Vulnerabilitycritical
Rocke: The Champion of Monero Miners
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-10271 | Unauthenticated Remote Code Execution in Oracle WebLogic Server | 7.5 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2017-3066 | Unauthenticated Deserialization RCE in Adobe ColdFusion (BlazeDS) | 9.8 | 91% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 3389.space | ron job that downloads and executes a file "logo.jpg" from "3389[.]space." This file is a shell script which, in turn, downloads m |
| domain | 3g2upl4pq6kufc4m.tk | .]172, they attempt to download a file called "XbashY" from 3g2upl4pq6kufc4m[.]tk. "R88.sh" is a shell script that installs a cron job and |
| domain | 5-xun.com | ns registered to Rocke (not all are necessarily malicious): 5-xun[.]com 88180585[.]com firstomato[.]com jxtiewei[.]com ncyypx[.]n |
| domain | 8282.space | enjoytopic[.]tk: file server realtimenews[.]tk: file server 8282[.]space: older C2 Domains registered to Rocke (not all are necess |
| domain | 88180585.com | d to Rocke (not all are necessarily malicious): 5-xun[.]com 88180585[.]com firstomato[.]com jxtiewei[.]com ncyypx[.]net URLs hxxp:// |
| domain | belesu.com | f these websites were for Jiangxi-based businesses, such as belesu[.]com, which sells baby food. We had had additional indications |
| domain | blockbitcoin.com | s HFS, also resolves to C2 sydwzl[.]cn Domains: sydwzl[.]cn blockbitcoin[.]com: Reached out to by Install.exe dazqc4f140wtl[.]cloudfront |
| domain | blog.sydwzl.cn | nese AV, and also downloads and extracts a tar.gz file from blog[.]sydwzl[.]cn, which also resolves to 118[.]24[.]150[.]172. The scrip |
| domain | d20blzxlz9ydha.cloudfront.net | om firstomato[.]com jxtiewei[.]com ncyypx[.]net URLs hxxp://d20blzxlz9ydha[.]cloudfront[.]net/Install.exe hxxp://www[.]amazon[.]com:80/N4215/adj/amzn |
| domain | d3goboxon32grk2l.tk | front[.]net: file server 3g2upl4pq6kufc4m[.]tk: file server d3goboxon32grk2l[.]tk: file server enjoytopic[.]tk: file server realtimenews[.] |
| domain | dazqc4f140wtl.cloudfront.net | dwzl[.]cn blockbitcoin[.]com: Reached out to by Install.exe dazqc4f140wtl[.]cloudfront[.]net: file server 3g2upl4pq6kufc4m[.]tk: file server d3gobox |
| domain | dir.dir | ss/config[.]json hxxps://gitee[.]com/c-999/ss/raw/master/ss/dir[.]dir hxxps://gitee[.]com/c-999/ss/raw/master/ss/h32 hxxps://gi |
| domain | enjoytopic.tk | kufc4m[.]tk: file server d3goboxon32grk2l[.]tk: file server enjoytopic[.]tk: file server realtimenews[.]tk: file server 8282[.]space: |
| domain | firstomato.com | all are necessarily malicious): 5-xun[.]com 88180585[.]com firstomato[.]com jxtiewei[.]com ncyypx[.]net URLs hxxp://d20blzxlz9ydha[.] |
