04/20/2022 | News release | Distributed by Public on 04/20/2022 05:33
To generate more profit, operators of cryptocurrency miners constantly look for ways to deploy their malware on vulnerable machines. These often involve the exploitation of in-the-wild vulnerabilities in different types of operating systems. Recently, we observed the Spring4Shell vulnerability - a remote code execution bug, assigned as CVE-2022-22965, that exists in the Spring MVC (model-view-controller) and WebFlux applications running on Java Development Kit version 9 or higher and that was previously linked to the Mirai botnet - being actively exploited by malicious actors to deploy cryptocurrency miners.
These cryptocurrency miners have the potential to affect a large number of users, especially since Spring is the most widely used framework for developing enterprise-level applications in Java, with its open-source nature making it more readily adaptable for developers and companies. Furthermore, the Spring framework is not just a standalone piece of software but is part of the Spring ecosystem, which provides components for cloud, data, and security, among others.
In this blog entry, we look at how malicious actors exploit the vulnerability to deploy their cryptocurrency miners.
Malicious actors have been busy trying to find ways to exploit Spring4Shell since its disclosure at the end of March 2022. The following figure shows the total number of attempts to exploit the vulnerability that we observed from April 1 to 12, 2022. At least 700 exploitation attempts were performed daily during this period, with a peak of nearly 3,000 exploitation attempts occurring on April 3.
Among the exploitation attempts were ones aimed at deploying cryptocurrency miners. In this section, we look at how the malicious actors behind these exploitation attempts create a web shell to deploy their cryptocurrency miners.
The following code is used to create the web shell:
The web shell's content is URL-encoded using the following code:
After decoding, the resulting payload is a Spring4Shell web shell:
Before executing the payload, the malicious actors first have to determine the operating system of the machine they are infecting. They do this using a string check to see if "os.name" contains the word "ndo". If it does, then the machine is identified as Windows-based, otherwise the machine is identified as Linux-based.
Once the operating system is identified, the encoded payload is executed. The exploit uniform resource identifier (URI) containing the web shell path and parameters is shown in the following code:
The web shell is identified as zbc0fb.jsp, while the parameters w and l stand for, respectively, Windows and Linux payloads, which are Base64-encoded.
PowerShell is then executed using the following parameters:
For Windows payloads, the following PowerShell command fetches the script ldr.ps1 and executes it within memory without having to create it on-disk:
The IP address and the port of the vulnerable server are also logged on the malicious actors' infrastructure.
The following code shows ldr.ps1 and its execution flow - specifically, the redacted PowerShell script that downloads the cryptocurrency miner and executes it. (A similar PowerShell script was previously reported by The DFIR Report.)
The execution flow of the cryptocurrency miner involves the following steps:
1. The firewall is turned off using the netsh utility.
2. Other known cryptocurrency miners such as kthreaddi, sysrv, and sysrv012 are stopped or killed.
3. Other running processes listening on ports 3333, 4444, 5555, 7777, and 9000 are stopped.
4. If the process kthreaddk does not exist, the cryptocurrency miner downloads a binary, sys.exe, from 194[.]145[.]227[.]21 to C:\Users\\AppData\Roaming\.exe.5. The cryptocurrency miner then starts the process with a hidden window to avoid having the user observe visual hints of the process being executed.
6. A scheduled task with the name "BrowserUpdate" is created later, running every minute. In addition, the Windows run key is modified to run the binary sys.exe.
We are unable confirm if the exploitation attempts we analyzed for this blog entry were successful. It should be noted that we also observed Linux payloads where the script ldr.sh attempts to stop other running cryptocurrency miners to run its own payload.
We highly encourage users of the Spring framework to update their software to 5.3.18 and 5.2.20 or later to prevent the exploitation of Spring4Shell (CVE-2022-22965) from occurring on their systems. More details on how Trend Micro technologies such as Trend Micro Cloud One™ protect users from attacks using this vulnerability can be found in our security bulletin.
File |
SHA-256 |
Detection name |
ldr.ps1 |
093b72e9b4efcc30c1644a763697a235c9c3e496c421eceaac97d4babeba7108 |
Trojan.PS1.MALXMR.MPF |
sys.exe |
566b0187d8ff500d923859c98da2c96b8b581e93ac0c94dacba76328b34412b3 |
PUA.Win64.CRYPTOMINER.CFL |
kthreaddk |
67e38438759f34eaf50d8b38b6c8f18155bcc08a2e79066d9a367ea65e89aa3d |
Coinminer.Linux.MALXMR.SMDSL64 |
ldr.sh |
93d380ba2bedd37c2313924784b26fec27c9e96e4c500b5cb78259b3c824ee4e |
Coinminer.SH.MALXMR.SM |
IP address |
Detail |
194[.]145[.]227[.]21 |
Malware accomplice |