CoinMiner Being Installed on Vulnerable Apache Tomcat Web Server - ASEC BLOG
Tags
maec-delivery-vectors: Watering Hole
attack-pattern: Credentials - T1589.001 Malware - T1587.001 Malware - T1588.001 Powershell - T1059.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 Tool - T1588.002 Vulnerabilities - T1588.006 Powershell - T1086
Show in Graph
Common Information
Type Value
UUID 5644bebd-9b8b-412b-9eef-2966094c1da2
Fingerprint 9d018ccfc9639fc3
Analysis status DONE
Considered CTI value 2
Text language
Published Oct. 27, 2022, 8:59 a.m.
Added to db Oct. 24, 2023, 1:36 p.m.
Last updated Nov. 17, 2024, 6:53 p.m.
Headline CoinMiner Being Installed on Vulnerable Apache Tomcat Web Server
Title CoinMiner Being Installed on Vulnerable Apache Tomcat Web Server - ASEC BLOG
Detected Hints/Tags/Attributes 40/2/22
Source URLs
Redirection Url
Details Source https://asec.ahnlab.com/en/40673/
URL Provider
Details Provider Source level domain
Details ahnlab.com asec.ahnlab.com
Attributes
Details Type #Events CTI Value
Details Domain 339 
system.net
Details Domain 358 
pastebin.com
Details Domain 31 
pool.supportxmr.com
Details File 128 
w3wp.exe
Details File 1 
tomca7.exe
Details File 6 
tomcat9.exe
Details File 2 
ta.txt
Details File 153 
config.json
Details File 23 
xmrig.exe
Details md5 1 
12799b5f179c7d84122a79fc2d4e2629
Details md5 1 
1925ba565905e6b0e6c2b2f55f9fee96
Details md5 1 
606ce310d75ee688cbffaeae33ab4fee
Details md5 1 
a969e99ce36946d7fbece73f874b4e7d
Details md5 1 
627d3815c9faf693d89cf1361706a856
Details md5 1 
4346850f1794c621d06f08e58f530365
Details md5 1 
1650d7d352a8cd12bf598f71e9daf98b
Details IPv4 1 
61.103.177.229
Details Url 1 
http://61.103.177.229:8000/css/ta.txt
Details Url 1 
https://pastebin.com/raw/3a9immp5
Details Url 1 
https://pastebin.com/raw/h4vnbnqe
Details Url 1 
http://61.103.177.229:8000/js/xmrig.exe
Details Url 1 
http://61.103.177.229:8000/css/config.json