Exploit / PoChigh
Cryptocurrency miners aren’t dead yet: Documenting the voracious but simple “Panda”
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-10271 | Unauthenticated Remote Code Execution in Oracle WebLogic Server | 7.5 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2017-5638 | Unauthenticated RCE in Apache Struts Jakarta Multipart parser | 9.8 | 100% | KEVRansomwarePoC ×10 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 2019.ip138.com | IP and reaches out to Chinese-language IP geolocation site 2019[.]ip138[.]com to get the external IP, using the victim's Class B addr |
| domain | a45.bulehero.in | ule pack available for purchase on Snort.org . IOCs Domains a45[.]bulehero[.]in a46[.]bulehero[.]in a47[.]bulehero[.]in a48[.]bulehero[ |
| domain | a46.bulehero.in | to both directly download a file called "download.exe" from a46[.]bulehero[.]in and upload a simple PHP web shell to the path "/public/ |
| domain | a47.bulehero.in | .org . IOCs Domains a45[.]bulehero[.]in a46[.]bulehero[.]in a47[.]bulehero[.]in a48[.]bulehero[.]in a88[.]bulehero[.]in a88[.]heroheroh |
| domain | a48.bulehero.in | a45[.]bulehero[.]in a46[.]bulehero[.]in a47[.]bulehero[.]in a48[.]bulehero[.]in a88[.]bulehero[.]in a88[.]heroherohero[.]info a[.]buleh |
| domain | a88.bulehero.in | a46[.]bulehero[.]in a47[.]bulehero[.]in a48[.]bulehero[.]in a88[.]bulehero[.]in a88[.]heroherohero[.]info a[.]bulehero[.]in aic[.]fxxxx |
| domain | a88.heroherohero.info | a47[.]bulehero[.]in a48[.]bulehero[.]in a88[.]bulehero[.]in a88[.]heroherohero[.]info a[.]bulehero[.]in aic[.]fxxxxxxk[.]me axx[.]bulehero[.] |
| domain | a.bulehero.in | bulehero[.]in a88[.]bulehero[.]in a88[.]heroherohero[.]info a[.]bulehero[.]in aic[.]fxxxxxxk[.]me axx[.]bulehero[.]in b[.]bulehero[.] |
| domain | aic.fxxxxxxk.me | .]bulehero[.]in a88[.]heroherohero[.]info a[.]bulehero[.]in aic[.]fxxxxxxk[.]me axx[.]bulehero[.]in b[.]bulehero[.]in bulehero[.]in c[. |
| domain | axx.bulehero.in | .]heroherohero[.]info a[.]bulehero[.]in aic[.]fxxxxxxk[.]me axx[.]bulehero[.]in b[.]bulehero[.]in bulehero[.]in c[.]bulehero[.]in cb[.] |
| domain | b.bulehero.in | ed PowerShell to download a file called "download.exe" from b[.]bulehero[.]in, and similarly, save it as another simple number filena |
| domain | bulehero.in | ved very similar TTPs in an attack using another C2 domain: bulehero[.]in. The actors used PowerShell to download a file called "do |
| domain | cb.fuckingmy | hero[.]in b[.]bulehero[.]in bulehero[.]in c[.]bulehero[.]in cb[.]fuckingmy[.].life cnm[.]idc3389[.]top down[.]idc3389[.]top fid[.]ho |
| domain | cb.fuckingmy.life | to download the secondary miner payload located at http[:]//cb[.]fuckingmy[.]life:80/trapceapet.exe. This sample also includes a Gh0st RA |
| domain | c.bulehero.in | d cfg.ini hosted on a different subdomain of bulehero[.]in, c[.]bulehero[.]in, over the previously observed port 57890. Consistent wi |
