A new Linux coin miner that is capable of deleting previously installed L
Security researchers from TrendMicro observed the new coin miner and their scripts are matching to the Xbash features and KORKERDS.
“Noticing the script downloading the binary, we also looked at an analyzed code of KORKERDS modified and collected in November 2018 and found them almost the same except for a few additions and notable omissions.”
The new miner doesn’t remove the security products in the system, instead, it kills components if the malware from where the script is copied.
A modified version of the cryptocurrency miner XMR-Stak that supports CPUs, AMD, and NVIDIA GPUs processors to download Cryptonight currencies. The infection starts with an IP camera where the attacker tries to upload a crontab file.
Researchers found the malware performs following three functions.
- Function B kills previously installed malware
- Function D downloads the coin miner
- Function C downloads a script
hxxp ://yxarsh[.]shop/0 that creates acorntab and calls the script at 1 am.
The miner is capable of implanting themselves in the system root to survive reboots.
“We noted the subtle difference in the absence of the link placed in between the PUT URL /fileserver/vMROB4ZhfLTljleL and the actual crontab. While KORKERDS’ saves the crontab directly, the new script inserts just one crontab that fetches all the code and the miner,” reads Trend Micro report.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.
