Ebury is alive but unseen: 400k Linux servers compromised for cryptotheft and financial gain
May 15, 2024, 4:01 p.m.
Tags
External References
Description
The Ebury malware gang is continuing to expand, with hundreds of thousands of servers compromised and used to steal cryptocurrency and credit card data, according to a paper published by ESET Research on 14 May 2024.
Date
Published: May 15, 2024, 4 p.m.
Created: May 15, 2024, 4 p.m.
Modified: May 15, 2024, 4:01 p.m.
Indicators
ApacheModule
ff72489289b1aef791630546223b2f917f98ceb7c2e391737bb8ff9a15cd1593
fe4a4de274d61f3b2fe2a9103ed4cc66dfd92382057ad1a0920e8271e28c2a5b
fcd24de593f6fa2dd14612050dd79192d2e6d6e5170d171712b1f658c4daa4d9
fbcdccbdc7506720cfb1f37843f88a39d8cb6e551e7224e813a6bbc81e9b7813
f9aa316f3b0c7bfc7fef2fe6e442519a4661de5d5ed1165423b1dfe9795e4166
f6404d673cec28aaf21336f95baf2f9ebc1c2f8f55ffbd4eb2c4c9c1c0053de6
f36808dbd52c9074e87fd365a91168daadbb63681a08a9eeba5977f0731a1c04
f270258ba7902927ac917c1782b8bbfe0619d11b968758a984c9dc7f8693cea8
f2176ac3ffe8ae723f095c23c97410f20a2b500a22415e70b975faa727d0add3
ecdcf256c822a9d9f3ce011fd98f22b3ca3e345b34b2c17fa34471ab7f65edb3
ecd5a6de365683bfaeaaf555ae5dba39bf1c3591816e1549bdf521e0ae87fe5f
e8e40b73fd8b903282bd9e1de138b417f50efbf594134273e6d54b865837e4f9
e69323fb1f891726ae7589b97ebd46d1aafec87793be2b68f9b033c360e0a4d2
e67d20a83bcb45439c94f03b68af263055fc7ac6b60fd3882525c27e36254fa7
e4618296202c53b9d8714e3028ea6c290ab83f637557e1f97dea82a6fefea8fe
e3a3776a15abdee85ed2d949ae32e5312ab3a6660f10b9269f03baaeecf8ac9a
e33a1aeed5e3d670cfe002cd98ab1dd106e83a08be4def552ccec461ed2e9611
e2c40cb7fe69fa985a3d77fb083f3f2ab2c5d8848df3c432a94c6ef50f96dae6
e06c312ca77aa439175da4792ee5ea055ee78a6efb087f1126a8ade683cab249
e06115a553def25a846468290795f1a36b67dbbe7012d612d5cb7675c9170cd0
de6f016a167555a1c35f5e9d54c6874f2db1d142a833139bc57032f9dc56c3fe
ddd172c1483a5c4afc4b7ddfc8ecb6f23b789ad3751a392fbc07933619d5e42e
dd642bb34500e23a829fd33782ff4b9dd97285c350964707d74b50ce72d8a22c
db3e9c6e4b9d3b699e2940196b07a5a1cde19f6b60b83163882b736c61ca43e1
db0ff03216625bce95640c4b9931e4720684791f68cfa4adbb260b4135425521
dae9068440615750cbff522faa093a320a61185320aaa3a68499f31302a52fda
d99a13872fd36e9f9712bc10e583836db3649198d25f71097bd5e0c96c786fef
d4859d47ee892be52dc936653a5e33674fa2836291e1cb145b47114438749f72
d3f0668fee0a2bd7fc819ea1d913c6b0d51702a5afab659a7b6a6c118749cbd6
d2bc83cf8d2e785a58ab3d88ced60f1635fd25918a67820d9da0a9c6d4eea6e9
