Giter Club home page Giter Club logo

malware-cryptominer-container's Introduction

Container image with malware and crypto miner for testing purposes

Container build

Ransomware Malware Threat Actor

I decided to build minimal nginx based container image which contains the following malware / crypto miner:

The malware/crypto miner are stored inside container in directory:

/usr/share/nginx/html/
├── 50x.html
├── Fantom.exe
├── Linux.Trojan.Multiverze.elf.x86
├── MadMan.exe
├── eicar
│   ├── eicar.com
│   ├── eicar.com.txt
│   └── eicarcom2.zip
├── index.html
└── xmrig
    ├── xmrig
    └── xmrig-linux-static-x64.tar.gz

List of malware/ransomware/crypto miner files located in the container:

Container details

CloudFormation

Run the EC2 instance with docker and the quay.io/petr_ruzicka/malware-cryptominer-container container with SSM enabled (only console access):

# Create CloudFormation Stack
aws cloudformation create-stack --capabilities CAPABILITY_IAM --stack-name ${USER}-malware-cryptominer-container-test \
 --template-body file://EC2InstanceWithDockerSample.yaml \
 --tags Key=Name,Value=${USER}-malware-cryptominer-container-test \
        Key=used_for,Value=dev

# Delete CloudFormation Stack
aws cloudformation delete-stack --stack-name ${USER}-malware-cryptominer-container-test

Scanner tests

Few scanners which I used to identify the problems inside container image. Output results will change in the future...

Scanner tests were executed on: 2022-11-28

Aqua Scanner

❯ docker pull quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1
❯ docker run -it --rm -v /var/run/docker.sock:/var/run/docker.sock registry.aquasec.com/scanner:2022.4 \
  -H https://xxxxxxxxx.cloud.aquasec.com -U 'ruzickap-scanner-test' -P 'xxxxxxx' \
  scan --local --scan-malware --collect-sensitive quay.io/petr_ruzicka/malware-cryptominer-container:1.2.0

