A Mirai-like botnet named “LiquorBot” was analyzed by Bitdefender researchers. Their blog post discusses the distribution method and goals of this botnet variant. In most cases the initial infection vector is via SSH brute-forcing, although it is also capable of exploiting several command injection and remote execution vulnerabilities. Installation of the malware begins with a dropper shell script that downloads a series of binaries from a remote server. These binaries are all LiquorBot samples but compiled for a variety of CPU architectures. Upon installation, the bot relaunches itself under the guise of the sshd daemon and subsequently clears its tracks. There are 3 servers involved in the botnet’s communication: a C2 server from which it receives commands, a mining server, and the server hosting the aforementioned binaries. The available commands include those to download and execute files or shutdown the server. Additionally, this botnet malware incorporates Monero cryptocurrency mining into its functionality.
Mine for cryptocurrency