| domain | ckingmy.life | cker IPs pulling down payloads from the URL hxxp[:]//cb[.]f*ckingmy[.]life/download.exe. In a slight departure from previous behavio |
| domain | cnm.idc3389.top | .]in bulehero[.]in c[.]bulehero[.]in cb[.]fuckingmy[.].life cnm[.]idc3389[.]top down[.]idc3389[.]top fid[.]hognoob[.]se fxxk[.]noilwut0 |
| domain | down.idc3389.top | [.]bulehero[.]in cb[.]fuckingmy[.].life cnm[.]idc3389[.]top down[.]idc3389[.]top fid[.]hognoob[.]se fxxk[.]noilwut0vv[.]club haq[.]hogno |
| domain | fid.hognoob.se | [.]se. At the time, the domain hosting the initial payload, fid[.]hognoob[.]se, resolved to the IP address 195[.]128[.]126[.]241, whic |
| domain | fxxk.noilwut0vv.club | x "DOWNLOAD_SHELL_MUTEX_NAME" with the mutex name listed as fxxk[.]noilwut0vv[.]club:9898. The sample also made a DNS request for this domai |
| domain | fxxxxxxk.me | 7[.]80, which is also associated with several subdomains of fxxxxxxk[.]me and older Panda C2 hognoob[.]se. Combining mining capabil |
| domain | haq.hognoob.se | .]idc3389[.]top fid[.]hognoob[.]se fxxk[.]noilwut0vv[.]club haq[.]hognoob[.]se idc3389[.]top idc3389[.]cc idc3389[.]pw li[.]bulehero20 |
| domain | hognoob.se | infrastructure, including various subdomains of the domain hognoob[.]se. At the time, the domain hosting the initial payload, fid |
| domain | idc3389.cc | e fxxk[.]noilwut0vv[.]club haq[.]hognoob[.]se idc3389[.]top idc3389[.]cc idc3389[.]pw li[.]bulehero2019[.]club list[.]idc3389[.]to |
| domain | idc3389.pw | wut0vv[.]club haq[.]hognoob[.]se idc3389[.]top idc3389[.]cc idc3389[.]pw li[.]bulehero2019[.]club list[.]idc3389[.]top mi[.]oops[. |
| domain | idc3389.top | resses in the 172.105.X.X block. One of Panda's C2 domains, idc3389[.]top, was registered to a Chinese-speaking actor, who went by |
| domain | ip138.com | es a GET request to Chinese-language IP geolocation service ip138[.]com for a resource named ic.asp which provides the machine's |
| domain | kingminer.club | file from list[.]idc3389[.]top over port 57890, as well as kingminer[.]club. The config file specifies the Monero wallet to be used a |
| domain | li.bulehero2019.club | are known domains used by Panda. The sample also contacted li[.]bulehero2019[.]club. Cisco Threat Grid's analysis also showed artifacts ass |
| domain | list.idc3389.top | ting it. The sample attempts to download a config file from list[.]idc3389[.]top over port 57890, as well as kingminer[.]club. The confi |
| domain | mi.oops.best | file used for miner configuration lists the mining pool as mi[.]oops[.]best, with a backup pool at mx[.]oops[.]best. Conclusion Pan |
| domain | mx.oops.best | the mining pool as mi[.]oops[.]best, with a backup pool at mx[.]oops[.]best. Conclusion Panda's operational security remains poor, |
