Procedure examples

Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.

Rocke has looked for IP addresses in the known_hosts file on the infected system and attempted to SSH into them.

Rocke has spread its coinminer via SSH.

Rocke has modified UPX headers after packing files to break unpackers.

Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.

Rocke has compiled malware, delivered to victims as .c files, with the GNU Compiler Collection (GCC).

Rocke has used shell scripts which download mining executables and saves them with the filename "java".

Rocke has installed an "init.d" startup script to maintain persistence.

Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.

Rocke installed a cron job that downloaded and executed files from the C2.

Rocke's miner, "TermsHost.exe", evaded defenses by injecting itself into Windows processes, including Notepad.exe.

Rocke can detect a running process's PID on the infected machine.

Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.

Rocke has used Python-based malware to install and spread their coinminer.

Rocke has deleted files on infected machines.

Rocke has changed the time stamp of certain files.

Rocke issued wget requests from infected systems to the C2.

Rocke has executed wget and curl commands to Pastebin over the HTTPS protocol.

Rocke has used uname -m to collect the name and information about the infected system's kernel.

Rocke has used Pastebin, Gitee, and GitLab for Command and Control.

Rocke has used Pastebin to check the version of beaconing malware and redirect to another Pastebin hosting updated malware.

Rocke used malware to download additional malicious files to the target system.

Rocke has extracted tar.gz files after downloading them from a C2 server.

Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.

Rocke has changed file permissions of files so they could not be modified.

Rocke has distributed cryptomining malware.

Rocke used scripts which detected and uninstalled antivirus software.

Rocke has installed a systemd service script to maintain persistence.

Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.

Rocke has used SSH private keys on the infected machine to spread its coinminer throughout a network.

Rocke downloaded a file "libprocesshider", which could hide files on the target system.

Rocke's miner connects to a C2 server using port 51640.

Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.

Rocke used scripts which detected and uninstalled antivirus software.

Rocke has cleared log files within the /var/log/ folder.

Rocke used scripts which killed processes and added firewall rules to block traffic related to other cryptominers.