27 Jul 2025
Analysis of #Koske #miner: AI-generated #malware hidden in panda images. #Rootkit #hideproc for hiding from files and processes.
malwarelab.eu/posts/koske-pa…
@anyrun_app video:
youtube.com/watch?v=1OSPp996…
#koskeminer #coinminer #blueteam #cybersecurity #dfir #malwareanalysis #infosec
ALT Panda images with hidden Koske malware
ALT Bash shell script after JPEG data in image (some data omitted for clarity)
ALT Hooking of readdir() function and filter hiddenpid entry in /proc directory
ALT Rootkit affects the output of command ls when loaded via LD_PRELOAD
2
5
21
2,256
28 Aug 2018
-- Version 1.1 for hideproc-lkm is out --
Processes are now removed from the pid_hash hash table.
Interesting side-effect for @volatility is that process no longer appears in "parents" and "leaders" list in psxview, and volshell no longer works on them.
github.com/Iansus/hideproc-l…
14
32