警惕挖矿木马入侵丨Rocke Group团伙挖矿变种AliyunMiner分析

01.

背景介绍

客户现场的设备中发生了一起木马中毒事件，有窃取个人资料、破坏系统、建立网络连接等行为。经过分析，该木马的一系列行为特征与Rocke组织的AliyunMiner病毒极为相似，故可将其归为AliyunMiner病毒。

图片1.png

Rocke组织又称Iron组织，又名SystemTen、Kerberods/Khugepageds，最先由思科于2018年8月报道，以在Linux机器上运行加密劫持恶意软件而闻名，并顺利获得修改其工具，改进攻击技术来进行持续攻击。该组织最新使用的恶意软件还能顺利获得代码来卸载Linux服务器上安装的云安全保护和监控软件。

攻击者使用Go语言编写的恶意软件来设置和监视受感染机器并进行挖矿。自2019年3月 Anomali威胁研究团队首次报告以来，“LSD”恶意软件已经进行了一些更新。9月份新版LSD重构后的源代码布局如下（不过现在已经无法访问）：

Packagegithub.com/hippies/LSD/LSDB: /root/go/src/github.com/hippies/LSD/LSDB

File:<autogenerated>

init Lines: 1 to 1 (0)

File: a.go

_kBytes Lines: 15 to 29 (14)

KWR Lines: 29 to 49 (20)

File: b.go

_libBytes Lines: 14 to 21 (7)

LibWrite Lines: 21 to 25 (4)

File: c.go

_netdnsinitBytes Lines: 12 to 19 (7)

_netdnsserviceBytes Lines: 19 to 26 (7)

NetdnsWrite Lines: 26 to 39 (13)

Packagegithub.com/hippies/LSD/LSDA: /root/go/src/github.com/hippies/LSD/LSDA

File:<autogenerated>

init Lines: 1 to 1 (0)

File: a.go

run Lines: 11 to 65 (54)

runtwo Lines: 65 to 77 (12)

Aago Lines: 77 to 87 (10)

Aagofunc1 Lines: 82 to 85 (3)

File: b.go

generateTask Lines: 17 to 29 (12)

cmd Lines: 29 to 59 (30)

cmdfunc1 Lines: 37 to 76 (39)

cmdtwo Lines: 59 to 71 (12)

bgo Lines: 71 to 91 (20)

bgofunc1 Lines: 76 to 79 (3)

Bbgo Lines: 91 to 96 (5)

File: c.go

crun Lines: 13 to 51 (38)

crunfunc1 Lines: 18 to 68 (50)

cruntwo Lines: 51 to 63 (12)

Ccgo Lines: 63 to 73 (10)

Ccgofunc1 Lines: 68 to 71 (3)

File: d.go

exp Lines: 13 to 46 (33)

expfunc1 Lines: 18 to 69 (51)

drun Lines: 46 to 52 (6)

druntwo Lines: 52 to 64 (12)

Ddgo Lines: 64 to 82 (18)

Ddgofunc1 Lines: 69 to 72 (3)

Packagegithub.com/hippies/LSD/LSDC: /root/go/src/github.com/hippies/LSD/LSDC

File:<autogenerated>

init Lines: 1 to 69 (68)

File: a.go

Read Lines: 25 to 45 (20)

Starthttperver Lines: 45 to 91 (46)

Starthttperverfunc1 Lines: 47 to 203 (156)

glob.func1 Lines: 71 to 75 (4)

glob.func2 Lines: 75 to 80 (5)

glob.func3 Lines: 80 to 97 (17)

GetCurrentPath Lines: 91 to 128 (37)

glob.func4 Lines: 97 to 101 (4)

Getcmdnums Lines: 128 to 157 (29)

file2Pid Lines: 157 to 181 (24)

Getmd5nums Lines: 181 to 200 (19)

Downloadfile Lines: 200 to 235 (35)

Downloadfilefunc1 Lines: 203 to 398 (195)

Update Lines: 235 to 293 (58)

Dnstofile Lines: 293 to 308 (15)

CopyFile Lines: 308 to 325 (17)

Mkdir Lines: 325 to 329 (4)

