New Linux crypto-miner steals your root password and disables your antivirus

guest · Nov 23, 2018

New Linux crypto-miner steals your root password and disables your antivirus
November 23, 2018
https://www.zdnet.com/article/new-l...ur-root-password-and-disables-your-antivirus/

The latest example of this trend is a new trojan discovered this month by Russian antivirus maker Dr.Web. This new malware strain doesn't have a distinctive name, yet, being only tracked under its generic detection name of Linux.BtcMine.174.

The trojan itself is a giant shell script of over 1,000 lines of code. This script is the first file executed on an infected Linux system.
Once the trojan has a foothold on the system it uses one of two privilege escalation exploits CVE-2016-5195 (also known as Dirty COW) and CVE-2013-2094 to get root permissions and have full access to the OS.

It also downloads and runs another malware, known as the Bill.Gates trojan, a known DDoS malware strain, but which also comes with many backdoor-like functions.

in case some sysadmins want to scan their systems for the presence of this relatively new threat. More on Dr.Web's analysis of Linux.BtcMine.174 here.
Click to expand...

SuperSapien · Nov 27, 2018

I wonder if Firejail would help block this malware?

Log in or Sign up

New Linux crypto-miner steals your root password and disables your antivirus

guest Guest

SuperSapien Registered Member

Log in or Sign up

New Linux crypto-miner steals your root password and disables your antivirus

guest Guest

SuperSapien Registered Member

Useful Searches