{"id":2964,"date":"2024-09-25T20:46:53","date_gmt":"2024-09-25T20:46:53","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=2964"},"modified":"2025-07-29T06:53:51","modified_gmt":"2025-07-29T06:53:51","slug":"new-coin-miner-malware-bashes-the-unsuspecting","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/new-coin-miner-malware-bashes-the-unsuspecting\/","title":{"rendered":"New Coin Miner Malware Bashes The Unsuspecting"},"content":{"rendered":"
\n
\"\"<\/figure>\n<\/div>\n\n\n

Overview<\/strong>

LMNTRIX Labs has reported multiple coin-miner<\/a> infections. In the latest trend, we found a Monero XMR bash script that installs itself as cron job and then downloads a malicious executable.  

Here\u2019s the analysis.

BashScript Coin Miner Malware<\/strong>

LMNTRIX Labs researchers discovered a bash script which downloads the coin mining malware.

MD5: eef5cdda9cc6415e94ecdfe1214e732a

Size: 3.65 KB

File Type: Bash Script

 <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n



Figure 1 VT detection for the coin mining bash script<\/em>

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

 

Figure 2 Malicious link hosting two coin miner files<\/em>

The above picture show the relation between the malicious site which hosts two coin miner files which get downloaded by the bash script (transfer.sh). For downloading the files, the script  uses the wget command to pull the files in the victim server.

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

 

Figure 3 downloading the coin miner files<\/em>

The following Virustotal links of the ‘clay’ is a known Trojan. ‘Minerd’ is, as the name suggests, a crypto miner

https:\/\/www.virustotal.com\/#\/file\/260ef4f1bb0e26915a898745be873373f083227a4f996731f9a3885397a49e79\/detection<\/a>

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

 

Figure 4 CLAY<\/em>

https:\/\/www.virustotal.com\/#\/file\/2d89b48ed09e68b1a228e08fd66508d349303f7dc5a0c26aa5144f69c65ce2f2\/detection<\/a>

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

 

Figure 5 MINERD<\/em>

In order to avoid a dependency error, the bash script follows an order of installing all the required files before downloading the coin miner files.

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

 

Figure 6 to avoid dependency issues – installing all the required programs<\/em>
<\/p>\n\n\n\n

Determining the Core \u2013 It doesn\u2019t need full core for Mining<\/strong>

This bash script checks the availability of the core in the server. And moreover, if the core is greater than four then coin miner will take half of the resources to avoid consuming the full capacity of the server.

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

 

Figure 7 Code to determine and consumption of core

Persistency<\/strong>

Cron jobs are created by the script for downloading the original bash script every five hours. The vital step for incident response is that along with malware, you need to make sure that cron job is also removed. Otherwise, even after the removal of all the mining programs from the infected server this tiny cron job will remain persistent. 

Additional Context: Browser Based Coin Miner 

Most coin mining malware seems to focus on Linux based servers. One of the reasons might be that many Linux servers don\u2019t seem to be guarded with a good AV solution. That said, we have seen infections across Windows machines as well

Apart from this mining malware, there is also coin mining malware now in the market which can execute in any environment. It is referred as Coinhive JS, a JavaScript used in a compromised website to perform coin mining activities. In our earlier research, our team analysed CoinHive JavaScript which actually uses the client\u2019s web browser to perform coin mining activity. In this case, resources consumed by the running process appeared to be in web browser.

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

 

It is worth noting that popular sites like Pirate Bay, Vimshop.win, and showtime have moved away from monetizing with ads in favor of using CoinHive to generate revenue.

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n


<\/p>\n\n\n\n

Precautionary Steps To Take<\/strong>

LMNTRIX LABS recommends blocking the mining pool sites in the proxy and firewall. It is always recommended to keep the anti-malware solutions in the places like Linux servers with security patches up to date. Additionally, monitoring the health check will provide valuable information on resource utilization level in the servers, and will further help administrators find the presence of malware and the root cause.

 <\/p>\n\n\n\n

On 2018-05-01<\/p>\n","protected":false},"excerpt":{"rendered":"

Overview LMNTRIX Labs has reported multiple coin-miner infections. In the latest trend, we found a Monero XMR bash script that installs itself as cron job and then downloads a malicious executable.   Here’s the analysis. BashScript Coin Miner Malware LMNTRIX Labs researchers discovered a bash script which downloads the coin mining malware. MD5: eef5cdda9cc6415e94ecdfe1214e732a Size: […]<\/p>\n","protected":false},"author":1,"featured_media":2985,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[],"class_list":["post-2964","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-labs"],"_links":{"self":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2964","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/comments?post=2964"}],"version-history":[{"count":4,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2964\/revisions"}],"predecessor-version":[{"id":4350,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2964\/revisions\/4350"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media\/2985"}],"wp:attachment":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media?parent=2964"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/categories?post=2964"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/tags?post=2964"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}