| domain | nrs.hognoob.se | club list[.]idc3389[.]top mi[.]oops[.]best mx[.]oops[.]best nrs[.]hognoob[.]se oo[.]mygoodluck[.]best pool[.]bulehero[.]in pxi[.]hogno |
| domain | oo.mygoodluck.best | t.exe. This sample also includes a Gh0st RAT mutex, set to "oo[.]mygoodluck[.]best:51888:WervPoxySvc", and made a DNS request for this dom |
| domain | pool.bulehero.in | mx[.]oops[.]best nrs[.]hognoob[.]se oo[.]mygoodluck[.]best pool[.]bulehero[.]in pxi[.]hognoob[.]se pxx[.]hognoob[.]se q1a[.]hognoob[.]s |
| domain | pxi.hognoob.se | [.]hognoob[.]se oo[.]mygoodluck[.]best pool[.]bulehero[.]in pxi[.]hognoob[.]se pxx[.]hognoob[.]se q1a[.]hognoob[.]se qie[.]fxxxxxxk[.] |
| domain | pxx.hognoob.se | .]mygoodluck[.]best pool[.]bulehero[.]in pxi[.]hognoob[.]se pxx[.]hognoob[.]se q1a[.]hognoob[.]se qie[.]fxxxxxxk[.]me rp[.]oiwcvbnc2e[ |
| domain | q1a.hognoob.se | pool[.]bulehero[.]in pxi[.]hognoob[.]se pxx[.]hognoob[.]se q1a[.]hognoob[.]se qie[.]fxxxxxxk[.]me rp[.]oiwcvbnc2e[.]stream uio[.]hero |
| domain | qie.fxxxxxxk.me | in pxi[.]hognoob[.]se pxx[.]hognoob[.]se q1a[.]hognoob[.]se qie[.]fxxxxxxk[.]me rp[.]oiwcvbnc2e[.]stream uio[.]heroherohero[.]info uio[ |
| domain | rat.kingminer.club | also installs Gh0st RAT, which communicates with the domain rat[.]kingminer[.]club. In several samples, we also observed Panda dropping ot |
| domain | rp.oiwcvbnc2e.stream | e pxx[.]hognoob[.]se q1a[.]hognoob[.]se qie[.]fxxxxxxk[.]me rp[.]oiwcvbnc2e[.]stream uio[.]heroherohero[.]info uio[.]hognoob[.]se upa1[.]hog |
| domain | uio.heroherohero.info | .]hognoob[.]se qie[.]fxxxxxxk[.]me rp[.]oiwcvbnc2e[.]stream uio[.]heroherohero[.]info uio[.]hognoob[.]se upa1[.]hognoob[.]se upa2[.]hognoob[. |
| domain | uio.hognoob.se | [.]se as well as a configuration file called "cfg.ini" from uio[.]hognoob[.]se, which provides configuration details for the miner. "W |
| domain | upa1.hognoob.se | bnc2e[.]stream uio[.]heroherohero[.]info uio[.]hognoob[.]se upa1[.]hognoob[.]se upa2[.]hognoob[.]se wiu[.]fxxxxxxk[.]me yxw[.]hognoob[. |
| domain | upa2.hognoob.se | ]heroherohero[.]info uio[.]hognoob[.]se upa1[.]hognoob[.]se upa2[.]hognoob[.]se wiu[.]fxxxxxxk[.]me yxw[.]hognoob[.]se zik[.]fxxxxxxk[. |
| domain | wiu.fxxxxxxk.me | Ps post-exploit pulling down payloads from the URL hxxp[:]//wiu[.]fxxxxxxk[.]me/download.exe and saving it under a random 20-character |
| domain | yxw.hognoob.se | upa1[.]hognoob[.]se upa2[.]hognoob[.]se wiu[.]fxxxxxxk[.]me yxw[.]hognoob[.]se zik[.]fxxxxxxk[.]me IPs 184[.]168[.]221[.]47 172[.]104[ |
| domain | zik.fxxxxxxk.me | upa2[.]hognoob[.]se wiu[.]fxxxxxxk[.]me yxw[.]hognoob[.]se zik[.]fxxxxxxk[.]me IPs 184[.]168[.]221[.]47 172[.]104[.]87[.]6 139[.]162[. |
| ipv4 | 116.193.154.122 | 2[.]104[.]87[.]6 139[.]162[.]123[.]87 139[.]162[.]110[.]201 116[.]193[.]154[.]122 95[.]128[.]126[.]241 195[.]128[.]127[.]254 195[.]128[ |
| ipv4 | 139.162.110.201 | 84[.]168[.]221[.]47 172[.]104[.]87[.]6 139[.]162[.]123[.]87 139[.]162[.]110[.]201 116[.]193[.]154[.]122 95[.]128[.]126[.]241 195[.]128[ |