2022-11-28 09:57:00.385 INFO  Logger started with level INFO
2022-11-28 09:57:02.351 INFO  Registering with server {"os": "linux", "os_version": "", "registries": []}
2022-11-28 09:57:02.553 INFO  Successfully registered {"scanner_id": 8894}
2022-11-28 09:57:03.066 INFO  Starting Scan Image {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1"}
2022-11-28 09:57:03.376 INFO  Start getting image information from registry... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63"}
2022-11-28 09:57:03.376 INFO  Connecting to registry... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63"}
2022-11-28 09:57:03.380 INFO  Requesting authorization to pull image... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63"}
2022-11-28 09:57:03.386 INFO  Getting image manifest... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63"}
2022-11-28 09:57:03.394 INFO  Found several platforms matching request, choosing first one {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "selected": "amd64::linux:", "matches": ["amd64::linux:"]}
2022-11-28 09:57:03.394 INFO  Getting image history... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:03.394 INFO  Getting image metadata... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:03.495 INFO  Working with Layer Digest Ids {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:03.495 INFO  End getting image information from registry... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:", "seconds": 0}
2022-11-28 09:57:03.495 INFO  Start getting assurance policies from server... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:03.495 INFO  Getting assurance policies... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:03.703 INFO  End getting assurance policies from server... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:", "seconds": 0}
2022-11-28 09:57:03.703 INFO  Start fetching security feed from server... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:03.804 INFO  Latest security feeds need to be pulled from server. {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:04.042 INFO  Latest security feeds need to be pulled from server. {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:04.154 INFO  Latest security feeds need to be pulled from server. {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:04.267 INFO  End fetching security feed from server... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:", "seconds": 1}
2022-11-28 09:57:04.267 INFO  Start pulling image... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:04.267 INFO  Start pulling image in Dockerless mode... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:05.806 INFO  End pulling image in Dockerless mode... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:", "seconds": 1}
2022-11-28 09:57:05.806 INFO  End pulling image {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:", "seconds": 1}
2022-11-28 09:57:05.806 INFO  Start analyzing image layer by layer without Docker... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:05.806 INFO  Start analyzing image by layer without Docker... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:06.836 INFO  End analyzing image by layer without Docker... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:", "seconds": 1}
2022-11-28 09:57:06.836 INFO  End analyzing image layer by layer without Docker... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:06.836 INFO  Contacting CyberCenter... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:07.309 INFO  Start merging layers analysis... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:07.310 INFO  End merging layers analysis... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:", "seconds": 0}
2022-11-28 09:57:07.310 INFO  Start Contacting CyberCenter... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:07.528 INFO  End Contacting CyberCenter... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:", "seconds": 0}
2022-11-28 09:57:07.528 INFO  Start processing results... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:07.631 INFO  End processing results... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:", "seconds": 0}
2022-11-28 09:57:07.632 INFO  Start applying assurance policies... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:07.833 INFO  Applying image assurance policies... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:"}
2022-11-28 09:57:07.834 INFO  End applying assurance policies... {"registry": "", "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1", "requested platform": "amd64:::", "job ID": "083a6798-35ea-4072-bafe-4485e2afafd1", "server version": "2022.4.64c5032a63", "scanning platform": "amd64::linux:", "seconds": 0}
2022-11-28 09:57:10.372 INFO  Skipping file hash saving.
{
  "image": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1",
  "scan_started": {
    "seconds": 1669629423,
    "nanos": 66194361
  },
  "scan_duration": 4,
  "image_size": 21565163,
  "digest": "sha256:d2723bc94d508dbbc1e1cff6c220a2d477603949b2a174c9360faad39eee1f15",
  "metadata": {
    "repo_digests": [
      "quay.io/petr_ruzicka/malware-cryptominer-container@sha256:447d3dc3ac81de3ae443decbfd0bce5ec10561d4f916e80cd56be072331b63b4"
    ]
  },
  "os": "alpine",
  "version": "3.16.3",
  "image_assurance_results": {
    "checks_performed": [
      {
        "policy_id": 265,
        "policy_name": "mypolicy",
        "control": "root_user"
      },
    ...
    ...
    ...
    ]
  },
  "vulnerability_summary": {},
  "scan_options": {
    "scan_executables": true,
    "scan_sensitive_data": true,
    "scan_malware": true,
    "scan_files": true,
    "scan_timeout": 3600000000000,
    "manual_pull_fallback": true,
    "save_adhoc_scans": true,
    "use_cvss3": true,
    "dockerless": true,
    "system_image_platform": "amd64:::",
    "telemetry_enabled": true,
    "scan_elf": true,
    "enable_fast_scanning": true,
    "memoryThrottling": true,
    "suggest_os_upgrade": true,
    "seim_enabled": true,
    "adhoc_scan_retention": 30
  },
  "initiating_user": "ruzickap-scanner-test",
  "data_date": 1669618636,
  "pull_name": "quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1",
  "scan_id": 1262414,
  "required_image_platform": "amd64:::",
  "scanned_image_platform": "amd64::linux:",
  "security_feeds_used": {
    "executables": "ef4e6ffe9e909f"
  },
  "image_id": 2264896,
  "internal_digest_id": {
    "id": 187617
  },
  "local": true,
  "OriginFromHostImage": true,
  "CanSkipFileHashSave": true
}
2022-11-28 09:57:10.584 INFO  Deregistering from console
2022-11-28 09:57:10.686 INFO  Scan successfully completed.

Aqua - Image details Aqua - Images

Trivy Scanner

Live web scan: https://trivy.dev/results/?image=quay.io/petr_ruzicka/malware-cryptominer-container:1.2.0

❯ trivy image quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1
2022-11-28T11:00:41.908+0100  INFO  Vulnerability scanning is enabled
2022-11-28T11:00:41.909+0100  INFO  Secret scanning is enabled
2022-11-28T11:00:41.909+0100  INFO  If your scanning is slow, please try '--security-checks vuln' to disable secret scanning
2022-11-28T11:00:41.909+0100  INFO  Please see also https://aquasecurity.github.io/trivy/v0.34/docs/secret/scanning/#recommendation for faster secret detection
2022-11-28T11:00:41.960+0100  INFO  Detected OS: alpine
2022-11-28T11:00:41.960+0100  INFO  Detecting Alpine vulnerabilities...
2022-11-28T11:00:41.962+0100  INFO  Number of language-specific files: 0

quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1 (alpine 3.16.3)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

