{
  "name": "From Dormant to Dangerous: P2Pinfect Evolves to Deploy New Ransomware and Cryptominer",
  "slug": "from-dormant-to-dangerous-p2pinfect-evolves-to-deploy-new-ransomware-and-cryptominer",
  "description": "P2Pinfect is a sophisticated malware that utilizes a peer-to-peer botnet for command and control. Initially appearing dormant, it has evolved to deploy ransomware and cryptominer payloads. The malware spreads via exploiting Redis and limited SSH capabilities. A recent update introduced a new ransomware payload that encrypts files with specific extensions, while a cryptominer targets system resources. Additionally, a usermode rootkit component aims to hide malicious processes, albeit with limitations regarding initial access permissions.",
  "published": "2024-06-27T06:14:54+00:00",
  "created_at": "2024-06-27T06:14:54+00:00",
  "modified_at": "2024-06-27T07:26:15+00:00",
  "created_at_opencti": "2024-06-27T06:14:54+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-06-27",
    "cryptominer",
    "p2pinfect",
    "ransomware",
    "rootkit",
    "rsagen",
    "worm"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "129.144.180.26"
      },
      {
        "id": "",
        "name": "88.198.117.174"
      },
      {
        "id": "",
        "name": "195.201.97.156"
      },
      {
        "id": "",
        "name": "159.69.83.232"
      },
      {
        "id": "",
        "name": "http://88.198.117.174:19999"
      },
      {
        "id": "",
        "name": "http://195.201.97.156:19999"
      },
      {
        "id": "",
        "name": "http://159.69.83.232:19999"
      },
      {
        "id": "",
        "name": "http://129.144.180.26:60107/dl/rsagen"
      },
      {
        "id": "",
        "name": "http://129.144.180.26:60107"
      },
      {
        "id": "",
        "name": "randbnothing@tutanota.com"
      },
      {
        "id": "",
        "name": "besttrcovery@firemail.cc"
      },
      {
        "id": "",
        "name": "9b74bfec39e2fcd8dd6dda6c02e1f1f8e64c10da2e06b6e09ccbe6234a828acb"
      },
      {
        "id": "",
        "name": "8a29238ef597df9c34411e3524109546894b3cca67c2690f63c4fb53a433f4e3"
      },
      {
        "id": "",
        "name": "4f949750575d7970c20e009da115171d28f1c96b8b6a6e2623580fa8be1753d9"
      },
      {
        "id": "",
        "name": "2c8a37285804151fb727ee0ddc63e4aec54d9460b8b23505557467284f953e4b"
      }
    ],
    "malware": [
      {
        "id": "08e2129e-0ca0-4e4e-9da0-381a71fb4a7a",
        "name": "rsagen",
        "slug": "rsagen"
      },
      {
        "id": "fa0b31a1-a36a-456e-898d-4adc19d8425e",
        "name": "P2Pinfect",
        "slug": "p2pinfect"
      }
    ],
    "attack_patterns": [
      {
        "id": "1e043fe4-2413-4b8e-887c-0fe45d095a24",
        "name": "T1583"
      },
      {
        "id": "eb118bf2-fdf2-4b49-a470-0acabf7608ad",
        "name": "T1505"
      },
      {
        "id": "f1bb7823-4f4b-4565-b472-bf0cfca467b1",
        "name": "T1486"
      },
      {
        "id": "6d618903-d9f6-4747-aec2-7630f43c1908",
        "name": "T1496"
      },
      {
        "id": "fcd96dc0-500e-4354-bd97-5c65718a9004",
        "name": "T1562"
      }
    ]
  },
  "external_refs": [
    "https://www.cadosecurity.com/blog/from-dormant-to-dangerous-p2pinfect-evolves-to-deploy-new-ransomware-and-cryptominer",
    "https://otx.alienvault.com/pulse/667d1f7eba160deac4b306c6"
  ]
}