| ipv4 | 139.162.123.87 | .]fxxxxxxk[.]me IPs 184[.]168[.]221[.]47 172[.]104[.]87[.]6 139[.]162[.]123[.]87 139[.]162[.]110[.]201 116[.]193[.]154[.]122 95[.]128[ |
| ipv4 | 139.162.71.92 | 128[.]126[.]120 195[.]128[.]126[.]243 195[.]128[.]124[.]140 139[.]162[.]71[.]92 3[.]123[.]17[.]223 46[.]173[.]217[.]80 5[.]56[.]133[. |
| ipv4 | 172.104.87.6 | .]hognoob[.]se zik[.]fxxxxxxk[.]me IPs 184[.]168[.]221[.]47 172[.]104[.]87[.]6 139[.]162[.]123[.]87 139[.]162[.]110[.]201 116[.]193[ |
| ipv4 | 184.168.221.47 | [.]fxxxxxxk[.]me yxw[.]hognoob[.]se zik[.]fxxxxxxk[.]me IPs 184[.]168[.]221[.]47 172[.]104[.]87[.]6 139[.]162[.]123[.]87 139[.]162[.]1 |
| ipv4 | 195.128.124.140 | 128[.]127[.]254 195[.]128[.]126[.]120 195[.]128[.]126[.]243 195[.]128[.]124[.]140 139[.]162[.]71[.]92 3[.]123[.]17[.]223 46[.]173[.]217 |
| ipv4 | 195.128.126.120 | ]193[.]154[.]122 95[.]128[.]126[.]241 195[.]128[.]127[.]254 195[.]128[.]126[.]120 195[.]128[.]126[.]243 195[.]128[.]124[.]140 139[.]162 |
| ipv4 | 195.128.126.241 | ial payload, fid[.]hognoob[.]se, resolved to the IP address 195[.]128[.]126[.]241, which was also associated with several subdomains of |
| ipv4 | 195.128.126.243 | 128[.]126[.]241 195[.]128[.]127[.]254 195[.]128[.]126[.]120 195[.]128[.]126[.]243 195[.]128[.]124[.]140 139[.]162[.]71[.]92 3[.]123[.]1 |
| ipv4 | 195.128.127.254 | ]162[.]110[.]201 116[.]193[.]154[.]122 95[.]128[.]126[.]241 195[.]128[.]127[.]254 195[.]128[.]126[.]120 195[.]128[.]126[.]243 195[.]128 |
| ipv4 | 217.69.6.42 | due to inappropriate language) currently resolves to the IP 217[.]69[.]6[.]42, and was first observed by Cisco Umbrella on August 1 |
| ipv4 | 3.123.17.223 | file via PowerShell. Wiu[.]fxxxxxxk[.]me resolves to the IP 3[.]123[.]17[.]223, which is associated with older Panda C2s including a |
| ipv4 | 46.173.217.80 | DNS request for this domain. The domain resolved to the IP 46[.]173[.]217[.]80, which is also associated with several subdomains of |
| ipv4 | 5.56.133.246 | 139[.]162[.]71[.]92 3[.]123[.]17[.]223 46[.]173[.]217[.]80 5[.]56[.]133[.]246 SHA-256 2df8cfa5ea4d63615c526613671bbd02cfa9ddf180a79 |
| ipv4 | 95.128.126.241 | ]162[.]123[.]87 139[.]162[.]110[.]201 116[.]193[.]154[.]122 95[.]128[.]126[.]241 195[.]128[.]127[.]254 195[.]128[.]126[.]120 195[.]128 |
| sha256 | 0697127fb6fa77e80b44c53d2a551862709951969f594df311f10dcf2619c9d5 | 3a22ccbf35e2f7c4981a6e8eff7c905bc7dbb5fedadd9ed80768e00ab27 0697127fb6fa77e80b44c53d2a551862709951969f594df311f10dcf2619c9d5 f9a972757cd0d8a837eb30f6a28bc9b5e2a6674825b18359648c50bbb7d |
| sha256 | 1e4f93a22ccbf35e2f7c4981a6e8eff7c905bc7dbb5fedadd9ed80768e00ab27 | c854a3bd3c3a222acc776301b380e60b5d0d6428db94d53fad6a98fc4ec 1e4f93a22ccbf35e2f7c4981a6e8eff7c905bc7dbb5fedadd9ed80768e00ab27 0697127fb6fa77e80b44c53d2a551862709951969f594df311f10dcf261 |
