ADB.Miner: More Information
<!--kg-card-begin: markdown--><p>This blog is a joint effort of <a href="http://blogs.360.cn/360mobile/">360 Beaconlab</a>, <a href="https://cert.360.cn">360 CERT</a>, <a href="http://shouji.360.cn/">360 MobileSafe</a>, <a href="https://twitter.com/360Netlab">360Netlab</a> and <a href="http://ti.360.net">360 Threat Intelligence Center</a>.</p>
<h2 id="overview">Overview</h2>
<p>About 48 hours ago, we reported an Android worm ADB.miner in our <a href="__GHOST_URL__/early-warning-adb-miner-a-mining-botnet-utilizing-android-adb-is-now-rapidly-spreading-en/">previous blog</a>. This malware can replicate itself over Android devices by utilizing the opened ADB debugging interface. The spreading speed is quite fast, doubles about every 12 hours.</p>
<p>Over the last 48 hours, we did more investigation on ADB.Miner. For now we have conclusions here for security community's reference:</p>
<ol>
<li>
<p><strong>Infected population has stabilized currently</strong>: Since 2018-02-05 15:00, the daily active infected ip addresses reached the peak at 7,000, and remained stable for last 24 hours.</p>
</li>
<li>
<p><strong>TV Boxes contribute part of the infected devices</strong>: All the infected devices are confirmed android based. Further analysis confirmed that part of them are TV boxes, but other devices are yet to be determined.</p>
</li>
<li>
<p><strong>We rule out the possibility of remotely enabling the ADB debugging interface</strong> analysis. The 5555 adb interfaces of those devices have already been opened before infected. We have no idea about how and when this port was opened yet.</p>
</li>
</ol>
<p>Most of the victims come from China(39%, including Hong Kong and Taiwan) and Korea (39%):</p>
<p><img src="__GHOST_URL__/content/images/2018/02/infected_device_distribute.png" alt="" loading="lazy"></p>
<h2 id="sampleanalysis">Sample Analysis</h2>
<p>We captured 9 samples in total, and their core functions are worm like propagation and mining.</p>
<ul>
<li><strong>Worm infection</strong>: Infected device will initiate port scan on TCP 5555 adb interface, and attempt to execute ADB command to copy itself to newly infected machines.</li>
<li><strong>XMR Mining</strong>: It will dig XMR tokens after infection.</li>
</ul>
<p>In addition, this worm borrows code from Mirai's syn scanning module for efficiency.</p>
<p>The worm does not have a Command and Control server and gains all income through a single wallet address.</p>
<p>The details of sample files are as follows:</p>
<p><img src="__GHOST_URL__/content/images/2018/02/IOC_en-1.jpg" alt="" loading="lazy"></p>
<h4 id="sssmainbody">SSS - Main body</h4>
<p>SSS is the main body. After it is uploaded and called by <code>droidbot</code> through <code>nohup /data/local/tmp/sss</code>, it reads <code>bot.dat</code> and releases <code>droidbot</code>,<code>invoke.sh</code>, <code>ddexe</code>, <code>debuggerd</code> and <code>install-recovery.sh</code> to current directory. Then it will invoke the newly released <code>droidbot</code> to spread itself.</p>
<p><img src="__GHOST_URL__/content/images/2018/02/sss_main_run.jpg" alt="" loading="lazy"></p>
<h4 id="invokeshforpersistence">Invoke.sh - For Persistence</h4>
<p><code>invoke.sh</code> persists the running of <code>droidbot</code> through replacing system programs. The replaced programs will launch droidbot additionally when executed. The three replaced files are:</p>
<ul>
<li>If /system/bin/ddexe exists, replace it with the released ddexe script</li>
<li>If /system/bin/debuggerd exists, replace with the released debuggerd script;</li>
<li>If /system/etc/install-recovery.sh exists, replace with the released install-recovery.sh script</li>
</ul>
<p><img src="__GHOST_URL__/content/images/2018/02/invoke_sh_code.jpg" alt="" loading="lazy"></p>
<h4 id="droidbotforwormpropagation">Droidbot - For Worm Propagation</h4>
<p>The worm's <strong>propagation is implemented through droidbot</strong>. When it discovers those devices with port 5555 adb enabled, it will implant all the samples from local to the victim, through commands such as the <code>adb connect/adb push/adb shell</code>. Here is the screenshot:</p>
<p><img src="__GHOST_URL__/content/images/2018/02/adbminer_adbshell_1.jpg" alt="adb command prefix" loading="lazy"></p>
<p><img src="__GHOST_URL__/content/images/2018/02/adbminer_adbshell_2.jpg" alt="adb command parameters" loading="lazy"></p>
<p>The scan module <strong>borrows source code from Mirai</strong>:</p>
<ol>
<li>
<p><strong>Mirai SYN Scan module</strong> is found inside this module to accelerate the port 5555 scan. The following figure highlights the code that constructs a random IP with a target port 5555.</p>
</li>
<li>
<p>The <strong>code structure</strong> is also similar to Mirai.</p>
</li>
<li>
<p>This module also contains <strong>Mirai string tables</strong>, which are weak passwords encrypted by Mirai's default key 0xdeadbeef. However, these weak passwords are <strong>NOT</strong> used in this worm.</p>
</li>
</ol>
<p><img src="__GHOST_URL__/content/images/2018/02/mirai_code_1.jpg" alt="" loading="lazy"></p>
<p><img src="__GHOST_URL__/content/images/2018/02/mirai_code_2.jpg" alt="" loading="lazy"></p>
<h4 id="xmrig32xmrig64configjsonforminingandtheconfigurations">Xmrig32/xmrig64/config.json - For Mining and the Configurations</h4>
<p>Two Xmrig samples are for XMR Mining.</p>
<p>The mining configuration is provided by the config.json file, as follows:</p>
<p><img src="__GHOST_URL__/content/images/2018/02/config_json_screen.jpg" alt="" loading="lazy"></p>
<p>The mining pools are</p>
<ul>
<li>pool.minexmr.com:7777</li>
<li>pool.monero.hashvault.pro:5555</li>
</ul>
<p>And the wallet address:</p>
<ul>
<li>44XT4KvmobTQfeWa6PCQF5RDosr2MLWm43AsaE3o5iNRXXTfDbYk2VPHTVedTQHZyfXNzMn8YYF2466d3FSDT7gJS8gdHAr</li>
</ul>
<h4 id="droidbotapkanotherminingsamplebasedoncoinhive">DROIDBOT.APK - Another Mining Sample Based on Coinhive</h4>
<p>This sample is a apk file running in the Android environment. Its core function is using webview to load a local HTML page, which contains coinhive script to dig XMR tokens, as shown in the following two figures:</p>
<p><img src="__GHOST_URL__/content/images/2018/02/adbminer_webview_1.jpg" alt="Loading local HTML pages with WebView" loading="lazy"></p>
<p><img src="__GHOST_URL__/content/images/2018/02/adbminer_webview_2.jpg" alt="The loaded Web page will invoke the Coinhive script to dig mine" loading="lazy"></p>
<h2 id="ioc">IoC</h2>
<pre><code>bc84e86f8090f935e0f1fc04b04455c6	bot.dat
cd37d59f2aac9101715b28f2b28b7417	botsuinit_1_1.txt
27c3e74b6ddf175c3827900fe06d63b3	config.json
412874e10fe6d7295ad7eb210da352a1	droidbot
914082a04d6db5084a963e9f70fb4276	droidbot.apk
9a10ba1d64a02ee308cd6479959d2db2	nohup
6a22c94d6e2a18acf2377c994d0186af	sss
ac344c3accbbc4ee14db0e18f81c2c0d	xmrig32
cc7775f1682d12ba4edb161824e5a0e4	xmrig64
</code></pre>
<!--kg-card-end: markdown-->
This blog is a joint effort of 360 Beaconlab, 360 CERT, 360 MobileSafe, 360Netlab and 360 Threat Intelligence Center.



