【図表】
異議申し立て中のPostgreSQLのRCEの脆弱性を悪用するPGMinerの構造
弊社の分析で、PGMinerが特定のモジュールを再帰的にダウンロードすることで自
PGMinerペイロードの関係
PGMinerでのPostgreSQLのエクスプロイト コード フロー
PostgreSQLへのPGMinerのエクスプロイトコンテンツ
出典: https://unit42.paloaltonetworks.jp/pgminer-postgresql-cryptocurrency-mining-botnet/
【ブログ】
◆PGMiner: PostgreSQLを介して配信される新しい暗号通貨マイニングボットネット (UNIT42(Paloalto), 2020/12/11 12:46)
https://unit42.paloaltonetworks.jp/pgminer-postgresql-cryptocurrency-mining-botnet/
【インディケータ情報】
■ハッシュ情報(Sha256) - PGMiner -
55698654f0fbcf5a6d52f3f44bc0f2257e06835e76fb7142d449a2d1641d7e4b
6d296648fdbc693e604f6375eaf7e28b87a73b8405dc8cd3147663b5e8b96ff0
6984a04d7e435499ff267cfaf913d51e8644f6c08db8069c56f9247f1e18ba71
fef1a83ba6aba160116a8251462dd842f68464a5f767b2e3194820d62fef23b1
a935d364622ebefbee659caaa9d0af5828952ab9501591c935cf1f919e2a38ff
864ece624b7069b929385f9cf741355a371e844aa3726d340f91549562e2c604
d8c46be19ff3ea5b2c12f050f226a199aaa5f76cc1731c868e29eea6c68b6801
8d44fbbefa0c59a65e21b0d1598ff7c51487ea1cede544d1c3f56d5db0ea7807
41ef5c6b0cdd068f117902e59233991082a4ecb4877a1fb16016e756412f06ea
55698654f0fbcf5a6d52f3f44bc0f2257e06835e76fb7142d449a2d1641d7e4b
1b1d6d5f01b26e4ccf6fff8f2626f9318084dc1123ac67ed7d02f955b72a1432
0fc1332d2b20ea43d3c3fea50a48bb1991522bc6c79d518ba9b68a763ef2ad58
8a13c3fe815f15a5600fda30d132dfbd4bb54d9c766da164060dd1d66b12e9e4
6d95b593f0b5e3cc1985635ad2b943acb083833fea8123e7ac3f88f68e04edd6
101ccbad7732fb185d51b91d31a67ff058cac3bc31ec36cec05094065a97d6fd
d4cf8cfb4dc9cc3101b8c850369a71af70f11e67df7e41e9af98624ebe54ff4a
47d56fcbf5d90b9c513d8d38a2c00e4bad6ea4e1d17b05dd37feb4d63b2856e1
e3c5abe56964ddb3b4f0b3c434a9af145efca558307c65d30e8acc5aed45bedc
524cce2cf615809bc08ca80facf95f2be7c5071c4cb3eac38c20a1f0ed39ce1f
(以上は UNIT42(Paloalto) の情報: 引用元は https://unit42.paloaltonetworks.jp/pgminer-postgresql-cryptocurrency-mining-botnet/ )
■URL情報 - C2 -
nssnkct6udyyx6zlv4l6jhqr5jdf643shyerk246fs27ksrdehl2z3qd[.]onion
ojk5zra7b3yq32timb27n4qj5udk4w2l5kqn5ulhnugdscelttfhtoyd[.]onion
dreambusweduybcp[.]onion
(以上は UNIT42(Paloalto) の情報: 引用元は https://unit42.paloaltonetworks.jp/pgminer-postgresql-cryptocurrency-mining-botnet/ )
【検索】
google: PGMiner
google:news: PGMiner
google: 55698654f0fbcf5a6d52f3f44bc0f2257e06835e76fb7142d449a2d1641d7e4b
google: 6d296648fdbc693e604f6375eaf7e28b87a73b8405dc8cd3147663b5e8b96ff0
google: 6984a04d7e435499ff267cfaf913d51e8644f6c08db8069c56f9247f1e18ba71
google: fef1a83ba6aba160116a8251462dd842f68464a5f767b2e3194820d62fef23b1
google: a935d364622ebefbee659caaa9d0af5828952ab9501591c935cf1f919e2a38ff
google: 864ece624b7069b929385f9cf741355a371e844aa3726d340f91549562e2c604
google: d8c46be19ff3ea5b2c12f050f226a199aaa5f76cc1731c868e29eea6c68b6801
google: 8d44fbbefa0c59a65e21b0d1598ff7c51487ea1cede544d1c3f56d5db0ea7807
google: 41ef5c6b0cdd068f117902e59233991082a4ecb4877a1fb16016e756412f06ea
google: 55698654f0fbcf5a6d52f3f44bc0f2257e06835e76fb7142d449a2d1641d7e4b
