Rewterz Threat Alert – LemonDuck Crypto-Miner New Variant

October 9, 2020

Severity

High

Analysis Summary

A previous cryptojacker campaign, Kingminer, landed on victims via brute-forced SQL server accounts and performed its actions with Defense Evasion in mind. The way Kingminer infects victim machines opened up new horizons for attackers aiming to take control of enterprise computers. LemonDuck (which got the name from the unique User-Agent used to send HTTP requests) draws inspiration from Kingminer for lateral movement, but, at the same time, it employs new techniques to infect even more systems than Kingminer did. Since its first appearance in October 2019, the malware extended its capabilities with a new persistence mechanism through WMI and new lateral movement strategies. LemonDuck has previously been known for targeting cloud Apps and Linux.

An infection can start on a system in multiple ways:

phishing e-mail – sent from an already infected machine
EternalBlue or other SMB exploits
RDP brute-forcing – if there are weak accounts on the system
A .lnk file from a removable drive or a network drive
SSH brute-forcing – if there are weak accounts on the system
Pass-the-hash – if the attackers manage to dump a valid NTLM password hash
MS-SQL brute-forcing – similar to Kingminer, if there are weak DB credentials
Redis remote command
Yarn remote command

Impact

Unauthorized Access
Credential Theft
Device Takeover
Detection Evasion

Indicators of Compromise

Hostname

t[.]amynx[.]com
t[.]zer9g[.]com
t[.]zz3r0[.]com
www[.]pingcastle[.]com
d[.]ackng[.]com

MD5

23d59ed726e13edabcb751da7a5ce310
614257993fd996b4cea3a0fdffa4feac
ce510f7de1c4312aa0d74d0f1804c151
5b2849ff2e8c335dcc60fd2155b2d4d3
ef3a4697773f84850fe1a086db8edfe0

SHA-256

8bd665c7f0522b1cd4ad61c5424f7acfb64cf0a5fb1313ad7da303d604019052
5e47d3058962bf781895ba7c761d4e462c5f366a9b50d21969bbbfa9bd434897
b2faa3a2f01b5aa58db9d59e2d7de3e170cef7a832df114f631abb00304bc298
2a788f1f0dfb1d52f5155f60d57a55f54b39475f06eea9e9e13d00d3191c364c
d7d0f18071899c81ee90a7f8b266bd2cf22e988da7d0e991213f5fb4c8864e77

SHA1

c1384205da4a8b76aec5db733700b3159531a77d
ac890783ed388aa55ed70d560e4904f47dd4e4c1
2d0a23e49f3f5e33ca85d58117f7c6190417628d
0af7a28d9e5a9435db125d7e46e7e20825643ca4
6a4c477ba19a7bb888540d02acdd9be0d5d3fd02

Source IP

161[.]35[.]107[.]193
139[.]162[.]80[.]221
167[.]99[.]154[.]202
128[.]199[.]183[.]160
167[.]71[.]87[.]85
66[.]42[.]43[.]37

URL

http[:]//167[.]71[.]87[.]85/20[.]dat?$params
http[:]//d[.]ackng[.]com
http[:]//t[.]amynx[.]com/ipc[.]jsp?0[.]8?Ion
http[:]//t[.]zz3r0[.]com
http[:]//167[.]71[.]87[.]85/20[.]
http[:]//t[.]amynx[.]com
http[:]//t[.]zer9g[.]com

Remediation

Block the threat indicators at their respective controls.
Do not download email attachments without prior confirmation from the sender.
To thwart brute force attacks, enable account lockout policies by limiting the number of failed login attempts per user.
Apply security measures to both the clients and the servers involved in the RDP communication.
Implement a strong password policy.
Keep all systems and software updated to latest patched versions.