Rewterz Threat Alert – LiquorBot Botnet

Friday, January 10, 2020



Analysis Summary

A Mirai-like botnet named “LiquorBot” was analyzed by Bitdefender researchers. Their blog post discusses the distribution method and goals of this botnet variant. In most cases the initial infection vector is via SSH brute-forcing, although it is also capable of exploiting several command injection and remote execution vulnerabilities. Installation of the malware begins with a dropper shell script that downloads a series of binaries from a remote server. These binaries are all LiquorBot samples but compiled for a variety of CPU architectures. Upon installation, the bot relaunches itself under the guise of the sshd daemon and subsequently clears its tracks. There are 3 servers involved in the botnet’s communication: a C2 server from which it receives commands, a mining server, and the server hosting the aforementioned binaries. The available commands include those to download and execute files or shutdown the server. Additionally, this botnet malware incorporates Monero cryptocurrency mining into its functionality.


Mine for cryptocurrency

Indicators of Compromise


  • 14592719e2a354633131bc238f07aa0cb9cce698
  • 1611a8445085d1687c72b7e5a7c5602cbe580c8b
  • 1f15195ddc1e4174674fbf5d1fc95ed0a7726f7b
  • 2784a122089c20d5c02665da1241fe02f9ac90cc
  • 2901d4ee7f289bf0b1a863bec716d751f66a4324
  • 2d1d294aac29fab2041949d4cb5c58d3169a31d3
  • 31176239ab5187af5d89666f37038340b95a5a4e
  • 31d9ca734c5f4c1787131d3a1b6b91ca60e57794
  • 331ec23c250b86d912fa34e0e700bfcac1a7c388
  • 3453a96414e63a813b82c6d98fa3b76c1824abd8
  • 36382165bb53a7ed9387a02e5b9baee36fe23f64
  • 48c863e4ad23fb946386320f3a85391b54ba50ad
  • 49602256c8d65d0620d5abe8011a78425c7ae177
  • 54bdfa936c9eb4ea329ca35b95e471d51daef1d5
  • 5821ff8eb9b23035a520e1fb836e43b1ec87ffaf
  • 61abc90c20930c7615880ac9931778b48b9e6ebd
  • 63b556a0afcf643337310254cc7f57c729188f36
  • 65cd6a0371bdfffd7383907ba9a816e8e2e95da5
  • 6c7a92d5d68b68ddba10af7ca6350cfb24b2595f
  • 6d24c472b06e6f9ac3204ca768319d2b035a210a
  • 8364c272e0c95ed214c71dbcb48f89c468544bc8
  • 8df16857cb914f5eded0249cfde07f1c01697db1
  • a69f9f5f2ac15aec393ab68277ec268c0624fe91
  • b40f4f13b2b144946b165a2e4284c96fbc0d4682
  • b9dd4d230d103b3db458d752d4917466ec1cb9b0
  • ba55d92e3d7dba70205597433f1a98b35e4911b8
  • bb07341ab6b203687845ae38cd8c17dfc947e79f
  • c59dd90f7cefadaa80d9c0113f8af39e4ed0c1a1
  • c5adabbdbf641f3e53e3268af60ac1b26088aa6b
  • c6d850e264d7d8d6978cd85d69c22b29378e34e4
  • c7ed7241e2d21fa471b6bfd6b97b24b514b3c5f2
  • d216f33695421dfb17e69ed05aec46cf84b544b7
  • d59175ffacd8895362253a3bcb18637ced765fcd
  • d62cdd8f16a8f6b6cde5e8da633c224eab4765f2
  • e91f2d5df4ef43cb4c69b15de9a68c7ff2d4951d
  • fd65e6c5ae07c50c7d7639e2712c45324d4cf8de


  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the links/attachments sent by unknown senders.

Data Sheets

Corporate Brochure

Our Story



Managed Security

Upcoming Rewterz Trainings/Events

Rewterz News

  • 10, January 2020 Rewterz Threat Advisory – CVE-2020-1600 – Juniper Networks Junos OS Denial of Service in the RPD daemon
  • 10, January 2020 Rewterz Threat Alert – Bank of America Phishing Campaign
  • 10, January 2020 Rewterz Threat Alert – LiquorBot Botnet
  • 10, January 2020 Rewterz Threat Advisory – CVE-2019-16005 – Cisco Webex Video Mesh Node Command Injection Vulnerability

Copyright © Rewterz. All rights reserved.