Along with the ever-increasing popularity of cryptominers, the number of cryptominer trojans circulating and infecting unsuspecting victims. A major problem with cryptominers, however, is that they are easily detected by victims, as they usually use 100% of their system's processing power.
A new variant of the common miner that is circulating adds the capabilities of a rootkit to a regular miner. The result is causing headaches for system administrators, as they cannot identify which process is bringing their systems to their knees.
According to research by TrendMicro, a powerful combo, cryptominer with rootkit properties, has been detected, which is capable of hiding the process from monitor tools. “We recently discovered a new malware named Coinminer.Linux.KORKERDS.AB, which targets systems running Linux. Monitor tools such as htop do not show the process that is exhausting the computer’s processing power, while at the same time it appears to be using 100% of the processor. In addition, the malicious process also includes automatic update capabilities from its creator”
While it has not yet been determined through which program the rootkit infects Linux systems, TrendMicro researchers believe it is done through a compromised plugin, or through a media streaming program.
In the version tested by the researchers, it was observed that the malware files are stored in the /Top/kworkerds directory, from where they are executed. When the rootkit is not installed, the process appears, along with 100% processor usage.
However, when the rootkit is installed, the process disappears, while processor usage remains at 100%.
As you can imagine, using a rootkit to hide a cryptominer can be an effective tool to avoid its removal. Unfortunately, this will also be a nightmare for system administrators and users who can't figure out why their computer is slowing down so much.