| domain | gitee.com | ]197 112[.]226[.]74[.]162 Domains 3389[.]space URLs hxxps://gitee[.]com/c-999/ss/raw/master/ss/a hxxps://gitee[.]com/c-999/ss/raw |
| domain | jxtiewei.com | ily malicious): 5-xun[.]com 88180585[.]com firstomato[.]com jxtiewei[.]com ncyypx[.]net URLs hxxp://d20blzxlz9ydha[.]cloudfront[.]ne |
| domain | ncyypx.net | 5-xun[.]com 88180585[.]com firstomato[.]com jxtiewei[.]com ncyypx[.]net URLs hxxp://d20blzxlz9ydha[.]cloudfront[.]net/Install.exe |
| domain | realtimenews.tk | boxon32grk2l[.]tk: file server enjoytopic[.]tk: file server realtimenews[.]tk: file server 8282[.]space: older C2 Domains registered to |
| domain | sydwzl.cn | les, from Rocke's command and control (C2) server hosted on sydwzl[.]cn. The sample then injects code into notepad.exe, which the |
| domain | www.amazon.com | hxxp://d20blzxlz9ydha[.]cloudfront[.]net/Install.exe hxxp://www[.]amazon[.]com:80/N4215/adj/amzn.us.sr.aps?sz=160x600&oe=oe=ISO-8859-1 |
| domain | xmr.pool.minergate.com | open-source Monero miner. The file sets the mining pool as xmr[.]pool[.]MinerGate[.]com:45700 and the actor's wallet as rocke@live.cn. This i |
| domain | xxxzlol.tar.gz | com/c-18/ss/raw/master/ss/h64 hxxp://93[.]174[.]93[.]149/[.]xxxzlol[.]tar[.]gz hxxps://gitee[.]com/c-888/ss/raw/master/ss/logo[.]jpg h |
| ipv4 | 112.226.250.77 | c: 27[.]193[.]180[.]224 Attacking IPs targeting ColdFusion: 112[.]226[.]250[.]77 27[.]210[.]170[.]197 112[.]226[.]74[.]162 Domains 338 |
| ipv4 | 112.226.74.162 | eting ColdFusion: 112[.]226[.]250[.]77 27[.]210[.]170[.]197 112[.]226[.]74[.]162 Domains 3389[.]space URLs hxxps://gitee[.]com/c-999/s |
| ipv4 | 118.24.150.172 | our Struts2 honeypot for a file named "0720.bin" located on 118[.]24[.]150[.]172:10555. We visited this IP and found it was an open HF |
| ipv4 | 120.55.226.24 | ts: 52[.]167[.]219[.]168: Attacking IP using repo at gitlab 120[.]55[.]226[.]24: Attacking IP using repo at gitee Attacking IP target |
| ipv4 | 123.249.9.149 | b1e87a78f8ae8ecdf91c776651c88a612 More recent campaign: IPs 123[.]249[.]9[.]149: Issues get request for 0720.bin 118[.]24[.]150[.]172 |
| ipv4 | 27.193.180.224 | ing IP using repo at gitee Attacking IP targeting WebLogic: 27[.]193[.]180[.]224 Attacking IPs targeting ColdFusion: 112[.]226[.]250[. |
| ipv4 | 27.210.170.197 | 24 Attacking IPs targeting ColdFusion: 112[.]226[.]250[.]77 27[.]210[.]170[.]197 112[.]226[.]74[.]162 Domains 3389[.]space URLs hxxps: |
| ipv4 | 52.167.219.168 | ls. IOCs: Earlier campaign: Attacking IPs targeting Struts: 52[.]167[.]219[.]168: Attacking IP using repo at gitlab 120[.]55[.]226[.]2 |
| ipv4 | 93.174.93.149 | s/h32 hxxps://gitlab[.]com/c-18/ss/raw/master/ss/h64 hxxp://93[.]174[.]93[.]149/[.]xxxzlol[.]tar[.]gz hxxps://gitee[.]com/c-888/ss/ra |
