Anomali Rocke March 2019

Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.

Rocke has spread its coinminer via SSH.

Rocke has modified UPX headers after packing files to break unpackers.

Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.

Rocke has compiled malware, delivered to victims as .c files, with the GNU Compiler Collection (GCC).

Rocke has installed an "init.d" startup script to maintain persistence.

Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.

Rocke installed a cron job that downloaded and executed files from the C2.

Rocke can detect a running process's PID on the infected machine.

Rocke has used Python-based malware to install and spread their coinminer.

Rocke has deleted files on infected machines.

Rocke has changed the time stamp of certain files.

Rocke has executed wget and curl commands to Pastebin over the HTTPS protocol.

Rocke has used uname -m to collect the name and information about the infected system's kernel.

Rocke has used Pastebin, Gitee, and GitLab for Command and Control.

Rocke has used Pastebin to check the version of beaconing malware and redirect to another Pastebin hosting updated malware.

Rocke has changed file permissions of files so they could not be modified.

Rocke has installed a systemd service script to maintain persistence.

Rocke has used SSH private keys on the infected machine to spread its coinminer throughout a network.

Rocke's miner connects to a C2 server using port 51640.

Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.

Rocke has cleared log files within the /var/log/ folder.