Rewterz Threat Alert – PgMiner Botnet Targets PostgreSQL Database on Linux Server

Severity

High

Analysis Summary

A botnet which is codenamed as PgMiner, is found brute forcing internet-accessible PostgreSQL databases on Linux servers. It begins with scanning phase, scanning a randomly picked public network and searching for Port 5432 for PostgreSQL that is exposed on the system. Once it finds active PostgreSQL system, it will start brute force phase by attempting default user as “postgres” and use a long list of passwords to brute force. The default user of PostgreSQL has no password for authentication. If PostgreSQL database owners have forgotten to disable this user or have forgotten to change its passwords, the hackers access the database and use the PostgreSQL COPY from PROGRAM feature to escalate their access from the database app to the underlying server and take over the entire OS. Once they have a more solid hold on the infected system, the PgMiner crew deploys a coin-mining application and attempt to mine as much Monero cryptocurrency as possible before they get detected. 
 

Impact

• Unauthorized Access
• Privilege Escalation
• System Takeover
• Unauthorized Resource Consumption

Indicators of Compromise

Domain Name

• ojk5zra7b3yq32timb27n4qj5udk4w2l5kqn5ulhnugdscelttfhtoyd[.]onion

MD5

• ee93529385e0594196ba2edcee60a9e2
• e9ef6319dd9ea1fb3f62bc6500cd0d41
• b15450094ef3965f1e387d0dc7fc901e
• 0b9a387037eea1acef09c47b19c9f686
• 903a77e545ccae58cc7bc9ab05fcb9cf
• e643d22254d51cc367880e7579677baf
• cb78987f76be78c5335bd5d9a8a1a9c9
• 09be8df5ed83ac8ef573e6168f2326b5
• a83472bb26b5af4f7cce2233df8509ed
• b390aa2e4ad5817388001e43f1899237
• 03ef5185386394a5f5ec071d6e1534dd
• 6e1c01f1fa3f22f0d28ff175bb56c1c1

SHA-256

• 55698654f0fbcf5a6d52f3f44bc0f2257e06835e76fb7142d449a2d1641d7e4b
• 6d296648fdbc693e604f6375eaf7e28b87a73b8405dc8cd3147663b5e8b96ff0
• 6984a04d7e435499ff267cfaf913d51e8644f6c08db8069c56f9247f1e18ba71
• 1b1d6d5f01b26e4ccf6fff8f2626f9318084dc1123ac67ed7d02f955b72a1432
• 0fc1332d2b20ea43d3c3fea50a48bb1991522bc6c79d518ba9b68a763ef2ad58
• 8a13c3fe815f15a5600fda30d132dfbd4bb54d9c766da164060dd1d66b12e9e4
• 6d95b593f0b5e3cc1985635ad2b943acb083833fea8123e7ac3f88f68e04edd6
• 101ccbad7732fb185d51b91d31a67ff058cac3bc31ec36cec05094065a97d6fd
• d4cf8cfb4dc9cc3101b8c850369a71af70f11e67df7e41e9af98624ebe54ff4a
• 47d56fcbf5d90b9c513d8d38a2c00e4bad6ea4e1d17b05dd37feb4d63b2856e1
• e3c5abe56964ddb3b4f0b3c434a9af145efca558307c65d30e8acc5aed45bedc
• 524cce2cf615809bc08ca80facf95f2be7c5071c4cb3eac38c20a1f0ed39ce1f

SHA1

• 434f98038beb681fa61b44b774683c1b7ad9f939
• 86344eb68440d73e30e328bdaede7ea567ac7c0d
• af206433c8d9583058c23d19ecaca65b8c3768b0
• 26e266fdf26b1186658661afd78e6213a6c01e8c
• 888191e376c615133c8ee86399bdc584c7045e8f
• a400fb5ecb50c2c96ceec43c8821707f0ed747a0
• 9cec1fe99a9cd46bf6659f5c3ae7dae2e0493388
• 71b9ae03368c553d2354603f899b0bec9eaefd68
• 758194201b29a1b183189306f2348f21b88a5c4c
• fae040afcc83a73e50ca1a5773a7a467fb72fa94
• fe6e4cba50db38a4f15a7439e6b2744b33bac37f
• c44dc569eea8e36b6a8068e7878814e5a4b85296

Remediation

• Block the threat indicators at their respective controls.
• Maintain a strong password policy and never use default passwords for authentication.