Talos Rocke August 2018

Rocke has looked for IP addresses in the known_hosts file on the infected system and attempted to SSH into them.

Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.

Rocke has used shell scripts which download mining executables and saves them with the filename "java".

Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.

Rocke installed a cron job that downloaded and executed files from the C2.

Rocke's miner, "TermsHost.exe", evaded defenses by injecting itself into Windows processes, including Notepad.exe.

Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.

Rocke issued wget requests from infected systems to the C2.

Rocke has used Pastebin, Gitee, and GitLab for Command and Control.

Rocke used malware to download additional malicious files to the target system.

Rocke has extracted tar.gz files after downloading them from a C2 server.

Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.

Rocke has distributed cryptomining malware.

Rocke used scripts which detected and uninstalled antivirus software.

Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.

Rocke downloaded a file "libprocesshider", which could hide files on the target system.

Rocke used scripts which detected and uninstalled antivirus software.

Rocke used scripts which killed processes and added firewall rules to block traffic related to other cryptominers.