Coinminer.Linux.KINSING.A

This Coinminer arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information. It uses the system's central processing unit (CPU) and/or graphical processing unit (GPU) resources to mine cryptocurrency.

Arrival Details

This Coinminer arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Coinminer drops and executes the following files:

• /tmp/salt-minions

Process Termination

This Coinminer terminates the following processes if found running in the affected system's memory:

• salt-minions

Other Details

This Coinminer connects to the following website to send and receive information:

• {BLOCKED}.{BLOCKED}.87.231
• {BLOCKED}.{BLOCKED}.153.85
• {BLOCKED}.{BLOCKED}.123.206
• {BLOCKED}.{BLOCKED}.178.195
• {BLOCKED}.{BLOCKED}.129.111
• {BLOCKED}.{BLOCKED}.152.69
• {BLOCKED}.{BLOCKED}.201.62

It does the following:

• It reads the following system info:
  • Product Name
  • Product Version
  • Product Serial
  • Product UUID
  • Board Vendor
  • Board Name
  • Board Version
  • Board Serial
  • Board Asset Tag
  • Chassis Vendor
  • Chassis Type
  • Chassis Version
  • Chassis Serial
  • Chassis Asset Tag
  • Bios Vendor
  • Bios Version
  • Bios Date
  • Sys Vendor
  • Kernel Version
  
  
• Reads the following information from /sys:
  • /sys/devices/system/cpu/possible
  • /sys/fs/cgroup/cpuset//cpuset.cpus
  • /sys/fs/cgroup/cpuset//cpuset/mems
  • /sys/devices/system/cpu/online
  • /sys/bus/cpu/devices/cpu{0-4}/topology/package_cpus
  • /sys/bus/cpu/devices/cpu{0-4}/topology/core_cpus
  • /sys/bus/cpu/devices/cpu{0-4}/topology/thread_siblings
  • /sys/bus/node/devices/node{0-4}/cpumap
  • /sys/bus/cpu/devices
  • /sys/bus/cpu/devices/cpu{0-4}/topology
  • /sys/bus/cpu/devices/cpu{0-4}/topology/core_siblings
  • /sys/bus/cpu/devices/cpu{0-4}/online
  • /sys/bus/cpu/devices/cpu{0-4}/topology/physical_package_id
  • /sys/bus/cpu/devices/cpu{0-4}/topology/die_cpu
  • /sys/bus/cpu/devices/cpu{0-4}/topology/core_id
  • /sys/bus/cpu/devices/cpu{0-4}/topology/book_siblings
  • /sys/bus/cpu/devices/cpu{0-4}/cache/Index{0-4}/level
  • /sys/bus/cpu/devices/cpu{0-4}/cache/Index{0-4}/size
  • /sys/bus/cpu/devices/cpu{0-4}/cache/Index{0-4}/coherency_line_size
  • /sys/bus/cpu/devices/cpu{0-4}/cache/Index{0-4}/number_of_sets
  • /sys/bus/cpu/devices/cpu{0-4}/cache/Index{0-4}/physical_line_partition
  • /sys/bus/cpu/devices/cpu{0-4}/cache/Index{0-4}/shared_cpu_map
  • /sys/bus/cpu/devices/cpu{0-4}/cache/Index{0-4}/type
  • /sys/kernel/mm/hugepages
  • /sys/bus/node/devices
  • /sys/bus/node/devices/node{0-4}/hugepages
  
  
• Reads the following information from /proc:
  • /proc/cpuinfo
  • /proc/self/cgroup
  • /proc/mounts
  • /proc/meminfo

It uses the system's central processing unit (CPU) and/or graphical processing unit (GPU) resources to mine cryptocurrency. This behavior makes the system run abnormally slow.