google: 1b1d6d5f01b26e4ccf6fff8f2626f9318084dc1123ac67ed7d02f955b72a1432
google: 0fc1332d2b20ea43d3c3fea50a48bb1991522bc6c79d518ba9b68a763ef2ad58
google: 8a13c3fe815f15a5600fda30d132dfbd4bb54d9c766da164060dd1d66b12e9e4
google: 6d95b593f0b5e3cc1985635ad2b943acb083833fea8123e7ac3f88f68e04edd6
google: 101ccbad7732fb185d51b91d31a67ff058cac3bc31ec36cec05094065a97d6fd
google: d4cf8cfb4dc9cc3101b8c850369a71af70f11e67df7e41e9af98624ebe54ff4a
google: 47d56fcbf5d90b9c513d8d38a2c00e4bad6ea4e1d17b05dd37feb4d63b2856e1
google: e3c5abe56964ddb3b4f0b3c434a9af145efca558307c65d30e8acc5aed45bedc
google: 524cce2cf615809bc08ca80facf95f2be7c5071c4cb3eac38c20a1f0ed39ce1f
【VT検索】
https://www.virustotal.com/gui/file/55698654f0fbcf5a6d52f3f44bc0f2257e06835e76fb7142d449a2d1641d7e4b
https://www.virustotal.com/gui/file/6d296648fdbc693e604f6375eaf7e28b87a73b8405dc8cd3147663b5e8b96ff0
https://www.virustotal.com/gui/file/6984a04d7e435499ff267cfaf913d51e8644f6c08db8069c56f9247f1e18ba71
https://www.virustotal.com/gui/file/fef1a83ba6aba160116a8251462dd842f68464a5f767b2e3194820d62fef23b1
https://www.virustotal.com/gui/file/a935d364622ebefbee659caaa9d0af5828952ab9501591c935cf1f919e2a38ff
https://www.virustotal.com/gui/file/864ece624b7069b929385f9cf741355a371e844aa3726d340f91549562e2c604
https://www.virustotal.com/gui/file/d8c46be19ff3ea5b2c12f050f226a199aaa5f76cc1731c868e29eea6c68b6801
https://www.virustotal.com/gui/file/8d44fbbefa0c59a65e21b0d1598ff7c51487ea1cede544d1c3f56d5db0ea7807
https://www.virustotal.com/gui/file/41ef5c6b0cdd068f117902e59233991082a4ecb4877a1fb16016e756412f06ea
https://www.virustotal.com/gui/file/55698654f0fbcf5a6d52f3f44bc0f2257e06835e76fb7142d449a2d1641d7e4b
https://www.virustotal.com/gui/file/1b1d6d5f01b26e4ccf6fff8f2626f9318084dc1123ac67ed7d02f955b72a1432
https://www.virustotal.com/gui/file/0fc1332d2b20ea43d3c3fea50a48bb1991522bc6c79d518ba9b68a763ef2ad58
https://www.virustotal.com/gui/file/8a13c3fe815f15a5600fda30d132dfbd4bb54d9c766da164060dd1d66b12e9e4
https://www.virustotal.com/gui/file/6d95b593f0b5e3cc1985635ad2b943acb083833fea8123e7ac3f88f68e04edd6
https://www.virustotal.com/gui/file/101ccbad7732fb185d51b91d31a67ff058cac3bc31ec36cec05094065a97d6fd
https://www.virustotal.com/gui/file/d4cf8cfb4dc9cc3101b8c850369a71af70f11e67df7e41e9af98624ebe54ff4a
https://www.virustotal.com/gui/file/47d56fcbf5d90b9c513d8d38a2c00e4bad6ea4e1d17b05dd37feb4d63b2856e1
https://www.virustotal.com/gui/file/e3c5abe56964ddb3b4f0b3c434a9af145efca558307c65d30e8acc5aed45bedc
https://www.virustotal.com/gui/file/524cce2cf615809bc08ca80facf95f2be7c5071c4cb3eac38c20a1f0ed39ce1f
https://www.virustotal.com/gui/domain/nssnkct6udyyx6zlv4l6jhqr5jdf643shyerk246fs27ksrdehl2z3qd.onion
https://www.virustotal.com/gui/domain/ojk5zra7b3yq32timb27n4qj5udk4w2l5kqn5ulhnugdscelttfhtoyd.onion
https://www.virustotal.com/gui/domain/dreambusweduybcp.onion
