Rocke

Rocke is a cryptomining malware family/threat activity cluster associated with compute hijacking on Linux and Windows systems. The content links Rocke to exploitation of public-facing applications, including Apache Struts, Oracle WebLogic via CVE-2017-10271, and Adobe ColdFusion via CVE-2017-3066, to deliver malware. Rocke used shell scripts and Python-based malware to install and spread coinminers, and also leveraged SSH and private keys present on infected machines to move laterally, including attempts to SSH to hosts found in known_hosts. Persistence mechanisms described include cron jobs, init.d startup scripts, systemd service scripts, and, on Windows, UPX-packed files placed in the Start Menu folder.

Rocke used Pastebin, Gitee, and GitLab as web-based command-and-control or payload-hosting infrastructure. It issued wget requests from infected systems to C2, executed wget and curl commands to Pastebin over HTTPS, and used Pastebin as a dead-drop resolver to check malware versions and redirect victims to updated payloads. Additional behaviors in the content include downloading and extracting tar.gz payloads, compiling delivered .c files with GCC, and downloading libprocesshider. Rocke modified /etc/ld.so.preload to hook libc functions and hide the dropper and mining software from process listings.

Defense evasion and anti-competition behaviors attributed to Rocke include scripts that detected and uninstalled antivirus software, killing processes, adding firewall rules to block competing cryptominers, clearing /var/log files, deleting files on infected machines, and changing file timestamps to hinder forensic analysis. The miner was also saved under the filename "java" to masquerade as legitimate software. The content further notes Rocke can detect a running process PID on an infected machine. Rocke scanned for exposed TCP port 7001 as well as SSH and Redis services. One cited network detail is that Rocke's miner connected over non-standard port 51640; on Windows, a miner component named TermsHost.exe injected into processes including Notepad.exe to evade defenses.

Indicators and references directly mentioned in the content include ClamAV detections such as "Unix.Downloader.Rocke" and "Unix.Downloader.Rocke-6826000-0," use of Pastebin/Gitee/GitLab for C2, and mention of Rocke/KORKERDS artifacts such as /tmp/.x/kworker in rival-miner context.