#Diamorphine rootkit deploys crypto miner on #Linux
A forked script is used to stealthily deploy a cryptocurrency #miner, disguised as a Python file. Diamorphine intercepts system calls and hides its presence. Let’s take a closer look at this threat’s behavior using #ANYRUN’s Linux VM, which provides full visibility into process activity and persistence mechanisms.
The attack #script capabilities:
Propagating from the compromised host to other systems, including stealing SSH keys to move laterally Privilege escalation Installing required dependencies Establishing persistence via #systemd Terminating rival cryptocurrency miners Establishing a three‑layer self‑defense stack:
– Replacing the ps utility
– Installing the Diamorphine #rootkit
– Loading a library that intercepts system calls
️ Both the rootkit and the miner are built from open‑source code obtained on #GitHub, highlighting the ongoing abuse of publicly available tooling in Linux threats.
See Linux analysis session and collect #IOCs: https://app.any.run/tasks/a750fe79-9565-449d-afa3-7e523f84c6ad/?utm_source=mastodon&utm_medium=post&utm_campaign=diamorphine&utm_term=070525&utm_content=linktoservice
Use this TI Lookup query to find fresh samples and enhance your organization's security response: https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=diamorphine&utm_content=linktotilookup&utm_term=070525#%7B%2522query%2522:%2522commandLine:%255C%2522Diamorphine.ko%255C%2522%2522,%2522dateRange%2522:180%7D%20
Analyze and investigate the latest #malware and phishing threats with #ANYRUN 
There's a new Linux rootkit dubbed "Curing" out in the wild, and it's got a nasty trick: leveraging `io_uring` to slip right past traditional security tools. Why? Because most of those tools are laser-focused on system calls... which `io_uring` can bypass.
/
) 
