New SHC-compiled Linux malware installs cryptominers, DDoS bots

guest · Jan 4, 2023

By Bill Toulas @billtoulas - January 4, 2023

A new Linux malware downloader created using SHC (Shell Script Compiler) has been spotted in the wild, infecting systems with Monero cryptocurrency miners and DDoS IRC bots.
Click to expand...

According to ASEC researchers, who discovered the attack, the SHC loader was uploaded to VirusTotal by Korean users, with attacks generally focused on Linux systems in the same country.

The analysts say the attacks likely rely on brute-forcing weak administrator account credentials over SSH on Linux servers.
Click to expand...

Stealthy loading
SHC is a "generic shell script compiler" for Linux, able to convert Bash shell scripts into ELF (Linux and Unix executables) files.
Malicious Bash shell scripts used by threat actors typically contain system commands, which can be detected by security software installed on a Linux device.

As scripts in SHC ELF executables are encoded using the RC4 algorithm, the malicious commands are not as easily seen by the security software, potentially allowing the malware to evade detection.
Click to expand...

One of the payloads is an XMRig miner that is downloaded as a TAR archive from a remote URL and extracted to "/usr/local/games/" and executed.
The second payload retrieved, dropped, and loaded by the SHC malware downloader is a Pearl-based DDoS IRC bot.

Bundling the configuration with the miner helps minimize communications with the C2 and keeps the crypto mining going in case the threat actor's server goes offline.
Click to expand...

ASEC warns that attacks like these are typically caused by using weak passwords on exposed Linux servers.

"Because of this, administrators should use passwords that are difficult to guess for their accounts and change them periodically to protect the Linux server from brute force attacks and dictionary attacks, and update to the latest patch to prevent vulnerability attacks," advises ASEC.
Click to expand...

ASEC: Shc Linux Malware Installing CoinMiner

The ASEC analysis team recently discovered that a Linux malware developed with Shc has been installing a CoinMiner. It is presumed that after successful authentication through a dictionary attack on inadequately managed Linux SSH servers, various malware were installed on the target system. Among those installed were the Shc downloader, XMRig CoinMiner installed through the former, and DDoS IRC Bot, developed with Perl.
Click to expand...

Log in or Sign up

New SHC-compiled Linux malware installs cryptominers, DDoS bots

guest Guest

Log in or Sign up

New SHC-compiled Linux malware installs cryptominers, DDoS bots

guest Guest

Useful Searches