cfb64b329b95cfb7dbfac7fa61025b0cddfce3c77db1d224e839fa59defe8336
cef981a137bac96e1c2bf053da4e10c254c8d7892227e21dd5fcfb9b7ea32923
cb2f1a7ef1733faed91961ab63174e22e6fabfe658d631b5d5e3f7573418bfd5
c9cfa1f9d8b36ca653fa31d4796b23c12fb2e0a36acf4228982d8a92ba805f7b
c9ce4fd2476cc781064f1da7f6e784b38c70b7fea4f48332afae921d9e4c3dfa
c9a85949f61102bc27df7739c05c03620ba4f711d90ac9d4e9edff117332fe2e
c72973ac18d02c56b623bb402dc18d07ca8fa57f2f6b95b4f8341bd7b88334a0
c69f9eeb6f9d936ec33405a632f8f081ccd1eaa43fb88bc8daf5e27a73937eca
c00d0403fa426be3dc6219a5cb6390948fde6167314db4cb6fd3230c7cb698e2
c26ee35b75973d6d463cd39afd6764f23622f52cdd54f495cf232a741284bed1
bfefe897282c69afafc163aacb5c938e27dbbf62ad8dcb17e583b09cc1bd1493
bf4e30636cfc5b6a78067827f8d4b6a2639e4328b142deca1305a619ca001328
bed696e1a0a8a23e82a17176770f2271286b87878a2415b096efe09258b1b4e9
be4f0d9baec7a194fc7f2decb3c0a238919ba7ca87676344879b6f130f0a6654
bc6067d11ae5802fc7a174d0c4abf40bf68974dceeba8d11fa6185709f412011
bb06015d766bd6365f87b645dec7e7a469b216505921de1e3e78f0c1a6f5fc7c
b5a19a8a8250c9cd1d129f41e11b07f81508bc4d59d420c8834170e22b0bb1a0
b56ef85a632e2accdfb515fc2e9bea45f50f76635d999ec55ca85dc1883743dc
b20a25779dc2af69ebdbbe2884d9fe316477157d6dab1102d2371a65c256d8d1
afbef5352942dde22e5cfa802c057917fccb17623f3e8ead165fd17371d851f3
a2830a75fc7115aa2ac46e26391cdf7e5ab6dea73acf70b6af347a4e3766a953
9e091c5f5a66c31a822ce5714c740c69e37b3128ac2e445391a9d9dcc1194fcd
9dba448f82bd693484fdb303694e185e9eb5b9146c0b39974aa8a8ceea0a6589
9db0797cea658b62496dea9817c4fe4e752df7f5e5a08839d37d46ca69ae125a
9bc6400910443c471578695f90cbe97b94866219108664df8a8d918578280a66
998f74471bb96102781eb62713f57483dc6a6d1f27c429a957eb23bb124d7709
927269995c67da90e44e4b74f035e6c8931f8bc25db43c1e1503cf8cda201c06
91998d2f23556e3703e89b7987a87d3286ffe9b3416923e3dc3f9b86a595ce92
8cc01a0c2a3d20e2e1c29e4960e362d0258694538a23cd703f503f6969aeb356
868d3366e421238864483a08f48b4c0a933418f6bf64b7b3e291d7dae9906d6e
84876a1bcfeee7940cf9f250914360153c1317bc4c9ecb6ccf18f65d8f66e9f9
83d269ae06d961850aa6be078f6d80a180d086b0c5a306a5692e726d55e82761
82b70aed01d65d7b83aa21f89f65ebcc3b6622efe7d977540cdf8c4e90d31de7
817a971b0a74dfa8465c505da84c99bd30f9e34c5f8d0ad8651b932c45e95283
803828547baf601f31f1e203db9e5c312d1c9e223539f439a3c9079e1a91ecdf
7eaf3408cc13b8c36fafbdc0343053e82fb647b0b64e63a99bb0e90ba47c13a6
7f6328ae015850ab7d4340411e1d3ba4985ee00a0e3e4334719d9a88ef0441d9
