Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Eleethub: A Cryptocurrency Mining Botnet with Rootkit for Self-Hiding

Summary: Unit 42 researchers uncovered a botnet campaign, Eleethub, that uses a Perl Shellbot to mine Bitcoin on compromised devices while hiding its activity with a shared library called libprocesshider.so and a crafted rootkit that replaces the ps tool and filters out mining processes and keywords like proc, netstats, and tops. The botnet spreads via a malicious shell script that downloads further scripts, connects to an IRC server on UnderNet using nicknames starting with 'dark' plus a random integer between 0 and 8999, and was still under development with few recruiters when found.

Bottom line: The rootkit hides xmrig and emech from antivirus and from competing coin miners like Outlaw that scan running processes, so standard process-level detection may not surface the infection. Unit 42 estimates the botnet could grow to make thousands of dollars over one to two years, and the same implant is built to launch UDP floods, TCP floods, port scans, and HTTP attacks.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related