| sha256 | 0c358d826c4a32a8c48ce88eb073f505b555fc62bca6015f5270425c58a0d1c5 | 23472bbd8220fb19c488ae2884d9b52bc65add5d54b1821b4b743a run: 0c358d826c4a32a8c48ce88eb073f505b555fc62bca6015f5270425c58a0d1c5 upd: 187d06f1e6020b6787264e2e700c46c463a7818f07db0b051687f3 |
| sha256 | 187d06f1e6020b6787264e2e700c46c463a7818f07db0b051687f3cba65dbe0b | 4a32a8c48ce88eb073f505b555fc62bca6015f5270425c58a0d1c5 upd: 187d06f1e6020b6787264e2e700c46c463a7818f07db0b051687f3cba65dbe0b x (32-bit miner): 6e80a9d843faf27e239b1a767d29c7443972be1dd |
| sha256 | 2ad07f8d1985f00cd05dafacbe5b6a5b1e87a78f8ae8ecdf91c776651c88a612 | c7443972be1ddf5ff5f5f9fc9a2b55a161f5 x86_64 (64-bit miner): 2ad07f8d1985f00cd05dafacbe5b6a5b1e87a78f8ae8ecdf91c776651c88a612 More recent campaign: IPs 123[.]249[.]9[.]149: Issues get r |
| sha256 | 2f5bf7f1ea7a84828aa70f1140774f3d4ce9985d05a676c8535420232e2af87e | a4096e2af2e6670d4fc75e00b2b396921a79549fb16d03d4 lowerv2.sh 2f5bf7f1ea7a84828aa70f1140774f3d4ce9985d05a676c8535420232e2af87e pools.txt ba29d8a259d33d483833387fad9c7231fbb3beb9f4e0603b2 |
| sha256 | 35cb971daafd368b71ad843a4e0b81c80225ec20d7679cfbf78e628ebcada542 | b07c23c848ff8c28efe19d1b7c070161b7bd6c0ccfc858750 rootv2.sh 35cb971daafd368b71ad843a4e0b81c80225ec20d7679cfbf78e628ebcada542 Install.exe 654ec27ea99c44edc03f1f3971d2a898b9f1441de156832 |
| sha256 | 38066751cb6c39691904ffbef86fe3bdfa737e4ba64add4dd90358245fa2b775 | c8c5aaf83226ca00a3395292cc8f884bdc523a44c2fd431c7b 0720.bin 38066751cb6c39691904ffbef86fe3bdfa737e4ba64add4dd90358245fa2b775 3307.bin 89b3463664ff13ea77256094844c9cf69d3e408d3daf9ffad3 |
| sha256 | 442e4a8d35f9de21d5cbd9a695a24b9ac8120e548119c7f9f881ee16ad3761e6 | 133e534ca35d5ccc54b8a79f93ff0c917790e7d5f73fedaa480a6b93 a7 442e4a8d35f9de21d5cbd9a695a24b9ac8120e548119c7f9f881ee16ad3761e6 bashf 7674e0b69d848e0b9ff8b82df8671f9889f33ab1a664f299bcce1 |
| sha256 | 45ed59d5b27d22567d91a65623d3b7f11726f55b497c383bc2d8d330e5e17161 | e45413b001340afb4f98533d73e80f3b47daec42435789d12e4027 h32: 45ed59d5b27d22567d91a65623d3b7f11726f55b497c383bc2d8d330e5e17161 h64: 7fe9d6d8b9390020862ca7dc9e69c1e2b676db5898e4bfad51d662 |
| sha256 | 55dbdb84c40d9dc8c5aaf83226ca00a3395292cc8f884bdc523a44c2fd431c7b | b_sb_noss_1/167-3294888-0262949/field-keywords=books Hashes 55dbdb84c40d9dc8c5aaf83226ca00a3395292cc8f884bdc523a44c2fd431c7b 0720.bin 38066751cb6c39691904ffbef86fe3bdfa737e4ba64add4dd9 |
| sha256 | 654ec27ea99c44edc03f1f3971d2a898b9f1441de156832d1507590a47b41190 | 1ad843a4e0b81c80225ec20d7679cfbf78e628ebcada542 Install.exe 654ec27ea99c44edc03f1f3971d2a898b9f1441de156832d1507590a47b41190 ZZYO F808A42B10CF55603389945A549CE45EDC6A04562196D14F7489AF |