Overview


About 48 hours ago, we reported an Android worm ADB.miner in our previous blog. This malware can replicate itself over Android devices by utilizing the opened ADB debugging interface. The spreading speed is quite fast, doubles about every 12 hours.


Over the last 48 hours, we did more investigation on ADB.Miner. For now we have conclusions here for security community's reference:


 1. 
    
    
    Infected population has stabilized currently: Since 2018-02-05 15:00, the daily active infected ip addresses reached the peak at 7,000, and remained stable for last 24 hours.
    

 2. 
    
    
    TV Boxes contribute part of the infected devices: All the infected devices are confirmed android based. Further analysis confirmed that part of them are TV boxes, but other devices are yet to be determined.
    

 3. 
    
    
    We rule out the possibility of remotely enabling the ADB debugging interface analysis. The 5555 adb interfaces of those devices have already been opened before infected. We have no idea about how and when this port was opened yet.
    


Most of the victims come from China(39%, including Hong Kong and Taiwan) and Korea (39%):






Sample Analysis


We captured 9 samples in total, and their core functions are worm like propagation and mining.


 * Worm infection: Infected device will initiate port scan on TCP 5555 adb interface, and attempt to execute ADB command to copy itself to newly infected machines.
 * XMR Mining: It will dig XMR tokens after infection.


In addition, this worm borrows code from Mirai's syn scanning module for efficiency.