Prisma Cloud Scanner

(Files are extracted to the disk, where the scanner is running)

Locally installed MS Defender is alerting - seems like the content of the container image is extracted to the disk during scan

❯ docker pull quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1
❯ twistcli images scan --address=https://us-west1.cloud.twistlock.com/xxxxxxxxxxxxxx --details --user xxxx --password xxxx quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1
Scan results for: image quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1 sha256:d2723bc94d508dbbc1e1cff6c220a2d477603949b2a174c9360faad39eee1f15

Vulnerabilities found for image quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1: total - 0, critical - 0, high - 0, medium - 0, low - 0
Vulnerability threshold check results: PASS

Compliance Issues
+----------+------------------------------------------------+
| SEVERITY |                  DESCRIPTION                   |
+----------+------------------------------------------------+
| critical | Image contains malware                         |
+----------+------------------------------------------------+
| high     | Image contains binaries used for crypto mining |
+----------+------------------------------------------------+

Compliance found for image quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1: total - 2, critical - 1, high - 1, medium - 0, low - 0
Compliance threshold check results: PASS
Link to the results in Console: https://app4.prismacloud.io/compute?computeState=/monitor/vulnerabilities/images/ci?search=sha256%3Ad2723bc94d508dbbc1e1cff6c220a2d477603949b2a174c9360faad39eee1f15

Prisma Cloud - Image details

Wiz.io Scanner

(Files are extracted to the disk, where the scanner is running)

Locally installed MS Defender is alerting - seems like the content of the container image is extracted to the disk during scan

❯ docker pull quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1
❯ wizcli docker scan --image quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1
           _            _ _
 __      _(_)____   ___| (_)
 \ \ /\ / / |_  /  / __| | |
  \ V  V /| |/ /  | (__| | |
   \_/\_/ |_/___|  \___|_|_|
 SUCCESS  Ready to scan Docker image quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1
 SUCCESS  Scanned Docker image
 SUCCESS  Docker image scan analysis ready
Evaluated policy: Default vulnerabilities policy
Vulnerabilities: CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0, INFORMATIONAL: 0
    Total: 0, out of which 0 are fixable
    Scan was successfully performed and no vulnerabilities were detected
Scan results: PASSED. Container image meets policy requirements

Wiz CICD Scans - Container image

Anchore - Grype Scanner

(Files are extracted to the disk, where the scanner is running)

❯ grype --scope all-layers quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1
 ✔ Vulnerability DB        [updated]
 ✔ Loaded image
 ✔ Parsed image
 ✔ Cataloged packages      [32 packages]
 ✔ Scanned image           [0 vulnerabilities]

No vulnerabilities found

Snyk Scanner

❯ docker scan quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1

Testing quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1...

Package manager:   apk
Project name:      docker-image|quay.io/petr_ruzicka/malware-cryptominer-container
Docker image:      quay.io/petr_ruzicka/malware-cryptominer-container:1.2.1
Platform:          linux/amd64
Base image:        alpine:3.16.3

✔ Tested 18 dependencies for known vulnerabilities, no vulnerable paths found.

According to our scan, you are currently using the most secure version of the selected base image

For more free scans that keep your images secure, sign up to Snyk at https://dockr.ly/3ePqVcp

Snyk - Container image

Local tests

Container build:

docker build . -t malware-cryptominer-container

Run container and download the malware file:

docker run -it --rm -p 8080:8080 malware-cryptominer-container

wget http://localhost:8080/xmrig/xmrig
wget http://localhost:8080/eicar/eicar.com

Debug container:

docker run -it --rm --entrypoint=/bin/sh --user root -p 8080:8080 malware-cryptominer-container

Run in Kubernetes:

kubectl run malware-cryptominer --image=quay.io/petr_ruzicka/malware-cryptominer-container:1.2.0

malware-cryptominer-container's People

Contributors

my-renovate[bot] avatar renovate-bot avatar ruzickap avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.