| sha256 | 6e80a9d843faf27e239b1a767d29c7443972be1ddf5ff5f5f9fc9a2b55a161f5 | e700c46c463a7818f07db0b051687f3cba65dbe0b x (32-bit miner): 6e80a9d843faf27e239b1a767d29c7443972be1ddf5ff5f5f9fc9a2b55a161f5 x86_64 (64-bit miner): 2ad07f8d1985f00cd05dafacbe5b6a5b1e87 |
| sha256 | 6ec8201ef8652f7a9833e216b5ece7ebbf70380ebd367e3385b1c0d4a43972fb | 3623472bbd8220fb19c488ae2884d9b52bc65add5d54b1821b4b743a a: 6ec8201ef8652f7a9833e216b5ece7ebbf70380ebd367e3385b1c0d4a43972fb cron.d: f6a150acfa6ec9d73fdecae27069026ecf2d833eac89976289d |
| sha256 | 7051c9af966d1c55a4096e2af2e6670d4fc75e00b2b396921a79549fb16d03d4 | 48e0b9ff8b82df8671f9889f33ab1a664f299bcce13744e08954c bashg 7051c9af966d1c55a4096e2af2e6670d4fc75e00b2b396921a79549fb16d03d4 lowerv2.sh 2f5bf7f1ea7a84828aa70f1140774f3d4ce9985d05a676c8 |
| sha256 | 725efd0f5310763bc5375e7b72dbb2e883ad90ec32d6177c578a1c04c1b62054 | 55603389945A549CE45EDC6A04562196D14F7489AF04688F12BC XbashY 725efd0f5310763bc5375e7b72dbb2e883ad90ec32d6177c578a1c04c1b62054 reg9.sct d7fbd2a4db44d86b4cf5fa4202203dacfefd6ffca6a0615dca |
| sha256 | 7674e0b69d848e0b9ff8b82df8671f9889f33ab1a664f299bcce13744e08954c | 9de21d5cbd9a695a24b9ac8120e548119c7f9f881ee16ad3761e6 bashf 7674e0b69d848e0b9ff8b82df8671f9889f33ab1a664f299bcce13744e08954c bashg 7051c9af966d1c55a4096e2af2e6670d4fc75e00b2b396921a795 |
| sha256 | 7c2dbc0d74e01a5e7c13b4a41d3a1f7564c165bd532e4473acea6f46405d0889 | 833387fad9c7231fbb3beb9f4e0603b204523607c622a03 config.json 7c2dbc0d74e01a5e7c13b4a41d3a1f7564c165bd532e4473acea6f46405d0889 r88.sh d44e767132d68fdb07c23c848ff8c28efe19d1b7c070161b7bd6 |
| sha256 | 7fe9d6d8b9390020862ca7dc9e69c1e2b676db5898e4bfad51d66250e9af3eaf | 7d22567d91a65623d3b7f11726f55b497c383bc2d8d330e5e17161 h64: 7fe9d6d8b9390020862ca7dc9e69c1e2b676db5898e4bfad51d66250e9af3eaf logo.jpg (from gitee[.]com): f1f041c61e3086da8157745ee01c28 |
| sha256 | 89b3463664ff13ea77256094844c9cf69d3e408d3daf9ffad3aa18af39bab410 | 691904ffbef86fe3bdfa737e4ba64add4dd90358245fa2b775 3307.bin 89b3463664ff13ea77256094844c9cf69d3e408d3daf9ffad3aa18af39bab410 TermsHost.exe d341e3a9133e534ca35d5ccc54b8a79f93ff0c917790e |
| sha256 | a20d61c3d4e45413b001340afb4f98533d73e80f3b47daec42435789d12e4027 | d73fdecae27069026ecf2d833eac89976289d6fa15713a84fe dir.dir: a20d61c3d4e45413b001340afb4f98533d73e80f3b47daec42435789d12e4027 h32: 45ed59d5b27d22567d91a65623d3b7f11726f55b497c383bc2d8d3 |
| sha256 | ad68ab153623472bbd8220fb19c488ae2884d9b52bc65add5d54b1821b4b743a | ab[.]com/c-18/ss/raw/master/ss/logo[.]jpg Hashes: Logo.jpg: ad68ab153623472bbd8220fb19c488ae2884d9b52bc65add5d54b1821b4b743a a: 6ec8201ef8652f7a9833e216b5ece7ebbf70380ebd367e3385b1c0d4 |