The worm does not have a Command and Control server and gains all income through a single wallet address.


The details of sample files are as follows:





SSS - Main body


SSS is the main body. After it is uploaded and called by droidbot through nohup /data/local/tmp/sss, it reads bot.dat and releases droidbot,invoke.sh, ddexe, debuggerd and install-recovery.sh to current directory. Then it will invoke the newly released droidbot to spread itself.





Invoke.sh - For Persistence


invoke.sh persists the running of droidbot through replacing system programs. The replaced programs will launch droidbot additionally when executed. The three replaced files are:


 * If /system/bin/ddexe exists, replace it with the released ddexe script
 * If /system/bin/debuggerd exists, replace with the released debuggerd script;
 * If /system/etc/install-recovery.sh exists, replace with the released install-recovery.sh script





Droidbot - For Worm Propagation


The worm's propagation is implemented through droidbot. When it discovers those devices with port 5555 adb enabled, it will implant all the samples from local to the victim, through commands such as the adb connect/adb push/adb shell. Here is the screenshot:








The scan module borrows source code from Mirai:


 1. 
    
    
    Mirai SYN Scan module is found inside this module to accelerate the port 5555 scan. The following figure highlights the code that constructs a random IP with a target port 5555.
    

 2. 
    
    
    The code structure is also similar to Mirai.
    

 3. 
    
    
    This module also contains Mirai string tables, which are weak passwords encrypted by Mirai's default key 0xdeadbeef. However, these weak passwords are NOT used in this worm.
    








Xmrig32/xmrig64/config.json - For Mining and the Configurations


Two Xmrig samples are for XMR Mining.


The mining configuration is provided by the config.json file, as follows:





The mining pools are


 * pool.minexmr.com:7777
 * pool.monero.hashvault.pro:5555


And the wallet address:


 * 44XT4KvmobTQfeWa6PCQF5RDosr2MLWm43AsaE3o5iNRXXTfDbYk2VPHTVedTQHZyfXNzMn8YYF2466d3FSDT7gJS8gdHAr


DROIDBOT.APK - Another Mining Sample Based on Coinhive


This sample is a apk file running in the Android environment. Its core function is using webview to load a local HTML page, which contains coinhive script to dig XMR tokens, as shown in the following two figures:









IoC


bc84e86f8090f935e0f1fc04b04455c6	bot.dat
cd37d59f2aac9101715b28f2b28b7417	botsuinit_1_1.txt
27c3e74b6ddf175c3827900fe06d63b3	config.json
412874e10fe6d7295ad7eb210da352a1	droidbot
914082a04d6db5084a963e9f70fb4276	droidbot.apk
9a10ba1d64a02ee308cd6479959d2db2	nohup
6a22c94d6e2a18acf2377c994d0186af	sss
ac344c3accbbc4ee14db0e18f81c2c0d	xmrig32
cc7775f1682d12ba4edb161824e5a0e4	xmrig64


