Pro-Ocean

Description

(Palo Alto) Pro-Ocean uses known vulnerabilities to target cloud applications. In our analysis, we found Pro-Ocean targeting Apache ActiveMQ (CVE-2016-3088), Oracle WebLogic (CVE-2017-10271) and Redis (unsecure instances). In the case that the malware runs in Tencent Cloud or Alibaba Cloud, it will use the exact code of the previous malware to uninstall monitoring agents to avoid detection. Additionally, it attempts to remove other malware and miners including Luoxk, BillGates, XMRig and Hashfish before installation. Once installed, the malware kills any process that uses the CPU heavily, so that it’s able to use 100% of the CPU and mine Monero efficiently.

Names

Name
Pro-Ocean

Category

Malware

Type

  • Miner

Information

Malpedia

Other Information

Uuid

794ffbdf-64e6-4f00-911d-a359a08c02a5

Last Card Change

2021-04-24