# Copyright (c) 2014-2022 Maltrail developers (https://github.com/stamparm/maltrail/) # See the file 'LICENSE' for copying permission # Reference: https://www.virustotal.com/en/file/0687cd8d38c334a970b81b1ba9bb2e18aa66424edba3f33b61f7d03e35d5db20/analysis/ # Reference: https://isc.sans.edu/forums/diary/Crypto+Mining+Is+More+Popular+Than+Ever/24050 # Reference: https://www.alibabacloud.com/blog/jbossminer-mining-malware-analysis_593804 # Reference: https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html # Reference: https://unit42.paloaltonetworks.com/malware-used-by-rocke-group-evolves-to-evade-detection-by-cloud-security-products/ 3g2upl4pq6kufc4m.tk a.ssvs.space aybc.so blockbitcoin.com d3goboxon32grk2l.tk d20blzxlz9ydha.cloudfront.net dazqc4f140wtl.cloudfront.net dwn.rundll32.ml enjoytopic.tk realtimenews.tk sydwzl.cn # Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/linux-coin-miner-copied-scripts-from-korkerds-removes-all-other-malware-and-miners/ drnfbu.xyz yxarsh.shop # Reference: https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang # Reference: https://otx.alienvault.com/pulse/5c8bff7c52e568275bf09e0b sowcar.com w2wz.com # Generic link path signs for sh-loaders of ELF-coinminer /bonn.sh /conn.sh /Duck.sh /kw.sh /lower.sh /lowerv2.sh /lowerv3.sh /pro.sh /r88.sh /root.sh /rootv2.sh /rootv3.sh # Reference: https://twitter.com/bad_packets/status/1106094104520253441 # Reference: https://www.virustotal.com/#/file/5c1439c0db107cb5f3a9b9c239652b26935a2badaf1d840812702267290ebcac/detection /a_thk.sh # Reference: https://twitter.com/SugitaMuchi/status/1075352914221121537 103.55.13.68:13333 # Reference: https://twitter.com/bad_packets/status/1123473023313616896 45.67.14.152:1337 # Reference: https://twitter.com/liuya0904/status/1135901420958281729 # Reference: https://pastebin.com/5Ee4Xevs 220.194.237.43:43768 w.21-3n.xyz w.3ei.xyz w.lazer-n.com # Reference: https://otx.alienvault.com/pulse/5d0773672ba7e7853c4ad5cf 51.15.56.161:443 51.38.133.232:80 51.38.133.232:201 http://107.173.102.59 http://107.174.47.156 http://107.174.47.181 http://51.15.56.161 # Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/cryptocurrency-mining-botnet-arrives-through-adb-and-spreads-through-ssh/ 198.98.51.104:282 # Reference: https://twitter.com/KernelD0wn/status/1144379473585983493 http://112.216.100.210 # Reference: https://twitter.com/bad_packets/status/1151785688360075264 http://185.181.10.234 # Reference: https://www.alibabacloud.com/blog/return-of-watchbog-exploiting-jenkins-cve-2018-1000861_594798 # Reference: https://otx.alienvault.com/pulse/5d35958a9983df3a51f1a3b9 # Reference: https://blog.talosintelligence.com/2019/09/watchbog-patching.html # Reference: https://otx.alienvault.com/pulse/5d794c4a25c9e790d1f66f01 http://45.55.211.79 z5r6anrjbcasuikp.onion.to aziplcr72qjhzvin.onion.to # Reference: https://otx.alienvault.com/pulse/5d44442ef2bd636085171214 # Reference: https://unit42.paloaltonetworks.com/rockein-the-netflow/ # Reference: https://otx.alienvault.com/pulse/5db2e2a517e95c5c22817055 # Reference: https://www.anomali.com/blog/illicit-cryptomining-threat-actor-rocke-changes-tactics-now-more-difficult-to-detect z9ls.com gwjyhs.com heheda.tk