{"version":"0.3.1","markups":[],"atoms":[],"cards":[["markdown",{"cardName":"card-markdown","markdown":"This blog is a joint effort of [360 Beaconlab](http://blogs.360.cn/360mobile/), [360 CERT](https://cert.360.cn), [360 MobileSafe](http://shouji.360.cn/), [360Netlab](https://twitter.com/360Netlab) and [360 Threat Intelligence Center](http://ti.360.net).\n\n## Overview\n\nAbout 48 hours ago, we reported an Android worm ADB.miner in our [previous blog](__GHOST_URL__/early-warning-adb-miner-a-mining-botnet-utilizing-android-adb-is-now-rapidly-spreading-en/). This malware can replicate itself over Android devices by utilizing the opened ADB debugging interface. The spreading speed is quite fast, doubles about every 12 hours.\n\nOver the last 48 hours, we did more investigation on ADB.Miner. For now we have conclusions here for security community's reference:\n\n\n 1. **Infected population has stabilized currently**: Since 2018-02-05 15:00, the daily active infected ip addresses reached the peak at 7,000, and remained stable for last 24 hours. \n\n 2. **TV Boxes contribute part of the infected devices**: All the infected devices are confirmed android based. Further analysis confirmed that part of them are TV boxes, but other devices are yet to be determined.\n\n 3. **We rule out the possibility of remotely enabling the ADB debugging interface** analysis. The 5555 adb interfaces of those devices have already been opened before infected. We have no idea about how and when this port was opened yet.\n\n\nMost of the victims come from China(39%, including Hong Kong and Taiwan) and Korea (39%):\n\n![](__GHOST_URL__/content/images/2018/02/infected_device_distribute.png)\n\n## Sample Analysis\n\nWe captured 9 samples in total, and their core functions are worm like propagation and mining.\n\n - **Worm infection**: Infected device will initiate port scan on TCP 5555 adb interface, and attempt to execute ADB command to copy itself to newly infected machines.\n - **XMR Mining**: It will dig XMR tokens after infection.\n\nIn addition, this worm borrows code from Mirai's syn scanning module for efficiency.\n\nThe worm does not have a Command and Control server and gains all income through a single wallet address. \n\nThe details of sample files are as follows:\n\n![](__GHOST_URL__/content/images/2018/02/IOC_en-1.jpg)\n\n\n#### SSS - Main body\n\nSSS is the main body. After it is uploaded and called by `droidbot` through `nohup /data/local/tmp/sss`, it reads `bot.dat` and releases `droidbot`,`invoke.sh`, `ddexe`, `debuggerd` and `install-recovery.sh` to current directory. Then it will invoke the newly released `droidbot` to spread itself.\n\n\n![](__GHOST_URL__/content/images/2018/02/sss_main_run.jpg)\n\n#### Invoke.sh - For Persistence\n\n\n`invoke.sh` persists the running of `droidbot` through replacing system programs. The replaced programs will launch droidbot additionally when executed. The three replaced files are:\n\n\n* If /system/bin/ddexe exists, replace it with the released ddexe script\n* If /system/bin/debuggerd exists, replace with the released debuggerd script;\n* If /system/etc/install-recovery.sh exists, replace with the released install-recovery.sh script\n\n![](__GHOST_URL__/content/images/2018/02/invoke_sh_code.jpg)\n\n#### Droidbot - For Worm Propagation\n\nThe worm's **propagation is implemented through droidbot**. When it discovers those devices with port 5555 adb enabled, it will implant all the samples from local to the victim, through commands such as the `adb connect/adb push/adb shell`. Here is the screenshot:\n\n \n![adb command prefix](__GHOST_URL__/content/images/2018/02/adbminer_adbshell_1.jpg)\n\n \n![adb command parameters](__GHOST_URL__/content/images/2018/02/adbminer_adbshell_2.jpg)\n\nThe scan module **borrows source code from Mirai**:\n\n1. **Mirai SYN Scan module** is found inside this module to accelerate the port 5555 scan. The following figure highlights the code that constructs a random IP with a target port 5555. \n\n2. The **code structure** is also similar to Mirai.\n\n3. This module also contains **Mirai string tables**, which are weak passwords encrypted by Mirai's default key 0xdeadbeef. However, these weak passwords are **NOT** used in this worm.\n\n![](__GHOST_URL__/content/images/2018/02/mirai_code_1.jpg)\n\n![](__GHOST_URL__/content/images/2018/02/mirai_code_2.jpg)\n \n#### Xmrig32/xmrig64/config.json - For Mining and the Configurations\n\nTwo Xmrig samples are for XMR Mining.\n\nThe mining configuration is provided by the config.json file, as follows:\n\n![](__GHOST_URL__/content/images/2018/02/config_json_screen.jpg)\n\nThe mining pools are\n\n* pool.minexmr.com:7777  \n* pool.monero.hashvault.pro:5555\n\nAnd the wallet address:\n\n* 44XT4KvmobTQfeWa6PCQF5RDosr2MLWm43AsaE3o5iNRXXTfDbYk2VPHTVedTQHZyfXNzMn8YYF2466d3FSDT7gJS8gdHAr\n\n#### DROIDBOT.APK - Another Mining Sample Based on Coinhive \n\nThis sample is a apk file running in the Android environment. Its core function is using webview to load a local HTML page, which contains coinhive script to dig XMR tokens, as shown in the following two figures:\n\n\n![Loading local HTML pages with WebView](__GHOST_URL__/content/images/2018/02/adbminer_webview_1.jpg)\n\n\n![The loaded Web page will invoke the Coinhive script to dig mine](__GHOST_URL__/content/images/2018/02/adbminer_webview_2.jpg)\n\n## IoC\n```\nbc84e86f8090f935e0f1fc04b04455c6\tbot.dat\ncd37d59f2aac9101715b28f2b28b7417\tbotsuinit_1_1.txt\n27c3e74b6ddf175c3827900fe06d63b3\tconfig.json\n412874e10fe6d7295ad7eb210da352a1\tdroidbot\n914082a04d6db5084a963e9f70fb4276\tdroidbot.apk\n9a10ba1d64a02ee308cd6479959d2db2\tnohup\n6a22c94d6e2a18acf2377c994d0186af\tsss\nac344c3accbbc4ee14db0e18f81c2c0d\txmrig32\ncc7775f1682d12ba4edb161824e5a0e4\txmrig64\n```"}]],"sections":[[10,0]],"ghostVersion":"3.0"}