What it is
DreamBus is a botnet built from shell scripts and Linux programs that mines the cryptocurrency Monero with the XMRig miner. It goes after servers running business software such as Redis, PostgreSQL, Hadoop YARN, Apache Spark, HashiCorp Consul and SaltStack. It keeps itself running with scheduled task files in /etc/cron.d and a script called systemd-service.sh, and leaves files in /tmp/.X11-unix and /tmp/.salted. Several of its names copy real system names to blend in.
How it gets in
Through server software left open with no password or a weak one, such as Redis, or databases with weak passwords.
Close the door: Require authentication with strong, unique passwords on Redis, PostgreSQL and other server software, and do not expose these services to untrusted networks. Aqua's example incident involved a database with a trivially weak password.
How to tell if you have it
Signs published for this threat. One sign alone proves little: names get reused, and newer versions change them. Look for several together.
| Kind | Sign |
|---|---|
| File location | /opt/systemd-service.sh |
| File location | /tmp/.X11-unix/sshd |
| File location | /tmp/.X11-unix/01 |
| File location | /tmp/.X11-unix/22 |
| File location | /tmp/.salted/ |
| File location | /tmp/.systemd-salt |
| File name | .systemd-service.sh |
| File name | systemd-service.sh |
| File name | 0systemd-service |
| Process name | tracepath |
| Scheduled task line | /etc/cron.d/0systemd-service |
| Scheduled task line | /etc/cron.d/systemdd |
| Scheduled task line | /etc/cron.d/tmp00 |
These commands only look. They change nothing.
Look for the known file locations:
sudo ls -la /opt/systemd-service.sh /tmp/.X11-unix/01 /tmp/.X11-unix/22 /tmp/.X11-unix/sshd /tmp/.salted/ /tmp/.systemd-salt 2>/dev/nullSearch for the known file names (slow on big disks):
sudo find / -xdev \( -name '.systemd-service.sh' -o -name 'systemd-service.sh' -o -name '0systemd-service' \) 2>/dev/nullLook for the known process names, and where each one runs from:
for p in $(pgrep -f 'tracepath'); do echo "$p $(sudo readlink /proc/$p/exe)"; doneList running programs that live in a temporary folder (real software almost never does):
sudo ls -l /proc/[0-9]*/exe 2>/dev/null | grep -E '/(tmp|var/tmp|dev/shm)/'Check every scheduled task for the known lines:
sudo grep -rnF -e '/etc/cron.d/0systemd-service' -e '/etc/cron.d/systemdd' -e '/etc/cron.d/tmp00' /etc/crontab /etc/cron.d /var/spool/cron 2>/dev/nullFingerprint a suspect file and compare it with the list below:
sudo sha256sum /path/to/suspect-fileKnown file fingerprints (SHA-256). A match identifies that exact file; newer builds differ.
How sure these signs are: Every sign here comes from one analysis published in January 2021; a 2025 article added nothing new, so newer builds may differ. systemd-service.sh is named to look like part of systemd, and tracepath is a real network tool: only a tracepath running from somewhere like /tmp, or with a fingerprint that doesn't match the real one, is a sign. /tmp/.X11-unix is a normal system folder; only unexpected files inside it, such as sshd, 01 or 22, are a sign. The fingerprints identify the 2021 parts only.
How to remove it by hand
Work through these in order. Don't skip the first two.
- Cut the server off from the internet, but keep a way to log in, such as your hosting provider's web console. Save evidence first: the process list with where each process runs from and when it started, the matched files and their SHA-256 fingerprints, every crontab and the files in /etc/cron.d, and the settings of the server software it got into (for Redis, its dir and dbfilename settings).
- Find its processes by where they run from, not by name: for each suspect process number, run sudo readlink /proc/NUMBER/exe. A program in /tmp/.X11-unix or /tmp/.salted, or a file that matches a fingerprint above, is confirmed. Stop it with sudo kill NUMBER, and use kill -9 only if that doesn't work. Never stop a process only because it is called tracepath.
- Open /etc/cron.d/0systemd-service, /etc/cron.d/systemdd and /etc/cron.d/tmp00. Delete each one only if every line in it runs one of the files named on this page; otherwise remove just those lines. In other crontabs, remove only lines that point at those files.
- Move the confirmed files into a folder only root can read: /opt/systemd-service.sh, .systemd-service.sh in each home folder, /tmp/.X11-unix/sshd, /tmp/.X11-unix/01, /tmp/.X11-unix/22, /tmp/.systemd-salt and the matched files inside /tmp/.salted. Keep their fingerprints, then delete the originals. Never delete the /tmp/.X11-unix folder itself.
- Run the checks above again. Then restart the server and check once more. Nothing should come back.
- If the server software it got into ran as root, or you can't confirm what changed, rebuild from a fresh install and restore only data you've checked.
- From a clean computer, change the password of the server software it got into (for example Redis or the database), plus any SSH keys and tokens on the server, and cancel the old ones. Before you reconnect, require a strong, unique password on Redis, PostgreSQL and similar software, and keep them off untrusted networks.
What Minaki Scan does about it
Minaki Scan finds this threat by the fingerprints of its files and processes and removes it, but only after you type yes. It backs up what it changes and logs every change on your server.
Minaki Scan checks your server every day for this and the other threats in this wiki. $1 per server a month. Downloads open soon.
Sources
This page is written by MinakiLabs in our own words. The facts above come from this published research; credit and thanks to its authors.
- SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops, NIST (2013-07)
- Secure Your Containers from DreamBus Botnet with Aqua Runtime Protection, Aqua Security (2025-02-05)
- Malware Analysis of the DreamBus Botnet, Zscaler ThreatLabz (2021-01-22)