Rewterz Threat Alert – Black-T; New Cryptojacking Variant from TeamTnT

Severity

Medium

Analysis Summary

Black-T Malware, a new cryptojacking variant from TeamTnT, favors targeting AWS credential files. TeamTnT is a cloud-focused cryptojacking group that often targets AWS credential files on compromised cloud systems to mine for Monero. By September, TeamTnT was able to gain full remote takeover of cloud instances. The researchers found that Black-T includes features not found in the group’s earlier malware, including “targeting and stopping of previously unknown cryptojacking worms – the Crux worm, ntpd miner and a redis-backup miner,”.
Black-T also features memory password scraping using mimipy and mimipenguins, which are *NIX equivalents to the commonly used Windows-specific memory password scraper functionality of Mimikatz. Mimikatz is a tool capable of scraping plaintext passwords from Windows OS systems, and also has the capability to perform pass-the-hash and pass-the-token operations, allowing attackers to hijack user sessions. Any identified passwords which were obtained through mimipenguins are then exfiltrated to a TeamTnT command and control (C2) node. This is the first time TeamTnT actors have been witnessed including this type of post-exploitation operation in their TTPs. The Black-T tool also has the capability to use three different network scanning tools to identify additional exposed Docker daemon APIs, within the local network of the compromised system and across any number of publicly accessible networks, to extend their cryptojacking operations. 

Impact

• Credential Theft
• Remote Takeover
• Unauthorized Access
• Session hijacking

Indicators of Compromise

MD5

• 8007d1507587af220ebaa4fbf4311a72
• df386df8c8a376686f788ceff1216f11
• 48858971bb4f5bcd6a972cbdaabfe9ea
• 8ffdba0c9708f153237aabb7d386d083
• 492ffed6e5cdc872f00a3f8b7cd3e512
• 8ffdba0c9708f153237aabb7d386d083
• 1238baab2e029d86f29fa1e67671a95c
• 3acc4bb5971c31c7544378a448fa8ff0
• 75363103bb838ca8e975d318977c06eb
• a315439d6c1a769f7f751b1744a2a075
• b0dc91d2591c46944976697b3c5b002e
• cdc433224a594395f16fcd637050bff7

SHA-256

• a5dd446b2a7b8cfd6b6fd4047cc2fddfcea3a4865d8069dcd661e422046de2a1
• a506c6cf25de202e6b2bf60fe0236911a6ff8aa33f12a78edad9165ab0851caf
• a5e6b084cdabe9a4557b5ff8b2313db6c3bb4ba424d107474024030115eeaa0f
• 139f393594aabb20543543bd7d3192422b886f58e04a910637b41f14d0cad375
• 9f8cb3f25a8b321b86ee52c16b03b3118f3b157b33e29899d265da3433a02c79
• 139f393594aabb20543543bd7d3192422b886f58e04a910637b41f14d0cad375
• 5b417032a80ddf4d9132a3d7d97027eeb08d9b94b89f5128863930c1967c84c4
• fae2f1399282508a4f01579ad617d9db939d0117e3b2fcfcc48ae4bef59540d9
• 84fabfbbd134bbeeb5481a96b023f44a671382349e5b39928baf0e80e28fd599
• 79b478d9453cb18d2baf4387b65dc01b6a4f66a620fa6348fa8dbb8549a04a20
• 3acfe74cd2567e9cc60cb09bc4d0497b81161075510dd75ef8363f72c49e1789
• 73a956f40d51da737a74c8ad4ecbfab12350621ffc167b5c278cd33ce9e0e0f0

SHA1

• 68d25f6ce7d12be1536ed5933660fe9aa717adec
• b878d4c559855d65a4359341e11e7382f18aeb54
• 9da572c471aa6a6d7265b2a96c233b9c694a756a
• 712390c705335787f2601987746bda98657446d0
• 3a82f6f27aca8d4bfdc3b030d7b7d9c2bf68ade9
• 712390c705335787f2601987746bda98657446d0
• 1adf462605836e65fe494fb518d892b481ac7552
• c9cdefa94375c8c2979614d2999cf0882c7cec69
• 7719e1b7001fd7e704b3da67f84d40ac8c151b84
• 20d201cdf4116adaafc925f53f4fdacb823186fb
• 496c657df343631526f2b9da8cd630ccd351ca70
• f95d22bbfd2cf51227af0f35a8e46170b8ccde79

URL

• hxxps[:]//teamtnt[.]red
• hxxps[:]//teamtnt[.]red/BLACK-T/beta
• hxxps[:]//teamtnt[.]red/BLACK-T/CleanUpThisBox
• hxxps[:]//teamtnt[.]red/BLACK-T/setup/bd
• hxxps[:]//teamtnt[.]red/BLACK-T/setup/docker-update
• hxxps[:]//teamtnt[.]red/BLACK-T/setup/hole
• hxxps[:]//teamtnt[.]red/BLACK-T/setup/kube
• hxxps[:]//teamtnt[.]red/BLACK-T/setup/tshd
• hxxps[:]//teamtnt[.]red/BLACK-T/SetUpTheBLACK-T
• hxxps[:]//teamtnt[.]red/BLACK-T/SystemMod
• hxxps[:]//teamtnt[.]red/ip_log/getip[.]php
• hxxps[:]//teamtnt[.]red/only_for_stats/dup[.]php
• hxxps[:]//teamtnt[.]red/x/getpwds[.]tar[.]gz
• hxxps[:]//teamtnt[.]red/x/pw
• hxxps[:]//iplogger[.]org/blahblahblah

Remediation

• Block the threat indicators at their respective controls.
• Search for IoCs in your environment.