It manages two miners
Ten payloads from this honeypot were small, single-purpose miners with the pool address compiled in. The eleventh is nine megabytes of Go, and it carries pool configuration for two different mining programs, libraries for SSH and file transfer, and the PAM authentication stack. It is not a miner. It is the process that installs and supervises one.
Nine megabytes of malware, and it does not mine anything itself.
The ten payloads before it were simple. One miner, one pool address baked in, packed down to a few hundred kilobytes. You kill the process and delete the file.
This one is written in Go. Inside are configuration keys for two separate mining programs, each with an algorithm, a pool address, a pool user and a pool password.
Next to them, libraries for SSH and for file transfer. And pam, the stack Linux uses to check passwords.
It writes its payload to a hidden file under temp, then clears the port it wants by killing whatever is already listening there.
That is not a miner. That is the thing that installs one, supervises it, and keeps its own way back in.
Check what is listening, not just what is running.
#linux#security#malware#infosec#sysadmin
❯ Check what is listening, not just what is running.