Ransom.Linux.XBASH.AC

This Ransomware may be downloaded by other malware/grayware/spyware from remote sites.

Arrival Details

This Ransomware may be downloaded by other malware/grayware/spyware from remote sites.

Stolen Information

This Ransomware sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}ift.censys.xyz/cidir

Other Details

This Ransomware does the following:

• It uses the following list of passwords to bruteforce database servers:
  • test
  • neagrle
  • 123456
  • admin
  • root
  • password
  • 123123
  • 123
  • 1
  • {user}
  • {user}{user}
  • {user}1
  • {user}123
  • {user}2016
  • {user}2015
  • {user}!
  • P@ssw0rd!!
  • qwa123
  • 12345678
  • test
  • 123qwe!@#
  • 123456789
  • 123321
  • 1314520
  • 666666
  • woaini
  • fuckyou
  • 000000
  • 1234567890
  • 8888888
  • qwerty
  • 1qaz2wsx
  • abc123
  • abc123456
  • 1q2w3e4r
  • 123qwe
  • 159357
  • p@ssw0rd
  • p@55w0rd
  • password!
  • p@ssw0rd!
  • password1
  • r00t
  • tomcat
  • apache
  • system'
  • 121212
  • jason
  • admin123
  • goodluck123
  • peaches
  • asdfghjkl
  • wang123456
  • falcon
  • www123
  • 1qazxsw2
  • 112211
  • fuckyou
  • test
  • silver
  • 123456789
  • 234567
  • 1122334455
  • xxxxxx
  • 123321
  • 7788521
  • 123456qaz
  • hunter
  • qwe123
  • 123
  • asdf123
  • password
  • 1q2w3e4r
  • nihao123
  • aaaa1111
  • 123123
  • 147258369
  • a123
  • 123qwe
  • 1234abcd
  • spider
  • qqaazz
  • qwertyuiop
  • 1234qwer
  • 123abc
  • qwer1234
  • mustang
  • 123456
  • 123456a
  • ww123456
  • 1234
  • 123456.com
  • football
  • jessica
  • power
  • q1w2e3r4t5
  • aaa123
  • passw0rd
  • 741852
  • 666666
  • 123465
  • justin
  • !@#$%^&*()
  • 12345
  • 222222
  • qazwsx123
  • 999999
  • abc123
  • tomcat
  • dongdong
  • 654321
  • 111111a
  • q1w2e3
  • dragon
  • 1234560
  • 1234567
  • asd123456
  • secret
  • abc123456
  • master
  • qq123456
  • 1q2w3e
  • playboy
  • P@ssw0rd
  • 123654
  • 88888888
  • 12345678
  • orange
  • rabbit
  • jonathan
  • 000000
  • qwer
  • admin
  • asdfasdf
  • 1234567890
  • 709394
  • 12qwaszx
  • abcd1234
  • pass
  • fuck
  • abc12345
  • qweasdzxc
  • abcdef
  • superman
  • rainbow
  • 11111111111
  • 1
  • 321
  • 888888
  • 1qaz2wsx
  • test
  • 112233
  • qazwsx
  • welcome
  • 4815162342
  • tiger
  • wangyang
  • q1w2e3r4
  • 111111
  • a123456
  • hello
  • 123456654321
• It uses the following usernames for specific database server:
  • mysql:[root]
  • postgresql:[postgres, admin]
  • mongodb:[admin]
  • redis:[null]
• It uses regular expression to scan tcp and udp ports in the database servers
• It uses the following ports for the specific database servers:
  • HTTP: 80, 8080, 8888, 8000, 8001, 8088
  • VNC: 5900, 5901, 5902, 5903
  • MySQL: 3306
  • Memcached: 11211
  • MySQL/MariaDB: 3309, 3308,3360 3306, 3307, 9806, 1433
  • FTP: 21
  • Telnet: 23, 2323
  • PostgreSQL: 5432
  • Redis: 6379, 2379
  • ElasticSearch: 9200
  • MongoDB: 27017
  • RDP: 3389
  • UPnP/SSDP: 1900
  • NTP: 123
  • DNS: 53
  • SNMP: 161
  • LDAP: 389
  • Rexec: 512
  • Rlogin: 513
  • Rsh: 514
  • Rsync: 873
  • Oracle database: 1521
  • CouchDB: 5984
• It uses the following for C2 Communication based on HTTP Protocol:
  • Fetching for a list of IP addresses or domains for scanning a range of IP
  • Fetching for a list of passwords
  • Reports the scan results
• It fetches internet resources using
  • user-agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.2 Safari/537.36
  • url:http://{BLOCKED}ift.censys.xyz/cidir
• This ransomware will do the following commands on the database it has bypassed:
  • DROP DATABASE %s← (This command will delete the database)
  • CREATE DATABASE %s;' % 'PLEASE_READ_ME_XYZ ← (This command will create a blank database)
  • CREATE TABLE WARNING (id INT NOT NULL, PRIMARY KEY(id), warning TEXT, Bitcoin_Address TEXT,Email TEXT); ← (This command will create a blank table in the current database)
  • INSERT INTO PLEASE_READ_ME_XYZ.WARNING (id, warning, Bitcoin_Address, Email) VALUES(1,'Send 0.02 BTC to this address and contact this email with your ip or db_name of your server to recover your database! Your DB is Backed up to our servers!', '1Kss6v4eSUgP4WrYtfYGZGDoRsf74M7CMr', 'backupsql@protonmail.com'); ← (This command will insert the data in the table)