Kerberods

Description

(Trend Micro) Kerberods is responsible for dropping the cryptocurrency miner (khugepageds, detected as Coinminer.Linux.MALXMR.UWEJI) and its rootkit component.

One particularly interesting aspect of the binary is the way it drops the rootkit.

Kerberods also has multiple ways of propagating itself, spreading via SSH and exploiting CVE-2019-1003001 and CVE-2019-1003000.

Names

Name
Kerberods

Category

Malware

Type

• Dropper
• Worm

Information

• https://blog.trendmicro.com/trendlabs-security-intelligence/cve-2019-3396-redux-confluence-vulnerability-exploited-to-deliver-cryptocurrency-miner-with-rootkit/

Malpedia

• https://malpedia.caad.fkie.fraunhofer.de/details/elf.kerberods

Alienvault Otx

• https://otx.alienvault.com/browse/pulses?q=tag:kerberods

Other Information

Uuid

b2f59574-e769-4655-8b30-28e7c608bf41

Last Card Change

2021-04-24