Loading malware…
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
The malware, kerberods... installs itself via cron jobs
we observed one of these vulnerabilities, the widget connector vulnerability CVE-2019-3396, being exploited by threat actors to perform malicious attacks
The malware, kerberods... installs itself via cron jobs
The malware, kerberods... installs itself via cron jobs
It hides not only the mining process but also certain files and network traffic. It is also capable of forging the machine’s CPU usage.
Kerberods is responsible for dropping the cryptocurrency miner (khugepageds... ) and its rootkit component
Most of the hooked functions would return a “No such file or directory error” if their parameter contains the file name of the rootkit, the miner, or ld.so.preload.
Note how the version with the rootkit loaded hides the CPU usage and the mining process.
It hides not only the mining process but also certain files and network traffic.
This shell script is responsible for downloading a trojan dropper from the following servers: gwjyhs[.]com img[.]sobot[.]com
it is also being used to deliver a cryptocurrency-mining malware containing a rootkit
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.