#Linux lite virus install
#Linux lite virus update

Typically, process monitoring tools can detect the presence of a cryptocurrency miner.

#Linux lite virus install

If it fails to find one, it will download and install its rootkit and then save it as / usr/local/lib/ libdns.so. It first checks whether there is already a rootkit installed in the affected machine.

The updated version of the malware has the top function, which is responsible for downloading and installing the rootkit. This function is responsible for downloading another cryptocurrency miner ( ) in case the one downloaded by the downloadrun function didn’t work properly.įigure 5: The malware’s top function Installing the rootkit component If there were no connections, it will execute its downloadrunxm function. The shell script will sleep for 10 seconds then check whether a connection was made on port 56415.

#Linux lite virus update

If there is an update available, the shell script will then call its echocronfunction responsible for downloading and scheduling a task that will execute the malware update.įigure 4: Code snippets showing the malware’s downloadrun (top), init (center) and downloadrunxm (bottom) functions As of this writing, the link contains the string “ noupdate,” indicating that there are currently no updates for the malware. Once executed, the shell script first checks whether there is an update available for the malware. After decoding, the resulting file is also a shell script that is executed by /bin/ httpdns.įigure 2: How the shell script is downloaded and saved bin/ httpdns contains a shell script that connects and downloads another base64-encoded text file. Lastly, the downloaded shell script is executed. A scheduled task is created to run /bin/ httpdns every hour. The downloaded file, which is a shell script, is saved as /bin/ httpdns. The initial file ( ) connects and downloads a file from Pastebin. It’s not an uncommon vector, as other Linux cryptocurrency-mining malware tools have also used this as an entry point.įigure 1: The cryptocurrency-mining malware’s infection chain Installing one entails granting it admin rights, and in the case of compromised applications, malware can run with the privileges granted to the application. We construe that this cryptocurrency-mining malware’s infection vector is a malicious, third-party/unofficial or compromised plugin (i.e., media-streaming software). Interestingly, the permission model in Unix and Unix-like operating systems like Linux make it tricky to run executables with privileges.

The malware is also capable of updating and upgrading itself and its configuration file. This makes it difficult to detect, as infected systems will only indicate performance issues. It is notable for being bundled with a rootkit component ( ) that hides the malicious process’ presence from monitoring tools. We recently encountered a cryptocurrency-mining malware (detected by Trend Micro as ) affecting Linux systems. Indeed, this kind of threat is one of Trend Micro's most consistently detected malware, affecting a wide range of platforms and devices. With the popularity of cryptocurrencies, it is no surprise that cybercriminals continue to develop and fine-tune various cryptocurrency-mining malware. By Augusto II Remillano, Kiyoshi Obuchi, and Arvin Roi Macaraeg