.org:14444
    • User: {BLOCKED}PrDj3KF8fR1BHLBfiVArU6Hu61N9gtrZWgbRptntwht5JUrXX17ZeofwPwC6fXNxPZfGjNEChXttwWE3EGUEa
    • Password: x
  • If exploitation is successful, connects to the following URL to download and execute a malicious file:
    • http://{BLOCKED}.{BLOCKED}.227.21
  • It may use the following exploits to aid its propagation:
    • XXL-JOB unauthorized access
    • WebLogic Unauthorized Access (CVE-2020-14882)
    • ThinkPhp5Rce
    • Hadoop unauthorized access
    • Jupyter unauthorized access
    • Nexus unauthorized access
    • Tomcat unauthorized access
    • WordPress unauthorized access
    • Jenkins RCE
    • CVE-2017-11610
    • CVE-2019-10758
    • CVE-2020-16846
    • CVE-2021-3129
  • It scans the following ports to be used in exploitation and propagation:
    • 80
    • 6379
    • 7001
    • 8080
    • 8081
    • 8088
    • 8090
    • 8888
    • 8983
    • 9001
    • 9999
  • It uses the following credentials to bruteforce a system:
    • Username:
      • admin1234
      • admin@123
      • Admin@123
      • admin
      • Admin123
      • mfgproadmin
      • root
      • test
      • user
      • tomcat
    • Password:
      • 1q2e3e4r
      • 12345678
      • 123456
      • Admin123
      • P@ssw0rd
      • admin123
      • password
      • admin
      • tomcat
      • root
      • test
      • user
      • secret
      • tomcat123
      • oracle
  • It tries to bruteforce the following systems:
    • Wordpress
    • Tomcat
    • Nexus
    • Jupyter
    • Jenkins

  SOLUTION

Minimum Scan Engine: 9.800
FIRST VSAPI PATTERN FILE: 16.634.06
FIRST VSAPI PATTERN DATE: 03 Apr 2021
VSAPI OPR PATTERN File: 16.635.00
VSAPI OPR PATTERN Date: 04 Apr 2021

Step 1

Trend Micro Predictive Machine Learning detects and blocks malware at the first sign of its existence, before it executes on your system. When enabled, your Trend Micro product detects this malware under the following machine learning name:

  • Troj.ELF.TRX.XXELFC1DFF004

Step 2

Scan your computer with your Trend Micro product to delete files detected as Worm.Linux.MALXMR.PUWELX. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:


Did this description help? Tell us how we did.