| sha256 | 29b6dc1a00fea36bc3705344abea47ac633bc6dbff0c638b120d72bc6b38a36f | e115f36584175058dac3d34fe0442d435d6e5f8c5e76f0a3df15c9cd5fb 29b6dc1a00fea36bc3705344abea47ac633bc6dbff0c638b120d72bc6b38a36f 3ed90f9fbc9751a31bf5ab817928d6077ba82113a03232682d864fb6d7c |
| sha256 | 2df8cfa5ea4d63615c526613671bbd02cfa9ddf180a79b4e542a2714ab02a3c1 | 3[.]17[.]223 46[.]173[.]217[.]80 5[.]56[.]133[.]246 SHA-256 2df8cfa5ea4d63615c526613671bbd02cfa9ddf180a79b4e542a2714ab02a3c1 fa4889533cb03fc4ade5b9891d4468bac9010c04456ec6dd8c4aba44c8a |
| sha256 | 2f4d46d02757bcf4f65de700487b667f8846c38ddb50fbc5b2ac47cfa9e29beb | 9533cb03fc4ade5b9891d4468bac9010c04456ec6dd8c4aba44c8af9220 2f4d46d02757bcf4f65de700487b667f8846c38ddb50fbc5b2ac47cfa9e29beb 829729471dfd7e6028af430b568cc6e812f09bb47c93f382a123ccf3698 |
| sha256 | 34186e115f36584175058dac3d34fe0442d435d6e5f8c5e76f0a3df15c9cd5fb | 2757cd0d8a837eb30f6a28bc9b5e2a6674825b18359648c50bbb7d6d74a 34186e115f36584175058dac3d34fe0442d435d6e5f8c5e76f0a3df15c9cd5fb 29b6dc1a00fea36bc3705344abea47ac633bc6dbff0c638b120d72bc6b3 |
| sha256 | 3ed90f9fbc9751a31bf5ab817928d6077ba82113a03232682d864fb6d7c69976 | c1a00fea36bc3705344abea47ac633bc6dbff0c638b120d72bc6b38a36f 3ed90f9fbc9751a31bf5ab817928d6077ba82113a03232682d864fb6d7c69976 a415518642ce4ad11ff645151195ca6e7b364da95a8f89326d68c836f4e |
| sha256 | 4d1f49fac538692902cc627ab7d9af07680af68dd6ed87ab16710d858cc4269c | 18642ce4ad11ff645151195ca6e7b364da95a8f89326d68c836f4e2cae1 4d1f49fac538692902cc627ab7d9af07680af68dd6ed87ab16710d858cc4269c 8dea116dd237294c8c1f96c3d44007c3cd45a5787a2ef59e839c740bf54 |
| sha256 | 6d5479adcfa4c31ad565ab40d2ea8651bed6bd68073c77636d1fe86d55d90c8d | c1a00fea36bc3705344abea47ac633bc6dbff0c638b120d72bc6b38a36f 6d5479adcfa4c31ad565ab40d2ea8651bed6bd68073c77636d1fe86d55d90c8d Monero Wallets 49Rocc2niuCTyVMakjq7zU7njgZq3deBwba3pTcGFjLn |
| sha256 | 829729471dfd7e6028af430b568cc6e812f09bb47c93f382a123ccf3698c8c08 | 6d02757bcf4f65de700487b667f8846c38ddb50fbc5b2ac47cfa9e29beb 829729471dfd7e6028af430b568cc6e812f09bb47c93f382a123ccf3698c8c08 8b645c854a3bd3c3a222acc776301b380e60b5d0d6428db94d53fad6a98 |
| sha256 | 8b645c854a3bd3c3a222acc776301b380e60b5d0d6428db94d53fad6a98fc4ec | 9471dfd7e6028af430b568cc6e812f09bb47c93f382a123ccf3698c8c08 8b645c854a3bd3c3a222acc776301b380e60b5d0d6428db94d53fad6a98fc4ec 1e4f93a22ccbf35e2f7c4981a6e8eff7c905bc7dbb5fedadd9ed80768e0 |
| sha256 | 8dea116dd237294c8c1f96c3d44007c3cd45a5787a2ef59e839c740bf5459f21 | 9fac538692902cc627ab7d9af07680af68dd6ed87ab16710d858cc4269c 8dea116dd237294c8c1f96c3d44007c3cd45a5787a2ef59e839c740bf5459f21 991a9a8da992731759a19e470c36654930f0e3d36337e98885e56bd252b |
| sha256 | 991a9a8da992731759a19e470c36654930f0e3d36337e98885e56bd252be927e | 16dd237294c8c1f96c3d44007c3cd45a5787a2ef59e839c740bf5459f21 991a9a8da992731759a19e470c36654930f0e3d36337e98885e56bd252be927e a3f1c90ce5c76498621250122186a0312e4f36e3bfcfede882c83d06dd2 |