Writefile Lines: 329 to 338 (9)

Writefiletwo Lines: 338 to 366 (28)

Chmod Lines: 366 to 372 (6)

Delfile Lines: 372 to 381 (9)

Changetime Lines: 381 to 389 (8)

Cmdexec Lines: 389 to 395 (6)

Dnsget Lines: 395 to 431 (36)

Dnsgetfunc1 Lines: 398 to 491 (93)

Checkupdate Lines: 431 to 451 (20)

Getcronurl Lines: 451 to 467 (16)

Updatekill Lines: 467 to 488 (21)

getip Lines: 488 to 520 (32)

getipfunc1 Lines: 491 to 496 (5)

getipb Lines: 520 to 535 (15)

Getiplist Lines: 535 to 563 (28)

Cron Lines: 563 to 578 (15)

Bashrc Lines: 578 to 585 (7)

File: b.go

procPidStatSplit Lines: 12 to 61 (49)

readSmallFile Lines: 61 to 74 (13)

readFileLines Lines: 74 to 84 (10)

readUInt Lines: 84 to 92 (8)

getProcessCpu Lines: 92 to 102 (10)

GetProcessCPUPercent Lines: 102 to 111 (9)

Killcpu Lines: 111 to 118 (7)

File: c.go

NewAesCipher128 Lines: 16 to 52 (36)

(*AesCipher128)BlockSize Lines: 52 to 67(15)

(*AesCipher128)Decrypt Lines: 67 to 71 (4)

Package main:/root/go/src/github.com/hippies/LSD

File:<autogenerated>

init Lines: 1 to 1 (0)

File: main.go

attack Lines: 16 to 27 (11)

lsd Lines: 27 to 79 (52)

main Lines: 79 to 95 (16)

主要更改在于C2功能，不再使用 “systemten[.]org”域

而是迁移到了“iap5u1rbety6vifaxsi9vovnc9jjay2l[.]com”

图片2.png

02.

病毒入侵的影响

病毒使用Go语言编写，包含经过修改的UPX壳，使某些恶意软件检测产品更难检测到恶意代码。病毒中还有许多以压缩形式存储在内部的模块，在执行过程中会解密提取并执行。其YARA规则为：

import "elf" rule Modified_UPX_ELF : Misc { meta: author = "@_lubiedo" date ="31-08-2021" description ="Detect possibly modified UPX magic on ELF binaries" strings: $upx_magick = "UPX!" /* entries */ $entry00 = {50 52 E8 ?? ?? ?? ?? 55 53 51 52} // ELF64_AMD $entry01 = { 50 E8} //ELF_i386 $entry02 = { 04 11 ?? ??} //ELF32_MIPSEB, ELF32_MIPSEL $entry03 ={ 18 D0 4D E2 B? } // ELF_ARMEL condition: filesize < 10MB and uint32be(0) ==0x7f454c46 and for any of ($entry*) :( $ at elf.entry_point ) and // search for stub opcodes at entrypoint ( // search for UPX exec format types (not $upx_magick at 0xec anduint16be(filesize - 0x20) == 0x0d16) or // UPX_F_LINUX_ELF64_AMD (not $upx_magick at 0x98 and(uint16be(filesize - 0x20) == 0x0d17 or uint16be(filesize - 0x20) == 0x0d0c))or // UPX_F_LINUX_ELF_i386, UPX_F_LINUX_ELF32_ARMEL (not $upx_magick at 0x78 and(uint16be(filesize - 0x20) == 0x0d89 or uint16be(filesize - 0x20) == 0x0d1e))// UPX_F_LINUX_ELF32_MIPSEB, UPX_F_LINUX_ELF32_MIPSEL ) }

该病毒使用保存的SSH密钥和弱密码感染网络中的其他机器。还利用一些平台和服务中的漏洞，比如jenkins（CVE-2018-1000861、CVE-2019-1003000）、redis和 ActiveMQ（CVE-2016-3088），一旦受害者被感染，就会借此进行传播。

病毒使用了4个LSD包：

1. github.com/hippies/LSD/LSDA，病毒相关配置初始化

图片3.png