| sha256 | ba29d8a259d33d483833387fad9c7231fbb3beb9f4e0603b204523607c622a03 | 28aa70f1140774f3d4ce9985d05a676c8535420232e2af87e pools.txt ba29d8a259d33d483833387fad9c7231fbb3beb9f4e0603b204523607c622a03 config.json 7c2dbc0d74e01a5e7c13b4a41d3a1f7564c165bd532e447 |
| sha256 | d341e3a9133e534ca35d5ccc54b8a79f93ff0c917790e7d5f73fedaa480a6b93 | 56094844c9cf69d3e408d3daf9ffad3aa18af39bab410 TermsHost.exe d341e3a9133e534ca35d5ccc54b8a79f93ff0c917790e7d5f73fedaa480a6b93 a7 442e4a8d35f9de21d5cbd9a695a24b9ac8120e548119c7f9f881ee16 |
| sha256 | d44e767132d68fdb07c23c848ff8c28efe19d1b7c070161b7bd6c0ccfc858750 | 1a5e7c13b4a41d3a1f7564c165bd532e4473acea6f46405d0889 r88.sh d44e767132d68fdb07c23c848ff8c28efe19d1b7c070161b7bd6c0ccfc858750 rootv2.sh 35cb971daafd368b71ad843a4e0b81c80225ec20d7679cfbf |
| sha256 | d7fbd2a4db44d86b4cf5fa4202203dacfefd6ffca6a0615dca5bc2a200ad56b6 | 3bc5375e7b72dbb2e883ad90ec32d6177c578a1c04c1b62054 reg9.sct d7fbd2a4db44d86b4cf5fa4202203dacfefd6ffca6a0615dca5bc2a200ad56b6 m.png ece3cfdb75aaabc570bf38af6f4653f73101c1641ce78a4bb146e |
| sha256 | ece3cfdb75aaabc570bf38af6f4653f73101c1641ce78a4bb146e62d9ac0cd50 | 4d86b4cf5fa4202203dacfefd6ffca6a0615dca5bc2a200ad56b6 m.png ece3cfdb75aaabc570bf38af6f4653f73101c1641ce78a4bb146e62d9ac0cd50 hidden executable in m.png |
| sha256 | f1f041c61e3086da8157745ee01c280a8238a379ca5b4cdbb25c5b746e490a9b | 76db5898e4bfad51d66250e9af3eaf logo.jpg (from gitee[.]com): f1f041c61e3086da8157745ee01c280a8238a379ca5b4cdbb25c5b746e490a9b logo.jpg (from gitlab[.]com): ad68ab153623472bbd8220fb19c48 |
| sha256 | f6a150acfa6ec9d73fdecae27069026ecf2d833eac89976289d6fa15713a84fe | f7a9833e216b5ece7ebbf70380ebd367e3385b1c0d4a43972fb cron.d: f6a150acfa6ec9d73fdecae27069026ecf2d833eac89976289d6fa15713a84fe dir.dir: a20d61c3d4e45413b001340afb4f98533d73e80f3b47daec42 |
| sha256 | f808a42b10cf55603389945a549ce45edc6a04562196d14f7489af04688f12bc | 9c44edc03f1f3971d2a898b9f1441de156832d1507590a47b41190 ZZYO F808A42B10CF55603389945A549CE45EDC6A04562196D14F7489AF04688F12BC XbashY 725efd0f5310763bc5375e7b72dbb2e883ad90ec32d6177c578a |
| url | http://93.174.93.149/.xxxzlol.tar.gz | aster/ss/h32 hxxps://gitlab[.]com/c-18/ss/raw/master/ss/h64 hxxp://93[.]174[.]93[.]149/[.]xxxzlol[.]tar[.]gz hxxps://gitee[.]com/c-888/ss/raw/master/ss/logo |
| url | http://d20blzxlz9ydha.cloudfront.net/Install.exe | 585[.]com firstomato[.]com jxtiewei[.]com ncyypx[.]net URLs hxxp://d20blzxlz9ydha[.]cloudfront[.]net/Install.exe hxxp://www[.]amazon[.]com:80/N4215/adj/amzn.us.sr.aps?s |
| url | https://gitee.com/c-888/ss/raw/master/ss/a | s/run hxxps://gitee[.]com/c-999/ss/raw/master/ss/logo[.]jpg hxxps://gitee[.]com/c-888/ss/raw/master/ss/a hxxps://gitee[.]com/c-888/ss/raw/master/ss/cron[.]d hxxps |
| url | https://gitee.com/c-888/ss/raw/master/ss/config.json | /master/ss/h64 hxxps://gitlab[.]com/c-18/ss/raw/master/ss/a hxxps://gitee[.]com/c-888/ss/raw/master/ss/config[.]json hxxps://gitlab[.]com/c-18/ss/raw/master/ss/config[.]jso |
| url | https://gitee.com/c-888/ss/raw/master/ss/cron.d | /ss/logo[.]jpg hxxps://gitee[.]com/c-888/ss/raw/master/ss/a hxxps://gitee[.]com/c-888/ss/raw/master/ss/cron[.]d hxxps://gitee[.]com/c-888/ss/raw/master/ss/dir[.]dir hx |
| url | https://gitee.com/c-888/ss/raw/master/ss/dir.dir | er/ss/a hxxps://gitee[.]com/c-888/ss/raw/master/ss/cron[.]d hxxps://gitee[.]com/c-888/ss/raw/master/ss/dir[.]dir hxxps://gitlab[.]com/c-18/ss/raw/master/ss/x hxxps://gi |
| url | https://gitee.com/c-888/ss/raw/master/ss/h32 | dir[.]dir hxxps://gitee[.]com/c-888/ss/raw/master/ss/x86_64 hxxps://gitee[.]com/c-888/ss/raw/master/ss/h32 hxxps://gitlab[.]com/c-18/ss/raw/master/ss/h64 hxxp://93[ |
| url | https://gitee.com/c-888/ss/raw/master/ss/h64 | er/ss/x hxxps://gitlab[.]com/c-18/ss/raw/master/ss/cron[.]d hxxps://gitee[.]com/c-888/ss/raw/master/ss/h64 hxxps://gitlab[.]com/c-18/ss/raw/master/ss/a hxxps://gite |
| url | https://gitee.com/c-888/ss/raw/master/ss/logo.jpg | ter/ss/h64 hxxp://93[.]174[.]93[.]149/[.]xxxzlol[.]tar[.]gz hxxps://gitee[.]com/c-888/ss/raw/master/ss/logo[.]jpg hxxps://gitlab[.]com/c-18/ss/raw/master/ss/logo[.]jpg H |
| url | https://gitee.com/c-888/ss/raw/master/ss/run | on hxxps://gitlab[.]com/c-18/ss/raw/master/ss/config[.]json hxxps://gitee[.]com/c-888/ss/raw/master/ss/run hxxps://gitlab[.]com/c-18/ss/raw/master/ss/h32 hxxps://gi |
| url | https://gitee.com/c-888/ss/raw/master/ss/upd | er/ss/x86_64 hxxps://gitlab[.]com/c-18/ss/raw/master/ss/run hxxps://gitee[.]com/c-888/ss/raw/master/ss/upd hxxps://gitlab[.]com/c-18/ss/raw/master/ss/upd hxxps://gi |
| url | https://gitee.com/c-888/ss/raw/master/ss/x | aster/ss/upd hxxps://gitlab[.]com/c-18/ss/raw/master/ss/upd hxxps://gitee[.]com/c-888/ss/raw/master/ss/x hxxps://gitlab[.]com/c-18/ss/raw/master/ss/cron[.]d hxxps |
| url | https://gitee.com/c-888/ss/raw/master/ss/x86_64 | ss/h32 hxxps://gitlab[.]com/c-18/ss/raw/master/ss/dir[.]dir hxxps://gitee[.]com/c-888/ss/raw/master/ss/x86_64 hxxps://gitee[.]com/c-888/ss/raw/master/ss/h32 hxxps://gi |
| url | https://gitee.com/c-999/ss/raw/master/ss/a | [.]170[.]197 112[.]226[.]74[.]162 Domains 3389[.]space URLs hxxps://gitee[.]com/c-999/ss/raw/master/ss/a hxxps://gitee[.]com/c-999/ss/raw/master/ss/config[.]json |
| url | https://gitee.com/c-999/ss/raw/master/ss/config.json | 9[.]space URLs hxxps://gitee[.]com/c-999/ss/raw/master/ss/a hxxps://gitee[.]com/c-999/ss/raw/master/ss/config[.]json hxxps://gitee[.]com/c-999/ss/raw/master/ss/dir[.]dir hx |
| url | https://gitee.com/c-999/ss/raw/master/ss/dir.dir | /a hxxps://gitee[.]com/c-999/ss/raw/master/ss/config[.]json hxxps://gitee[.]com/c-999/ss/raw/master/ss/dir[.]dir hxxps://gitee[.]com/c-999/ss/raw/master/ss/h32 hxxps:// |
| url | https://gitee.com/c-999/ss/raw/master/ss/h32 | .]json hxxps://gitee[.]com/c-999/ss/raw/master/ss/dir[.]dir hxxps://gitee[.]com/c-999/ss/raw/master/ss/h32 hxxps://gitee[.]com/c-999/ss/raw/master/ss/upd hxxps://gi |
| url | https://gitee.com/c-999/ss/raw/master/ss/h64 | er/ss/upd hxxps://gitee[.]com/c-999/ss/raw/master/ss/x86_64 hxxps://gitee[.]com/c-999/ss/raw/master/ss/h64 hxxps://gitee[.]com/c-999/ss/raw/master/ss/x hxxps://gite |
| url | https://gitee.com/c-999/ss/raw/master/ss/logo.jpg | /master/ss/x hxxps://gitee[.]com/c-999/ss/raw/master/ss/run hxxps://gitee[.]com/c-999/ss/raw/master/ss/logo[.]jpg hxxps://gitee[.]com/c-888/ss/raw/master/ss/a hxxps://gi |
| url | https://gitee.com/c-999/ss/raw/master/ss/run | /master/ss/h64 hxxps://gitee[.]com/c-999/ss/raw/master/ss/x hxxps://gitee[.]com/c-999/ss/raw/master/ss/run hxxps://gitee[.]com/c-999/ss/raw/master/ss/logo[.]jpg hxx |
| url | https://gitee.com/c-999/ss/raw/master/ss/upd | ss/dir[.]dir hxxps://gitee[.]com/c-999/ss/raw/master/ss/h32 hxxps://gitee[.]com/c-999/ss/raw/master/ss/upd hxxps://gitee[.]com/c-999/ss/raw/master/ss/x86_64 hxxps:/ |
| url | https://gitee.com/c-999/ss/raw/master/ss/x | er/ss/x86_64 hxxps://gitee[.]com/c-999/ss/raw/master/ss/h64 hxxps://gitee[.]com/c-999/ss/raw/master/ss/x hxxps://gitee[.]com/c-999/ss/raw/master/ss/run hxxps://gi |
| url | https://gitee.com/c-999/ss/raw/master/ss/x86_64 | aster/ss/h32 hxxps://gitee[.]com/c-999/ss/raw/master/ss/upd hxxps://gitee[.]com/c-999/ss/raw/master/ss/x86_64 hxxps://gitee[.]com/c-999/ss/raw/master/ss/h64 hxxps://gi |
| url | https://gitlab.com/c-18/ss/raw/master/ss/a | /ss/cron[.]d hxxps://gitee[.]com/c-888/ss/raw/master/ss/h64 hxxps://gitlab[.]com/c-18/ss/raw/master/ss/a hxxps://gitee[.]com/c-888/ss/raw/master/ss/config[.]json |
| url | https://gitlab.com/c-18/ss/raw/master/ss/config.json | /a hxxps://gitee[.]com/c-888/ss/raw/master/ss/config[.]json hxxps://gitlab[.]com/c-18/ss/raw/master/ss/config[.]json hxxps://gitee[.]com/c-888/ss/raw/master/ss/run hxxps:// |
| url | https://gitlab.com/c-18/ss/raw/master/ss/cron.d | /master/ss/upd hxxps://gitee[.]com/c-888/ss/raw/master/ss/x hxxps://gitlab[.]com/c-18/ss/raw/master/ss/cron[.]d hxxps://gitee[.]com/c-888/ss/raw/master/ss/h64 hxxps:// |
| url | https://gitlab.com/c-18/ss/raw/master/ss/dir.dir | aster/ss/run hxxps://gitlab[.]com/c-18/ss/raw/master/ss/h32 hxxps://gitlab[.]com/c-18/ss/raw/master/ss/dir[.]dir hxxps://gitee[.]com/c-888/ss/raw/master/ss/x86_64 hxxps |
| url | https://gitlab.com/c-18/ss/raw/master/ss/h32 | onfig[.]json hxxps://gitee[.]com/c-888/ss/raw/master/ss/run hxxps://gitlab[.]com/c-18/ss/raw/master/ss/h32 hxxps://gitlab[.]com/c-18/ss/raw/master/ss/dir[.]dir hxxp |
| url | https://gitlab.com/c-18/ss/raw/master/ss/h64 | er/ss/x86_64 hxxps://gitee[.]com/c-888/ss/raw/master/ss/h32 hxxps://gitlab[.]com/c-18/ss/raw/master/ss/h64 hxxp://93[.]174[.]93[.]149/[.]xxxzlol[.]tar[.]gz hxxps:// |
| url | https://gitlab.com/c-18/ss/raw/master/ss/logo.jpg | [.]gz hxxps://gitee[.]com/c-888/ss/raw/master/ss/logo[.]jpg hxxps://gitlab[.]com/c-18/ss/raw/master/ss/logo[.]jpg Hashes: Logo.jpg: ad68ab153623472bbd8220fb19c488ae2884d |
| url | https://gitlab.com/c-18/ss/raw/master/ss/run | ster/ss/x hxxps://gitlab[.]com/c-18/ss/raw/master/ss/x86_64 hxxps://gitlab[.]com/c-18/ss/raw/master/ss/run hxxps://gitee[.]com/c-888/ss/raw/master/ss/upd hxxps://gi |
| url | https://gitlab.com/c-18/ss/raw/master/ss/upd | aster/ss/run hxxps://gitee[.]com/c-888/ss/raw/master/ss/upd hxxps://gitlab[.]com/c-18/ss/raw/master/ss/upd hxxps://gitee[.]com/c-888/ss/raw/master/ss/x hxxps://gitl |
| url | https://gitlab.com/c-18/ss/raw/master/ss/x | on[.]d hxxps://gitee[.]com/c-888/ss/raw/master/ss/dir[.]dir hxxps://gitlab[.]com/c-18/ss/raw/master/ss/x hxxps://gitlab[.]com/c-18/ss/raw/master/ss/x86_64 hxxps:/ |
| url | https://gitlab.com/c-18/ss/raw/master/ss/x86_64 | r/ss/dir[.]dir hxxps://gitlab[.]com/c-18/ss/raw/master/ss/x hxxps://gitlab[.]com/c-18/ss/raw/master/ss/x86_64 hxxps://gitlab[.]com/c-18/ss/raw/master/ss/run hxxps://gi |
| url | http://www.amazon.com:80/N4215/adj/amzn.us.sr.aps?sz=160x600&oe=oe=ISO-8859-1;&sn=12275&s=3717&dc_ref=http%3A%2F%2Fwww.amazon.com | t URLs hxxp://d20blzxlz9ydha[.]cloudfront[.]net/Install.exe hxxp://www[.]amazon[.]com:80/N4215/adj/amzn.us.sr.aps?sz=160x600&oe=oe=ISO-8859-1;&sn=12275&s=3717&dc_ref=http%3A%2F%2Fwww.amazon.com hxxp://www[.]amazon[.]com:80/s/ref=nb_sb_noss_1/167-329 |
| url | http://www.amazon.com:80/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books | -8859-1;&sn=12275&s=3717&dc_ref=http%3A%2F%2Fwww.amazon.com hxxp://www[.]amazon[.]com:80/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books Hashes 55dbdb84c40d9dc8c5aaf83226ca00a3395292cc8f884bdc |
From the original article
8 min read at blog.talosintelligence.com
Cryptocurrency miners are becoming an increasingly significant part of the threat landscape. These malicious miners steal CPU cycles from compromised devices to mine cryptocurrencies and bring in income for the threat actor. In this post, we look at the activity of one particular threat actor: Rocke.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.