Loading malware…
8 distinct techniques documented for this family, organized by ATT&CK tactic.
The bot is propagated by sending a malicious shell script to a compromised device that then downloads other scripts.
This new campaign uses a shared library called libprocesshider.so to hide the mining processes on the infected device and a specially crafted rootkit to avoid detection.
Specifically, the malware replaces the original ps tool with a crafted one. The crafted tool calls the real ps but filters off the mining processes xmrig and emech and sensitive keywords in the ps results.
The crafted tool calls the real ps but filters off the mining processes xmrig and emech and sensitive keywords in the ps results such as proc, netstats, and tops.
Later, the compromised device could start receiving commands to send attacks such as UDP floods, TCP floods, port scans, and HTTP attacks.
A compromised device will download a malicious shell script containing commands to download pieces of the botnet and create directories to copy the downloaded files into. Next, the device executes the downloaded files.
We observed that the botnet performs Bitcoin mining on its victim devices on a growing scale using known mining tools such as xmrig and emech.
Later, the compromised device could start receiving commands to send attacks such as UDP floods, TCP floods... and HTTP attacks.
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.