• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – CVE-2020-17049 – Windows Kerberos Bronze Bit Attack Public Exploit
December 11, 2020
Rewterz Threat Alert – SolarWinds Breach Used to Infiltrate Customer Networks – IoCs
December 14, 2020

Rewterz Threat Alert – PgMiner Botnet Targets PostgreSQL Database on Linux Server

December 14, 2020

Severity

High

Analysis Summary

A botnet which is codenamed as PgMiner, is found brute forcing internet-accessible PostgreSQL databases on Linux servers. It begins with scanning phase, scanning a randomly picked public network and searching for Port 5432 for PostgreSQL that is exposed on the system. Once it finds active PostgreSQL system, it will start brute force phase by attempting default user as “postgres” and use a long list of passwords to brute force. The default user of PostgreSQL has no password for authentication. If PostgreSQL database owners have forgotten to disable this user or have forgotten to change its passwords, the hackers access the database and use the PostgreSQL COPY from PROGRAM feature to escalate their access from the database app to the underlying server and take over the entire OS. Once they have a more solid hold on the infected system, the PgMiner crew deploys a coin-mining application and attempt to mine as much Monero cryptocurrency as possible before they get detected. 
 

pgminer.png

Impact

  • Unauthorized Access
  • Privilege Escalation
  • System Takeover
  • Unauthorized Resource Consumption

Indicators of Compromise

Domain Name

  • ojk5zra7b3yq32timb27n4qj5udk4w2l5kqn5ulhnugdscelttfhtoyd[.]onion

MD5

  • ee93529385e0594196ba2edcee60a9e2
  • e9ef6319dd9ea1fb3f62bc6500cd0d41
  • b15450094ef3965f1e387d0dc7fc901e
  • 0b9a387037eea1acef09c47b19c9f686
  • 903a77e545ccae58cc7bc9ab05fcb9cf
  • e643d22254d51cc367880e7579677baf
  • cb78987f76be78c5335bd5d9a8a1a9c9
  • 09be8df5ed83ac8ef573e6168f2326b5
  • a83472bb26b5af4f7cce2233df8509ed
  • b390aa2e4ad5817388001e43f1899237
  • 03ef5185386394a5f5ec071d6e1534dd
  • 6e1c01f1fa3f22f0d28ff175bb56c1c1

SHA-256

  • 55698654f0fbcf5a6d52f3f44bc0f2257e06835e76fb7142d449a2d1641d7e4b
  • 6d296648fdbc693e604f6375eaf7e28b87a73b8405dc8cd3147663b5e8b96ff0
  • 6984a04d7e435499ff267cfaf913d51e8644f6c08db8069c56f9247f1e18ba71
  • 1b1d6d5f01b26e4ccf6fff8f2626f9318084dc1123ac67ed7d02f955b72a1432
  • 0fc1332d2b20ea43d3c3fea50a48bb1991522bc6c79d518ba9b68a763ef2ad58
  • 8a13c3fe815f15a5600fda30d132dfbd4bb54d9c766da164060dd1d66b12e9e4
  • 6d95b593f0b5e3cc1985635ad2b943acb083833fea8123e7ac3f88f68e04edd6
  • 101ccbad7732fb185d51b91d31a67ff058cac3bc31ec36cec05094065a97d6fd
  • d4cf8cfb4dc9cc3101b8c850369a71af70f11e67df7e41e9af98624ebe54ff4a
  • 47d56fcbf5d90b9c513d8d38a2c00e4bad6ea4e1d17b05dd37feb4d63b2856e1
  • e3c5abe56964ddb3b4f0b3c434a9af145efca558307c65d30e8acc5aed45bedc
  • 524cce2cf615809bc08ca80facf95f2be7c5071c4cb3eac38c20a1f0ed39ce1f

SHA1

  • 434f98038beb681fa61b44b774683c1b7ad9f939
  • 86344eb68440d73e30e328bdaede7ea567ac7c0d
  • af206433c8d9583058c23d19ecaca65b8c3768b0
  • 26e266fdf26b1186658661afd78e6213a6c01e8c
  • 888191e376c615133c8ee86399bdc584c7045e8f
  • a400fb5ecb50c2c96ceec43c8821707f0ed747a0
  • 9cec1fe99a9cd46bf6659f5c3ae7dae2e0493388
  • 71b9ae03368c553d2354603f899b0bec9eaefd68
  • 758194201b29a1b183189306f2348f21b88a5c4c
  • fae040afcc83a73e50ca1a5773a7a467fb72fa94
  • fe6e4cba50db38a4f15a7439e6b2744b33bac37f
  • c44dc569eea8e36b6a8068e7878814e5a4b85296

Remediation

  • Block the threat indicators at their respective controls.
  • Maintain a strong password policy and never use default passwords for authentication.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.