7e9398404707c57d2a3f71ee8548045eb5b42f8c5439ebf5d5e8227738554021
7e1c91e249b5a01a726dcf97f76f2f434d60385a4a060cb0272e715c82b8d914
7cdfdab7ddef2c8bf3bca9242bad47173eaec883cffa04c7e4fade9e7868bf78
7ca7a529194978a67dd3b99f2a1c9f7b5f17215af49ec452521e442c2ffd815a
7b3cd8c1bd0249df458084f28d91648ad14e1baf455fdd53b174481d540070c6
78bc52158716a514987415afd75fdea43fef73b7f215174218881881ba82500b
7a472fb0415345e9396e708621218783cb0459e7b883ab9ded648c4712aa2475
771d40f210cd69a416b8171d73776efac4d6bdde952940e69c4cf36de56e8999
6ff082ff2a6fe8e1d22b186bf0250ee4d78cba006d4752190d7e637ffde14bb4
7542573b7dcb1ff964a8112dbf242830e882f7d4de6d241e17469043f3a0da7e
6eb60410a7129de4207c37a1ae96121c8a873df1cc96214f5c1de623fa8133d7
6b8e01987c5631e97d9bc488142a4db5c3abed013fda125471e5ccb1f6e2f6b3
6e5a89b4f161529e233f342abc048c2e6584eb7a93f4feac258a34e992b66ee1
671c9fc9a4e82499b71cee43abfbbf86d1dc01a0dbc500f265f7867715f819f9
669119b2a9d5b6e1b764acf7582574345ff5470d8717da53a8330f358ffb8904
64c548dd113403f146971a03b09033e0fe73ce653f2110ebafd773d969c44f04
6275c888fca6fc10baa70954e22ec42cb09e7e4fbcc1110dee49ebc2941ea3d4
5ff9ed0b3f0b84de100b3ee47274437a2944c23a832b2bba2153992047223ecb
6061844bf4d4b4367bb04dd8ecffae648d45161e17d7177dd03cf20429c782f3
5ff94822492a058246fa34129d0f3ec6e0f0461ef2526d2914e126eddbc7e16d
5c6c2c266e142be253cba020420744b02f821b0993fc9f4bff9ff5e356780282
5f27e51636de85a3dcc821f0dc0b46a5cbd63bde3b5ea0c10c393d25e5305463
5a9ea0c4103b96434c4d99aebafbbb61475ad0844e6bd8c649e96a145e6462d2
59b01225155517c5ece002407f669bffeca741862c5a2881631e3a14b65d1290
5a7627820254abea2ae180e6ef5db029f2a612b510736723f0d94c2e49f09065
50ebb172d4c4e13879599981adfd4ff93e22091b29eb8c8ecde04e930932a38a
5082f3417f8aaf781b4ef7a6cd53133593881ed9e488da9c12937bfe8cf17a58
4f8b94046ed3c803eafbeddaf8d6e488076af5b38e499e6d59755f737a2a62e0
4b9ae4cac87f54e86ee0e42181fda4551eafc265793889cba78876e5660c391e
4d986f3407cf76de0318e7c84ed142e7bc1f8ac6bc99793ffef76ba904eaad5b
4c7409753c40e78586d8421ac61e874c0d877758118de239f6ae566e020a9444
490a4a7fc04bb2a67e8f3c1ac71386ef2783aa886dfac01448a56a3108c5deae
49b47a373448c946e2005c0516ddbe204279c1e68d34cfa8df8f28eb24ca6a82
4665484cfebbdce0c899b12c42e11183c29637fad23f60e5465df9a9fad63dcc
435be2e2b5b15862dc37f3e3e85e549448804141897a4e732be0bd8792a5e97e
4109cebe6ee503691bf53704a249893395f618221a160e32488eb48ca6954fcc
463907381e95aa22f9f3c2b395d1030328ed055c1a53766e85e134ea24c33920
