kerberods

The malware, kerberods... installs itself via cron jobs

The attack begins with a remote command sent to download a shell script from pastebin... This shell script kills certain processes and then downloads and executes “lsd_1”... This file is a second shell script that will drop a third shell script, “lsd_2”

we observed one of these vulnerabilities, the widget connector vulnerability CVE-2019-3396, being exploited by threat actors to perform malicious attacks

If it has root privileges, it will download and load a library into the operating system which hooks parts of Glibc to modify Glibc's behavior.

The malware, kerberods... installs itself via cron jobs

The malware, kerberods... installs itself via cron jobs

It hides not only the mining process but also certain files and network traffic. It is also capable of forging the machine’s CPU usage.

There were some attempts at obfuscation, such as base64 encoding URLs and Pastebins, but the attack was still relatively simple to uncover.

Most of the hooked functions would return a “No such file or directory error” if their parameter contains the file name of the rootkit, the miner, or ld.so.preload.

If it has root privileges, it will download and load a library into the operating system which hooks parts of Glibc to modify Glibc's behavior.

Kerberods also has multiple ways of propagating itself, spreading via SSH

Kerberods also has multiple ways of propagating itself, spreading via SSH and exploiting CVE-2019-1003001 and CVE-2019-1003000

This Linux-based malware relied heavily on Pastebin for command and control (C2) and operated openly.

the installation script would terminate their execution using the kill command... and then makes three attempts to download and install a 'kerberods' dropper using wget or curl.