Saturday, December 2, 2023

New Linux Coin Miner that Deletes Other Linux Malware and Coin Miners

A new Linux coin miner that is capable of deleting previously installed Linux malware, coin miners and services associated with that including the connection ports.

Security researchers from TrendMicro observed the new coin miner and their scripts are matching to the Xbash features and KORKERDS.

“Noticing the script downloading the binary, we also looked at an analyzed code of KORKERDS modified and collected in November 2018 and found them almost the same except for a few additions and notable omissions.”

Linux coin miner

The new miner doesn’t remove the security products in the system, instead, it kills components if the malware from where the script is copied.

A modified version of the cryptocurrency miner XMR-Stak that supports CPUs, AMD, and NVIDIA GPUs processors to download Cryptonight currencies. The infection starts with an IP camera where the attacker tries to upload a crontab file.

Researchers found the malware performs following three functions.

  • Function B kills previously installed malware
  • Function D downloads the coin miner
  • Function C downloads a script hxxp://yxarsh[.]shop/0 that creates a corntab and calls the script at 1 am.

The miner is capable of implanting themselves in the system root to survive reboots.

“We noted the subtle difference in the absence of the link placed in between the PUT URL /fileserver/vMROB4ZhfLTljleL and the actual crontab. While KORKERDS’ saves the crontab directly, the new script inserts just one crontab that fetches all the code and the miner,” reads Trend Micro report.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Website

Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Booking.com Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles