Vulnerabilitymedium
Watchbog and the Importance of Patching
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-1000861 | Unauthenticated RCE in Jenkins Stapler Web Framework via Crafted URLs | 9.8 | 98% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | aziplcr72qjhzvin.onion.to | C8A2D31D45D931E8401F13F7377932BA07D871DC42F252B9CA Domains: aziplcr72qjhzvin[.]onion[.]to Misc: Monero Wallet (Same wallet as the Alibaba Cloud P |
| domain | pixeldrain.com | our investigation the URL was no longer accessible. hXXps://pixeldrain[.]com/api/file/ZuVWceWG der_ke: This variable contains a Pasteb |
| sha256 | 0b0567c9b45ea0a3ea4267001f0760ccdf2b8224fceaf8979d32fcceb2d6fb7a | 0fdfa5036ccfa5d9c2b43cbfd814bce8778978873057b86678e5295fc61 0b0567c9b45ea0a3ea4267001f0760ccdf2b8224fceaf8979d32fcceb2d6fb7a 3A6271A90D0F6CC8A2D31D45D931E8401F13F7377932BA07D871DC42F25 |
| sha256 | 3a6271a90d0f6cc8a2d31d45d931e8401f13f7377932ba07d871dc42f252b9ca | 7c9b45ea0a3ea4267001f0760ccdf2b8224fceaf8979d32fcceb2d6fb7a 3A6271A90D0F6CC8A2D31D45D931E8401F13F7377932BA07D871DC42F252B9CA Domains: aziplcr72qjhzvin[.]onion[.]to Misc: Monero Wallet |
| sha256 | b383d0fdfa5036ccfa5d9c2b43cbfd814bce8778978873057b86678e5295fc61 | ve been observed associated with Watchbog. Hashes (SHA256): b383d0fdfa5036ccfa5d9c2b43cbfd814bce8778978873057b86678e5295fc61 0b0567c9b45ea0a3ea4267001f0760ccdf2b8224fceaf8979d32fcceb2d |
| url | https://github.com/fireice-uk/xmr-stak/releases/download/2.10.3/xmr-stak-linux-2.10.3-cpu.tar.xz | he Github repository that hosts the XMR-Stak mining client. hXXps://github[.]com/fireice-uk/xmr-stak/releases/download/2.10.3/xmr-stak-linux-2.10.3-cpu.tar.xz con_url: This variable contains the Pastebin URL that is |
| url | https://github.com/xmrig/xmrig/releases/download/v2.14.1/xmrig-2.14.1-xenial-x64.tar.gz | s the Github URL that hosts the XMrig monero mining client. hXXps://github[.]com/xmrig/xmrig/releases/download/v2.14.1/xmrig-2.14.1-xenial-x64.tar.gz mi_32: This variable contains a Pixeldrain URL. During ou |
| url | https://pastebin.com/raw/aJkbTx6Y | itional configuration file to be used by the mining client. hXXps://pastebin[.]com/raw/aJkbTx6Y The script then starts the Watchbog process and deletes t |
| url | https://pastebin.com/raw/DzgYb9mu | cutes it. This base64 encoded blob contains a Pastebin URL (hXXps://pastebin[.]com/raw/DzgYb9mu) which was used to host the following Python script. The |
| url | https://pastebin.com/raw/hURdMBLd | et is included in the Alibaba Cloud post mentioned earlier. hXXps://pastebin[.]com/raw/hURdMBLd The download function then writes the contents retrieved |
| url | https://pastebin.com/raw/irzk5mSh | itional configuration file to be used by the mining client. hXXps://pastebin[.]com/raw/irzk5mSh poo_url:This variable contains an additional Pastebin URL |
| url | https://pastebin.com/raw/YJH8sWr | used to host the configuration file for the mining client. hXXps://pastebin[.]com/raw/YJH8sWr Cpu_url: This variable contains an additional Pastebin UR |
| url | https://pixeldrain.com/api/file/ZuVWceWG | During our investigation the URL was no longer accessible. hXXps://pixeldrain[.]com/api/file/ZuVWceWG der_ke: This variable contains a Pastebin URL. The URL wa |
From the original article
9 min read at blog.talosintelligence.com
Cisco Incident Response (CSIRS) recently responded to an incident involving the Watchbog cryptomining botnet. The attackers were able to exploit CVE-2018-1000861 to gain a foothold and install the Watchbog malware on the affected systems. This Linux-based malware relied heavily on Pastebin for command and control (C2) and operated openly.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.