| sha256 | 9c37a6b2f4cfbf654c0a5b4a4e78b5bbb3ba26ffbfab393f0d43dad9000cb2d3 | 90ce5c76498621250122186a0312e4f36e3bfcfede882c83d06dd286da1 9c37a6b2f4cfbf654c0a5b4a4e78b5bbb3ba26ffbfab393f0d43dad9000cb2d3 d5c1848ba6fdc6f260439498e91613a5db8acbef10d203a18f6b9740d2c |
| sha256 | a3f1c90ce5c76498621250122186a0312e4f36e3bfcfede882c83d06dd286da1 | a8da992731759a19e470c36654930f0e3d36337e98885e56bd252be927e a3f1c90ce5c76498621250122186a0312e4f36e3bfcfede882c83d06dd286da1 9c37a6b2f4cfbf654c0a5b4a4e78b5bbb3ba26ffbfab393f0d43dad9000 |
| sha256 | a415518642ce4ad11ff645151195ca6e7b364da95a8f89326d68c836f4e2cae1 | f9fbc9751a31bf5ab817928d6077ba82113a03232682d864fb6d7c69976 a415518642ce4ad11ff645151195ca6e7b364da95a8f89326d68c836f4e2cae1 4d1f49fac538692902cc627ab7d9af07680af68dd6ed87ab16710d858cc |
| sha256 | d5c1848ba6fdc6f260439498e91613a5db8acbef10d203a18f6b9740d2cab3ca | 6b2f4cfbf654c0a5b4a4e78b5bbb3ba26ffbfab393f0d43dad9000cb2d3 d5c1848ba6fdc6f260439498e91613a5db8acbef10d203a18f6b9740d2cab3ca 29b6dc1a00fea36bc3705344abea47ac633bc6dbff0c638b120d72bc6b3 |
| sha256 | f9a972757cd0d8a837eb30f6a28bc9b5e2a6674825b18359648c50bbb7d6d74a | 27fb6fa77e80b44c53d2a551862709951969f594df311f10dcf2619c9d5 f9a972757cd0d8a837eb30f6a28bc9b5e2a6674825b18359648c50bbb7d6d74a 34186e115f36584175058dac3d34fe0442d435d6e5f8c5e76f0a3df15c9 |
| sha256 | fa4889533cb03fc4ade5b9891d4468bac9010c04456ec6dd8c4aba44c8af9220 | fa5ea4d63615c526613671bbd02cfa9ddf180a79b4e542a2714ab02a3c1 fa4889533cb03fc4ade5b9891d4468bac9010c04456ec6dd8c4aba44c8af9220 2f4d46d02757bcf4f65de700487b667f8846c38ddb50fbc5b2ac47cfa9e |
| url | http://cb.f*ckingmy.life/download.exe | ed multiple attacker IPs pulling down payloads from the URL hxxp[:]//cb[.]f*ckingmy[.]life/download.exe. In a slight departure from previous behavior, the fi |
| url | http://fid.hognoob.se/download.exe | o download an executable called "download.exe" from the URL hxxp://fid[.]hognoob[.]se/download.exe and save it in the Temp folder, although Panda now save |
| url | http://wiu.fxxxxxxk.me/download.exe | ttacker IPs post-exploit pulling down payloads from the URL hxxp[:]//wiu[.]fxxxxxxk[.]me/download.exe and saving it under a random 20-character name, with |
| url | http://wiu.fxxxxxxk.me/sppuihost.exe | Certutil to download the secondary miner payload located at hxxp[:]//wiu[.]fxxxxxxk[.]me/sppuihost.exe and using ping to delay execution of this payload. Th |
From the original article
10 min read at blog.talosintelligence.com
Executive summary A new threat actor named "Panda" has generated thousands of dollars worth of the Monero cryptocurrency through the use of remote access tools (RATs) and illicit cryptocurrency-mining malware. This is far from the most sophisticated actor we've ever seen, but it still has been one of the most active attackers we've seen in Cisco Talos threat trap data.
By Nick Biasini · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.