Best practices for handling cryptomining programs

Linux systems

1. Block malicious network communication.

   After discovering cryptomining activity on a host, the first step is to block the cryptomining Trojan's network communication to immediately control the impact, as a full remediation can be time-consuming.

   1. Run the following command to check the current system network connections.

      netstat -antp

      

   2. In the following commands, replace C&C address with a suspicious remote address (Foreign Address) that is not used by your normal business operations. Then, run the commands to add firewall rules to block all network connections between the server and the suspicious address.

      iptables -A INPUT -s C&C address -j DROP
      iptables -A OUTPUT -d C&C address -j DROP

2. Clear scheduled tasks.

   Cryptomining Trojans often use scheduled tasks to periodically download (update) and start the Trojan. Simply cleaning the process and the Trojan file is not enough to eradicate the program and can lead to recurring infections.

   Investigate the following scheduled task files and remove any tasks related to downloading or starting the cryptomining Trojan.

   • View the scheduled tasks for the current user or a specified user (username).

     crontab -l
     crontab -u username -l

   • All scheduled task files on the host.

     /etc/crontab
     /var/spool/cron/
     /etc/anacrontab
     /etc/cron.d/
     /etc/cron.hourly/
     /etc/cron.daily/
     /etc/cron.weekly/
     /etc/cron.monthly/

3. Clear auto-startup services.

   1. Run the following command to investigate all auto-startup services on the system.

      systemctl list-unit-files | grep enabled

   2. Find the unit file for the suspicious service and check its details.

      Replace * with the service name and <service_unit_name> with the service unit file name.

      ls -al /etc/systemd/system/*.service
      ls -al /usr/lib/systemd/system/*.service
      
      # View service details (the process file started by the service)
      cat /etc/systemd/system/<service_unit_name>.service

   3. If you find a malicious auto-startup service, use the following commands to disable the service and delete its unit file.

      Replace <service name> with the service name and <service_unit_name> with the service unit file name.

      systemctl disable <service name>
      rm /etc/systemd/system/<service_unit_name>.service
      rm /usr/lib/systemd/system/<service_unit_name>.service

   4. Investigate the following service paths for auto-startup services and clean them up using the steps above.

      /etc/rc.local
      /etc/inittab
      /etc/rc.d/
      /etc/init.d/

4. Clear SSH public keys.

   Cryptomining Trojans often add the attacker's SSH public key to the ~/.ssh/authorized_keys file. This allows the attacker to log on to the compromised host without a password and reinstall malicious files. Investigate the ~/.ssh/authorized_keys file and immediately delete any suspicious public keys.

5. Clear .so hijacking.

   Preloaded .so files, set via the /etc/ld.so.preload file, can hijack common system commands such as top, ps, and netstat to hide the cryptomining process.

   1. Run the following command to investigate preloaded .so files.

      cat /etc/ld.so.preload

   2. Run the following command to remove the preload hijacking.

      echo > /etc/ld.so.preload

6. Clear malicious accounts.

   Some cryptomining Trojan families create new backdoor accounts to maintain long-term control over the compromised host. Run the following commands to check for malicious accounts, then manually delete the relevant account information.

   • Check logs for recent account creation activity.

     cat /var/log/audit/audit.log | grep useradd
     # Or
     cat /var/log/secure | grep 'new user'

   • Check the /etc/passwd file for suspicious accounts.

     cut -d: -f1 /etc/passwd

   • Check the creation or last active time of an account's home directory. Pay special attention to recently created home directories.

     stat /home/guest/

7. Counter anti-modification techniques.

   After writing persistence files such as scheduled tasks and auto-startup services, some cryptomining Trojans set an immutable attribute on the file to prevent the persistence mechanism from being deleted.

   

   If you encounter this situation, run the following command to restore the file attributes before deleting the corresponding task.

   chattr -i /etc/passwd
   chattr -i /etc/crontab

8. Kill the cryptomining Trojan process.

   1. Cryptomining processes usually consume high CPU resources. You can use the following commands to investigate suspicious cryptomining processes.

      • Investigate processes consuming a large amount of the host's CPU.

        top -c

        

        ps -eo pid,ppid,cmd,%cpu --sort=-%cpu | more

        

      • Investigate abnormal network connection behavior.

        netstat -antp

        

      • Get the file path of the suspicious process.

        ls -al /proc/$PID/exe

      • Calculate the MD5 hash of the process file and look it up on the Alibaba Cloud Threat Intelligence platform.

        md5sum /proc/$PID/exe

        

   2. Run the following commands to terminate the cryptomining process and clean up the Trojan file.

      kill -9 $PID
      # Delete the process path obtained from ls -al /proc/$PID/exe
      rm /path/to/executable

Linux systems (specific cryptomining cases)

# Restore modified commands
crondir='/var/spool/cron/'"$USER"
mv /bin/ps.original /bin/ps
mv /bin/top.original /bin/top
mv /bin/pstree.original /bin/pstree

# Restore editing permissions for scheduled task files
chattr -R -ia /var/spool/cron
chattr -ia /etc/crontab
chattr -R -ia /var/spool/cron/crontabs
chattr -R -ia /etc/cron.d

# Delete suspicious scheduled tasks and payloads
sed -i '/upat.sh/d' /etc/crontab
rm -rf /etc/cron.d/httpd2
rm -rf /etc/upat.sh
rm -rf /tmp/upat.sh
rm -rf /etc/httpd2
rm -rf /tmp/httpd2

# Delete suspicious public keys
sed -i '/cKtXBjj******hVI0K7b/d' ~/.ssh/authorized_keys
sed -i '/cKtXBjj******hVI0K7b/d' /root/.ssh/authorized_keys

Windows Systems

1. In PowerShell, run the following command to investigate suspicious cryptomining processes based on CPU usage.

   Note

    ps | sort -des cpu
    While(1) {ps | sort -des cpu | select -f 15 | ft -a; sleep 1; cls}

2. Run the following command to view the executable path and command-line arguments of the cryptomining process.

   Note

   wmic process where processid=xxx get processid,executablepath,commandline,name     // xxx is the process PID

3. Terminate the cryptomining process and clean up the Trojan file.

4. Run the following command to check for connections on suspicious network ports.

   Note

   netstat -ano | findstr xxx            // xxx is the suspicious network port

5. Run the following command to check if the server's hosts file contains the mining pool address of the cryptomining program.

   Note

   type  C:\Windows\System32\drivers\etc\hosts

6. Run the following command to check for any scheduled tasks set by the cryptomining program.

   Note

   schtasks /query