systemten.org sowcar.com baocangwh.cn cloudappconfig.com w2wz.cn iap5u1rbety6vifaxsi9vovnc9jjay2l.com # Reference: https://twitter.com/28bit/status/1159906315642253312 http://96.32.50.131 http://188.192.40.43 /racks_s # Reference: https://habr.com/ru/company/pt/blog/466877/ (Russian) http://107.174.47.156 http://154.16.67.135 http://154.16.67.136 # Reference: https://blog.sucuri.net/2019/10/cryptominers-backdoors-found-in-fake-plugins.html xfer.abcxyz.stream # Reference: https://www.virustotal.com/gui/file/2d9fb5ea6356fba9734673ba4ed1653ff7e887875cc3bfc9da7669c80a53a93b/detection # Reference: https://twitter.com/luc4m/status/1202311106187821056 (Note: not perl ircbot) # Reference: https://yoroi.company/research/outlaw-is-back-a-new-crypto-botnet-targets-european-organizations/ # Reference: https://otx.alienvault.com/pulse/5eb984d90091572e80b24197 45.9.148.125:80 45.9.148.125:443 45.9.148.129:80 45.9.148.129:443 debian-package.center # Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/outlaw-updates-kit-to-kill-older-miner-versions-targets-more-systems/ # Reference: https://otx.alienvault.com/pulse/5e42eb027242294dd0f82358 104.236.192.6:80 159.203.141.208:80 minpop.com/sk12pack/idents.php minpop.com/sk12pack/names.php # Reference: https://unit42.paloaltonetworks.com/los-zetas-from-eleethub-botnet/ # Reference: https://otx.alienvault.com/pulse/5ec4066fef9efdf091b20025 # Reference: https://www.virustotal.com/gui/file/14c351d76c4e1866bca30d65e0538d94df19b0b3927437bda653b7a73bd36358/detection # Reference: https://www.virustotal.com/gui/file/9ae6fba4d9359a85984377dc9795de422bd9fbfa41558372ba8be9d5b9c9aa14/detection 62.210.119.142:80 62.210.119.142:4444 eleethub.com # Reference: https://unit42.paloaltonetworks.com/cryptojacking-docker-images-for-mining-monero/ # Reference: https://otx.alienvault.com/pulse/5ef4b1a819214546dc8ef774 144.202.23.108:4444 155.138.227.135:442 155.138.234.122:442 66.42.53.57:442 66.42.93.164:442 5pwcq42aa42fjzel.onion 73avhutb24chfsh6.onion # Reference: https://twitter.com/IntezerLabs/status/1300757052940263425 http://195.226.222.209 34.235.65.248:443 cdn.interakt.md # Reference: https://www.trendmicro.com/en_us/research/20/i/exposed-docker-server-abused-to-drop-cryptominer-ddos-bot-.html # Reference: https://otx.alienvault.com/pulse/5f622709681c2f7c568f13f4 http://104.244.75.25 http://107.189.11.170 http://205.185.113.151 c4k.xpl.pwndns.pw # Reference: https://securelist.com/miner-xmrig/99151/ # Reference: https://otx.alienvault.com/pulse/5f91a968694f84319b78938c 2fsdfsdgvsdvzxcwwef-defender.xyz sihost.xyz srhost.xyz svchost.xyz # Reference: https://twitter.com/VessOnSecurity/status/1325090726187851777 # Reference: https://www.virustotal.com/gui/file/e2a4507f53247b0b4ca2040dd637118538fafd59cb47a186798a858fd43a7fb8/detection http://103.125.218.107 global.bitmex.com.de/b2f627fff19fda/ # Reference: https://twitter.com/IntezerLabs/status/1334147151329435650 # Reference: https://www.virustotal.com/gui/file/876881f4c658ce8525f54e0eb06bfc8721f238878c3ff3e7f8387d7f84e13150/detection hellomeyou.cyou json.hellomeyou.cyou # Reference: https://twitter.com/r3dbU7z/status/1338245237517520898 # Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/exposed-redis-instances-abused-for-remote-code-execution-cryptocurrency-mining/ # Reference: https://www.virustotal.com/gui/file/ea55a206f7047f54a9e97cc3234848dfd3e49d0b5f9569b08545f1ad0e733286/detection # Reference: https://www.virustotal.com/gui/file/3c7faf7512565d86b1ec4fe2810b2006b75c3476b4a5b955f0141d9a1c237d38/detection http://178.157.91.26 http://45.137.151.106 178.157.91.26:1433 178.157.91.26:6379 178.157.91.26:6380 178.157.91.26:7001 178.157.91.26:7002 178.157.91.26:8080 178.157.91.26:8088 178.157.91.26:9200 /hrh8rjmb95n8t7t/ # Reference: https://www.virustotal.com/gui/file/969094571f6fcfd22238fe3163b7742a13402357961cda66acb3f192edd2d25b/detection tyz2020.top # Reference: https://twitter.com/r3dbU7z/status/1362716682507210755 http://47.114.157.117 # Reference: https://www.virustotal.com/gui/file/e1d7014b84618cd7fbf94439c78fe7d67f351cbc5536885fa3d94ea15325d83b/detection http://199.19.226.117 # Reference: https://twitter.com/r3dbU7z/status/1366886386985545728 http://34.107.61.31 # Reference: https://twitter.com/xuy1202/status/1371307049221382147 zzhreceive.anondns.net # Reference: https://twitter.com/r3dbU7z/status/1406295518213517320 # Reference: https://twitter.com/r3dbU7z/status/1406298605712031751 http://104.236.13.229 http://174.138.117.79 # Reference: https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/ http://129.226.180.53 # Reference: https://twitter.com/BushidoToken/status/1479400276859801603 # Reference: https://cystack.net/research/the-attack-on-onus-a-real-life-case-of-the-log4shell-vulnerability # Reference: https://www.virustotal.com/gui/file/d9e6eaeaacb3feb6e32482301f918f19727466e13bc0bef5323a1c86f42a8ca2/detection http://45.147.230.219 45.147.230.219:8001 45.147.230.219:81 # Reference: https://twitter.com/t0001100000/status/1446048755577458694 # Reference: https://www.anomali.com/blog/inside-teamtnts-impressive-arsenal-a-look-into-a-teamtnt-server /chimaeraxmr.c /chimaeraxmr.h /docker.ethminer.sh /my.xmr.sh /Setup_ETH_Miner.sh /Setup_ETH_MinerService.sh /setup_c3pool_miner.sh /setup_moneroocean_miner.sh /Setup_RainBow_Miner.sh /xmrigCC/ /xmrig_setup/ # Reference: https://blog.netlab.360.com/li-yong-namesilo-parkinghe-googlede-zi-ding-yi-ye-mian-lai-chuan-bo-e-yi-ruan-jian/ # Reference: https://otx.alienvault.com/pulse/618cfe9c6d8832f3adde566b gannimachoubi.cyou hvtde6ew5.top # Reference: https://www.virustotal.com/gui/file/ce278388efbe6072bef8fea520946b5b9f4c35e694476c49747164d580e0b28d/detection 195.2.93.34:443 # Generic link path signs for ELF-coinminer /accounts-daemon /askdljlqw /AnXqV.yam /bashf /bashg /BI5zj /bonns /conns /cranberry /cryptonight /crypto-pool /donns /gekoCrw /gekoCrw32 /gekoba2anc1 /gekoba5xnc1 /gekobalanc1 /gekobalance /gekobalanq1 /gekobnc1 /ihhnk /ir29xc1 /jaav /jIuc2ggfCAvYmluL2Jhc2gi /JnKihGjn /jva /KGlJwfWDbCPnvwEJupeivI1FXsSptuyh /kworker /kworker34 /kxjd /lexarbalanc1 /ltcminerd /minerd /minergate /minergate-cli /minerd /mixnerdx /minerd64_s /minexmr /nativesvc /NXLAi /oanacroner /pvv /rig1 /rig2 /servcesa /stratum /sourplum /t0mcat /thisxxs /watch-smart /watch-smartd /xig /xige /XJnRj /xmrig.service /xmrig /xmrig1 /xmrig2 /xmrig_s /xmrig_darwin /xmrig_linux2 /xmrig_win32 /yam /yam32 /ysaydh /zbjnu