3ea7ccf3932f76b2f0af7cd33f3c0efed4dd339dba238a91ada2a0c7a1ffac0e
3d6692b7a25809789b6bd899e2c28f52c40b87dbad751558cbb22fedb3b67a7b
3bc5b33247ed6a4b22890ad47b9bcf7209a1d0f767cc441cf4d2206557ddadba
398811f4fe60d8088cf19a50208927761bd8d8dc73ce9ee77b407aaee91a3516
397062b0ba3040e5a1d64b851d6b51f39df4d8ca1046f33f2186abfbae720ca4
3913e9bf43ec6a73584b9d621f396ee035d8bd1d28a99421e405c226cd321b98
38faa26350e17dd0cc9fc714b1ef800cf599397dcfb71b94812feae38ba78996
348148cc3efef8d544708ada0c2cb34b8d508f0715c2fb6e33b325a1247e7163
347c4fb37590644e2658cc97b38d5b0e09bb1f2f84928bfb3a64b0ca34fdb0b2
33ded5914025e70f6f5f109ea85179fb6373bb757da95e89958bf7a957b446bc
3127d2211bfea0d1a132d53e709c0d11dddfa32f497c4ab7f348350144b07d65
2ddb50f2d60c4b8bc50aa03206c6397b56fdda210bd2a935de5fb419a52fa56d
291be73e079ea1c39825da77b0628443c3800658846aaf76c2eb29b3a7deeeed
290b03d8d8082d3dd06c4b18287a3fb726b2eee7b9373b15fab93d9e4a4b5df9
2596956e0eb0f1e59d3275e557caf9974942db3d6927e2215243034f5c792916
2343255b3e2c6380454bf56fecb3e1368261b15b08f59f9b7eb37bc8acaae01a
1fa6d970dcc2bcccedbd545c85b3184dc3663ebdade04ed18410d0329ecbef81
1ea1c30e5dfa4a42dd3d393e508a75bcee1658a1a13ddc1b593f609b8648f9fc
1da2b0f230fdb695e161767a4fd7ed80fee1153a70a78032e4219c4898c3532d
1d6a0e9565b80e265fd5b193f2b1ba703afd0e5e284b2ea3e52925d73d2a60fb
1bc7eb07aaad906ca9822b827b9f0a0c6ea323ce4914f8aa5cf1df69f2462bd6
15298ef46a68803a3eeeac84e22df6836b991650f78ec2d1de379b0e6a86ef86
1471ec61976665e1e088a757d74c718aff82a737c66669f4a7460609fcdb43e4
1272daef8e1a8143c967676b120cc69be39031efe03593e1006f185e48f428e1
11ac32b7d5d1db9ab0b403a3e9637a7ada87c329c030fa0b491d335485dd5f42
10f7b527ccd1f846a5da8df25d6edecc7370cd98f9c25b5626fa88d152f42a95
107d3db3f4f760c212a2a2baa407e2414b4d83822134353b68f4079e5c4f4deb
0fba87d17bfc539680ed32df31b5b6b42ce5709eed7e4fc3d08d980f92267e42
0e45d547d54241595a1b2504d1c1f6991296a2b0196f0e653773615a8e3f39d1
06243598428c70ae07ec6651549378ee18d8b4ad4474b48a4ecf80775075a0ec
07a1a43bbcc747520a5afb91bd050c51541922cf4f4cf715dc6916e66dd204a9
0395e1c8f0bab7970782f9ce37fd2b5763b514bc52577e19d4d0d18c7b857546
02b0e3b6c60b53aa4daf5534459b595f9aa8e73ab257ed8a580090b0cf6fb213
01f8a935832048a6c116b376db82a83890e6375586e830e87ca3c244b71392b5
024f0e8e28b340a657d7e955edb37b9e819507aec00148d49f524e53301e8930
003245047359e17706e4504f8988905a219fcb48865afea934e6aafa7f97cef6
Attack Patterns
Ebury
Ebury
T1014
T1199
T1016
T1105
T1003
Additional Informations
Bitcoin