360 Netlab Blog - Network Security Research Lab at 360
  • Botnet
  • DNSMon
  • DDoS
  • PassiveDNS
  • Mirai
  • DTA

XMR CryptoCurrency

A collection of 2 posts
XMR CryptoCurrency

A New Mining Botnet Blends Its C2s into ngrok Service

Overview These days, it feels like new mining malwares are popping up almost daily and we have pretty much stopped blogging the regular ones so we don’t flood our readers’ feed. With that being said, one did have our attention recently. This botnet hides its C2s(Downloader and Reporter
  • Hui Wang
    Hui Wang
Sep 12, 2018 5 min read
XMR CryptoCurrency

利用ngrok传播样本挖矿

概述 "链治百病,药不能停"。时下各种挖矿软件如雨后春笋层出不穷,想把他们都灭了,那是不可能的,这辈子都不可能的。通常我们都忽略他们。但这个利用ngrok生成大量随机域名作为Downloader和Report域名,对抗安全设施阻断其域名,隐藏真实服务器地址的挖矿恶意样本成功的引起了我们的注意。 该恶意样本的主要特点是: * 使用ngrok定期更换的随机域名作为Downloader和Report域名。 * 利用redis,docker,jenkins,drupal,modx,CouchDB漏洞植入xmr挖矿程序挖矿。 * 企图扫描以太坊客户端,盗取以太币,当前未实际启用。 * 企图感染目标设备上的js文件,植入CoinHive挖矿脚本浏览器挖矿。 * 动态生成挖矿脚本和扫描脚本。 * 该挖矿样本主要模块由Scanner脚本,Miner脚本,Loader构成。Scanner模
  • Hui Wang
    Hui Wang
Sep 11, 2018 6 min read
360 Netlab Blog - Network Security Research Lab at 360 © 2025
Powered by Ghost