As the popularity of cryptocurrencies increases, so does the amount of cryptominer Tokens being generated and distributed to unsuspecting victims. One problem for cryptominers, however, is that the hacking process is easily detectable, due to the high CPU usage.
To make it harder to detect a CPU-intensive cryptomining process, a new variant has been discovered for Linuxthat attempts to hide its presence using a rootkit.
According to a new report from TrendMicro, this new cryptominer-rootkit combination will still cause performance issues due to high CPU utilization, but administrators will not be able to identify which process is causing them.
“We recently encountered a cryptocurrency-mining malware (detected by Trend Micro as Coinminer.Linux.KORKERDS.AB) affecting Linux systems,” TrendMicro states in a report . “Notably, it is bundled with a rootkit component (Rootkit.Linux.KORKERDS.AA) that hides the presence of the malicious processes from monitoring tools, making it difficult to detect, as infected systems will only report performance issues. The malware is also capable of updating and upgrading itself, and does the same to its configuration file.”
While it is not known what software this miner installs, TrendMicro believes it is an unofficial add-on, such as media-streaming software. Once installed, the executable will download and execute a series of shell scripts that will eventually install the miner and then a rootkit to hide the presence of the miners.
In the variant detected by TrendMicro, the cryptominer will install itself in /tmp/kworkerds and run. When the rootkit is not installed, you can easily see the kworkerds process as it is using 100% of the CPU.
Once the rootkit is installed however, the process causing the high CPU usage is not visible, even though the overall system usage still shows as 100%.
As you can see, using a rootkit to hide a cryptominer can be an effective tool to prevent its removal. Unfortunately, this will also be a nightmare for system administrators and users who can't figure out why their computer is using so much CPU.
