Attackers Cryptojacking Docker Images to Mine for Monero

This post is also available in: 日本語 (Japanese)

Executive Summary

Docker containers have been gaining popularity over the past few years as an effective way of packaging software applications. Docker Hub provides a strong community-based model for users and companies to share their software applications. This is also attracting the attention of malicious actors intending to make money by cryptojacking within Docker containers and using Docker Hub to distribute these images.

We identified a malicious Docker Hub account, azurenql, active since October 2019 that was hosting six malicious images intended to mine the cryptocurrency, Monero. The coin mining code within the image intends to evade network detection by using network anonymizing tools such as ProxyChains and Tor. The images hosted on this account have been collectively pulled more than two million times. For context, there are legitimate Azure related images under the official Microsoft Docker Hub account that have anywhere from a few thousand to 100 million+ pulls. One of the wallet IDs identified has been used to earn more than 525.38 XMR, which roughly translates to $36,000 USD. Additionally, when we last checked minexmr.com for this wallet ID, we saw recent activity indicating that it’s still being used.

We would like to give a shout out to the awesome security team at Docker Hub. They were very responsive and were able to take down this malicious Docker Hub account quickly in response to our notification.

Palo Alto Networks customers are protected by this threat through Threat Prevention signatures on the Next-Generation Firewall. Prisma Cloud customers are protected by this through the Trusted Images feature.

Introduction

We have identified a Docker Hub community user account named azurenql that contained eight repositories hosting six malicious Monero mining images. Here is a screenshot of the account and its repositories.

Table 1, below, provides a summary of all the images found under this Docker Hub account, listed in descending order of their pull counts. It is worth noting that the top image was pulled more than 1.47 million times.

Table 1. Summary of images found on the Docker Hub account

Docker Image Structure

To understand how the image is built, we reviewed the image structure of the image azurenql /227_135:442. The image is built in the following sequence of steps:

1. Use Ubuntu 16.04.6 LTS as the “base image”.
2. Install dependencies required for building from source, such as gcc, make, python, etc.
3. Install Tor to anonymize traffic. It is configured to listen on its default port, 9050.

1. Copy the source of ProxyChains-NG and build from source. The ProxyChains config is left as default to route its traffic through the local Tor SOCKS proxy connection.

1. Copy the source of the mining software, XMRig, and build from source.
2. Copy a custom python script dao.py and set it as the image’s Entrypoint.

Figure 2, below, demonstrates this sequence.

Custom Script dao.py Analysis

The author of these images has included a custom Python script called dao.py, which is responsible for starting the mining process within the container, and was included in all the images.

As mentioned earlier, this script is registered as the Entrypoint in the image so that as soon as the image is started, this script will run.

All the Docker images mentioned in Table 1 contain some variant of this dao.py script. The only difference between the dao.py scripts in these images is that they use a different XMRig command line invocation. The different XMRig command line invocations are listed in Table 2.

High-level execution flow of the dao.py script:

1. Find the number of CPU cores on the system.
2. Set hugepages system property to increase the hash rate.

3. Install Tor and build dependencies.
4. If proxychains-ng is not already installed, install it from https://github.com/rofl0r/proxychains-ng.git
5. If XMRig binary (“dlls”) is not present in /usr/local/bin, download it from https://github.com/nguyennhatduy2608/azures/raw/master/
6. Symlink the XMRig binary (“dlls”) under /usr/local/bin and /usr/bin
7. Start Tor in the background.
8. Launch the miner through proxychains, which in turn routes the miner traffic through the local Tor SOCKS proxy as described earlier. A list of all the different mining commands used across the different dao.py versions is included in Table 2.

The script’s execution workflow is also demonstrated in Figure 5 below.

Table 2. Different mining commands used in the dao.py scripts

Mining Infrastructure

Cryptomining is about solving a complex computational problem, which allows users to chain together blocks of transactions. These images are utilizing the processing power of the victim systems to verify transactions. Here, the image author is using two methods to mine the blocks by running these malicious images in the user's environment.

In the first method, the attacker is directly submitting the mined blocks to the central minexmr pool using a wallet ID.

When we looked up the transaction summary on the Monero mining pool, minexmr.com for this wallet ID, we saw recent activity indicating that the wallet ID is still used.

Figure 6 below shows the mining activity for this wallet in April and May 2020.

Figure 7 below indicates that this wallet ID has already earned 525.38 XMR, which roughly translates to $36,000 USD.

Whereas in the second method, the author has instances deployed on a hosting service running their own mining pool that are used to collect mined blocks.

The “Crypto Command” column in Table 2 lists examples of this method.

Conclusion

Docker containers provide a convenient way for packaging software, which is evident by its increasing adoption rate. This combined with coin mining makes it easy for a malicious actor to distribute their images to any machine that supports Docker and instantly start using its compute resources towards cryptojacking.

Palo Alto Networks Next-Generation Firewall customers subscribed for Threat Prevention are protected by this threat. Palo Alto Networks has released a Threat Signature to prevent network based delivery of the malicious images identified in this blog. Details of this signature are:

Table 3. Signature description for NGFW coverage

In addition, security best practices are recommended such as:

• • Avoid pulling or using base images from untrusted repositories.
  • Install the latest apps and threat definitions on the Palo Alto Networks Next-Generation Firewall.
  • Palo Alto Networks Prisma Cloud can be used to secure cloud deployments.

Indicators of Compromise

Images

Mining Infrastructure

Wallet ID 43ZBkWEBNvSYQDsEMMCktSFHrQZTDwwyZfPp43FQknuy4UD3qhozWMtM4kKRyrr2Nk66JEiTypfvPbkFd5fGXbA1LxwhFZf

Hostname:Port

73avhutb24chfsh6[.]onion:442

5pwcq42aa42fjzel[.]onion:442

pool[.]minexmr.com:4444

IP:Port

66[.]42.93.164:442

155[.]138.234.122:442

155[.]138.227.135:442

66[.]42.53.57:442

144[.]202.23.108:4444

Samples

dao.py script hashes

3a04405e8377dd1f159949e8acb0fa590fff965a871dc7cdc434216a4c253d1f

937d59ca356cac225c66b956d521ceaf60a4830584eea7941e378087391e0d8b

b7e07fc8eaed7b1abbd70a5b8b7b885a1dd0012498e9389b9db9fdc46cd26ef9

de518f16907ee056af49f60f098101a97cad7bcf76833169bbdfd89c06b6da93

81496a54fe3f9a7aace5b282e42853002fa2fde74a8782205edbd0106b0b8acd

5d1cb23f8f0ecd82769e9d346a06851927ac9738af1d0173c85f5457ffbde71c

Docker Hub account

hub.docker.com/u/azurenql