Loading malware…
libprocesshider is an open-source Linux user-space rootkit-style shared library for concealing selected processes from common process-enumeration utilities, including ps, top, and lsof. It abuses dynamic-linker preloading to interpose the readdir and readdir64 directory-enumeration functions. When applications enumerate the proc filesystem, the library resolves process names and suppresses entries matching a configured process name. It does not require a kernel module and instead relies on LD_PRELOAD-based function hooking. When configured as a system-wide preload library, it can conceal a process across dynamically linked applications and provide stealth that persists through reboot while the preload configuration remains in place. Threat actors including TeamTNT have used libprocesshider to hide cryptomining and bot processes, and the Xanthe Linux cryptomining botnet deployed it to conceal its XMRig-derived miner. The tool has also been reported in Sandworm-associated activity against Ukrainian critical-infrastructure environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Libprocesshider is an open-source tool designed to hide specific processes from commonly used process-listing tools such as ps, top, and lsof by overwriting the readdir function.”
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Every process with this name will be excluded ... static const char* process_to_filter = "evil_script.py"; ... if(get_dir_name(dirp, dir_name, sizeof(dir_name)) && strcmp(dir_name, "/proc") == 0 && get_process_name(dir->d_name, process_name) && strcmp(process_name, process_to_filter) == 0) { continue; }
Every process with this name will be excluded ... strcmp(process_name, process_to_filter) == 0) { continue; }
Rocke downloaded a file "libprocesshider", which could hide files on the target system.
Libprocesshider is an open-source tool designed to hide specific processes from commonly used process-listing tools such as ps, top, and lsof by overwriting the readdir function. This technique enabled TeamTNT to conceal XMRig cryptomining and other malicious processes.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A userland process-hiding tool abused by TeamTNT via LD_PRELOAD to conceal malicious processes such as Tsunami.
An open-source LD_PRELOAD-based process-hiding tool that intercepts readdir to conceal specified processes from process-listing utilities including ps, top, and lsof. TeamTNT used it to conceal cryptomining and other malicious processes.
A Linux rootkit used here in modified form as part of the attacker toolset to hide processes on infected systems.
A malicious shared-object rootkit used by Xanthe to hide the miner process by overriding process-enumeration behavior via /etc/ld.so.preload and readdir hooking.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.