dfir.chwriteupSysrv Infection (Linux Edition)
DFIR case study reversing a Sysrv botnet crypto-mining ELF binary (VirusTotal sample 41hs1z) found on a Linux endpoint, covering the initial ldr.sh loader script, Go binary reversing in Ghidra (using Max Kersten's GhidraScripts to recover strings/function names obscured by Go compilation), and dynamic analysis via strace showing the process masquerading as kthreaddk, establishing cron-based persistence at randomized paths, using a localhost TCP mutex port, and writing an XMRig-style config.json pointing to C2 194.38.23.2:8080. It also documents the malware's WordPress exploit (matched to Exploit-DB code) and hardcoded brute-force credential lists used for propagation.
What it is
A DFIR write-up of a Sysrv botnet crypto-miner infection on a Linux endpoint, focused on extracting concrete IOCs from the ELF Go binary (41hs1z, running as kthreaddk). The value the summary omits is the specific indicators and detection artifacts.
Preconditions / Affected
Internet-facing Linux web application; the loader is presumed to arrive via exploitation of a web-app vulnerability. Runs as root (cron entries and process listing show root). Note: unlike some Sysrv variants, the loader in this case did not harvest SSH keys for propagation, though a recovered version of the script does enumerate private keys, known_hosts, and associated usernames.
What to do — IOCs and detections
Hunt for these concrete indicators the page provides:
- Loader URL:
http://194.38.23.2/ldr[.]sh - Sample name:
41hs1z; observed paths include: /backup/files/excel/41hs1z/backup/files/xml/dotnet115/BeID/41hs1z/backup/files/xml/dotnet115/layouts/defaults/41hs1z- Runtime process name:
kthreaddk(masquerades as a kernel thread) - Binary hash / execve:
9d9150e2def883bdaa588b47cf5300934ef952bea3acd5ad0e86e1deaa7d89c5 - Mutex: binary connects to
localhost:51933(TCP) every ~60s; if the port is open it skips re-infection. The port is per-instance. - Randomized copy paths seen in
psand cron logs — the binary hides in legitimate-looking directories: /etc/apparmor.d/abstractions/ubuntu-browsers.d/3hxr47/dev/disk/by-partuuid/3hxr47/dev/block/mujqjo
Cron persistence — the malware installs a per-minute job with a randomized path via:
echo '* * * * * /dev/disk/by-partuuid/3hxr47' | /usr/bin/crontab -Cron logs show repeated REPLACE (root) / RELOAD (crontabs/root) events as the path rotates — a detectable pattern.
Reversing tips: the Go binary opens in Ghidra with empty functions and garbled strings. Run Max Kersten's GhidraScripts (per its README) to recover function names and readable strings — including the /usr/bin/crontab - string. Use strace for dynamic analysis; increase the max string-capture length to observe config.json being written to disk.
Caveats
The loader host and the C2 server were no longer reachable during investigation, so analysis relied on recovered script traces. The loader analysis itself is not reproduced here — the post defers to UltimaCybr, TheDFIRReport, and others. Paths, mutex port, and randomized filenames vary per infection; treat the literal strings above as examples of the pattern, not fixed signatures.
Organisations named here
- 194.38.23.2
- kthreaddk
Technologies named here
- Linux endpoints
- Ghidra
- WordPress
- GhidraScripts
- strace
- VirusTotal
- Exploit-DB
- Sysmon for Linux
- Kunai
- watch command
- Linux
- Go
Techniques named here
- Exploitation of public-facing application
- SSH key / known_hosts enumeration for propagation
- Disabling security controls
- Scheduled task persistence via cron
- Process masquerading
- Mutex/port-based infection check
- Binary relocation to varying paths
- Brute-forcing with hardcoded credentials
- Exploit-based propagation
- Cryptocurrency mining payload
Threat actors named here
- Sysrv
Related in Malware & RE
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupPost-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
huntress.comwriteupClickFix Removes Your Background but Leaves the Malware
