Eleethub: A Cryptocurrency Mining Botnet with Rootkit for Self
Unit 42 uncovered Eleethub, a Perl-based Bitcoin mining botnet using a crafted rootkit and libprocesshider to evade detection, still under development with few infections.
Unit 42 discovered an under-development Perl Shellbot campaign that mines Bitcoin using xmrig and emech while evading detection via a rootkit that replaces the ps tool and the LD_PRELOAD-based libprocesshider.so library. Infected devices download a malicious shell script, connect to IRC-based C2 at eleethub.com and the UnderNet network, and can receive commands for UDP/TCP floods, port scans, and HTTP attacks. The botnet can affect Unix systems and Windows 10 hosts running a Linux subsystem, and its operators use the 'Los Zetas' branding, though they are unlikely to be the Mexican drug cartel. Researchers found only a few compromised 'zombies' before the campaign expanded.
- Drops shell scripts that fetch botnet components and connect to IRC C2 servers including eleethub.com.
- Hides xmrig and emech mining processes using libprocesshider.so (LD_PRELOAD) and a crafted ps replacement rootkit.
- Filters keywords like proc, netstats, and tops from ps output to evade antivirus and rival coin miners.
- Targets Unix systems and Windows 10 with a Linux subsystem; linked to the UnderNet IRC network.
- 'Los Zetas' name is likely a homage, not attribution to the Mexican criminal organization.
- Vendors
- Palo Alto Networks
- Products
- xmrigemechlibprocesshider.so
- Threat actors
- Los Zetas
- Malware
- EleethubPerl Shellbot
- Countries
- Mexico
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | eleethub.com | s from Eleethub The domain associated with the C2 server is eleethub[.]com . We visited the website and found a message announcing t |
| domain | los.zetas.mx | , and in the information from the botnet operators undead[@]los[.]zetas[.]mx (Figure 15). “Los Zetas” is a reference to a Mexican cr |
| ipv4 | 62.210.119.142 | vers eleethub[.]com irc.eleethub[.]com ghost.eleethub[.]com 62.210.119[.]142 82.76.255[.]62 Public keys found in the server 1 2 3 4 5 |
| ipv4 | 82.76.255.62 | om irc.eleethub[.]com ghost.eleethub[.]com 62.210.119[.]142 82.76.255[.]62 Public keys found in the server 1 2 3 4 5 6 ssh - rsa AAA |
| sha256 | 14c351d76c4e1866bca30d65e0538d94df19b0b3927437bda653b7a73bd36358 | aa2d7456db3e77b676f5d265b4300aaef2d34c47399975a4f1a8f0412e4 14c351d76c4e1866bca30d65e0538d94df19b0b3927437bda653b7a73bd36358 6d1fe6ab3cd04ca5d1ab790339ee2b6577553bc042af3b7587ece0c1952 |
| sha256 | 6d1fe6ab3cd04ca5d1ab790339ee2b6577553bc042af3b7587ece0c195267c9b | 1d76c4e1866bca30d65e0538d94df19b0b3927437bda653b7a73bd36358 6d1fe6ab3cd04ca5d1ab790339ee2b6577553bc042af3b7587ece0c195267c9b C2 servers eleethub[.]com irc.eleethub[.]com ghost.eleethub |
| sha256 | 7ed8fc4ad8014da327278b6afc26a2b4d4c8326a681be2d2b33fb2386eade3c6 | nets targeting IoT devices Indicators of Compromise Samples 7ed8fc4ad8014da327278b6afc26a2b4d4c8326a681be2d2b33fb2386eade3c6 dbef55cc0e62e690f9afedfdbcfebd04c31c1dcc456f89a44acd516e187 |
| sha256 | d9001aa2d7456db3e77b676f5d265b4300aaef2d34c47399975a4f1a8f0412e4 | 5cc0e62e690f9afedfdbcfebd04c31c1dcc456f89a44acd516e187e8ef6 d9001aa2d7456db3e77b676f5d265b4300aaef2d34c47399975a4f1a8f0412e4 14c351d76c4e1866bca30d65e0538d94df19b0b3927437bda653b7a73bd |
| sha256 | dbef55cc0e62e690f9afedfdbcfebd04c31c1dcc456f89a44acd516e187e8ef6 | c4ad8014da327278b6afc26a2b4d4c8326a681be2d2b33fb2386eade3c6 dbef55cc0e62e690f9afedfdbcfebd04c31c1dcc456f89a44acd516e187e8ef6 d9001aa2d7456db3e77b676f5d265b4300aaef2d34c47399975a4f1a8f0 |
From the original article
5 min read at unit42.paloaltonetworks.com
Unit 42 researchers uncovered a new botnet campaign using Perl Shellbot , intended to mine Bitcoin, while avoiding detection using a specially crafted rootkit. The bot is propagated by sending a malicious shell script to a compromised device that then downloads other scripts. After the victim device executes the downloaded scripts, it starts waiting for commands from its Command and Control (C2) server.
By Asher Davila, Yang Ji · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.