Minaki Scan

Threat wiki / perfctl

perfctl

Back up and rebuild

This threat hides itself inside the system, so a server that has it can't be trusted after a cleanup. The honest fix is to save your data and reinstall.

What it isStealthy Linux cryptominer (XMRig) with an LD_PRELOAD rootkit and trojanized system utilities
Goes afterInternet-connected Linux servers
Our verdictBack up and rebuild
Last reviewed2026-10-15

What it is

perfctl takes over Linux servers to mine cryptocurrency with XMRig, a mining program, using your server's processor for the attacker's profit. It installs a rootkit, a tool that hides an attacker's presence, as a library that loads into other programs through /etc/ld.so.preload. It also swaps everyday tools such as ldd, top, lsof and crontab for its own versions, and hooks into the login password check. With the tools you would look with replaced, a server with perfctl can't be trusted to check itself.

How it gets in

Through internet-facing servers running software that hasn't been updated, or services set up with default passwords or no login at all.

Close the door: Keep internet-facing applications and system libraries patched, and review exposed services for default or missing authentication.

How to tell if you have it

Signs published for this threat. One sign alone proves little: names get reused, and newer versions change them. Look for several together.

KindSign
File location/root/.config/cron/perfcc
File location/usr/bin/perfcc
File location/usr/lib/libfsnkdev.so
File location/usr/lib/libpprocps.so
File location/tmp/.apid
File location/tmp/.xdiag/int/.per.s
File location/etc/ld.so.preload
File namelibgcwrap.so
File namelibpprocps.so
File nameperfcc
File namelibfsnkdev.so
File namewizlmsh
Process nameperfcc
Process namewizlmsh

These commands only look. They change nothing.

Look for the known file locations:

sudo ls -la /etc/ld.so.preload /root/.config/cron/perfcc /tmp/.apid /tmp/.xdiag/int/.per.s /usr/bin/perfcc /usr/lib/libfsnkdev.so /usr/lib/libpprocps.so 2>/dev/null

Search for the known file names (slow on big disks):

sudo find / -xdev \( -name 'libgcwrap.so' -o -name 'libpprocps.so' -o -name 'perfcc' -o -name 'libfsnkdev.so' -o -name 'wizlmsh' \) 2>/dev/null

Look for the known process names, and where each one runs from:

for p in $(pgrep -f 'perfcc|wizlmsh'); do echo "$p $(sudo readlink /proc/$p/exe)"; done

List running programs that live in a temporary folder (real software almost never does):

sudo ls -l /proc/[0-9]*/exe 2>/dev/null | grep -E '/(tmp|var/tmp|dev/shm)/'

How sure these signs are: perfctl hides its activity and replaces the tools you would use to look, so a check run on the infected server can miss it, and finding nothing does not prove the server is clean. /etc/ld.so.preload is a normal file; only a line naming a library you don't recognise is a sign. libpprocps.so imitates the name of the real procps package. Researchers spell one library two ways, libfsnkdev.so and libfsnldev.so, so check both. /root/.config/cron/perfcc is a program, not a scheduled task, despite its folder name; the user's login profile is changed to run it. The process name perfcc is a hint, not proof. No SHA-256 fingerprints have been published. All these signs come from one 2024 report.

How to deal with it

Removing it in place isn't safe. Here is what to do instead, in order:

  1. Don't try to clean it in place. Plan to rebuild the server from a fresh install.
  2. Cut the server off from the internet, but keep a way to log in, such as your hosting provider's web console. Save evidence: /etc/ld.so.preload and the library it names, ~/.profile and /etc/profile, and copies of suspect programs such as /usr/bin/perfcc with their SHA-256 fingerprints. If you can, collect them from a rescue disk, because the infected system hides things and its own tools lie.
  3. Copy off your data: databases, website files and documents. Don't copy programs, login profiles, scheduled tasks or /etc/ld.so.preload; any of those could bring it back.
  4. Reinstall from a fresh image, install all updates, including system libraries, then restore only the data you copied and checked.
  5. From a clean computer, change every password, key and token that was on the server, and cancel the old ones. The rootkit hooks the login check, so treat every password used on the server as exposed.
  6. Before you reconnect, update every internet-facing application and make sure no exposed service runs with a default password or without a login. Keep checking for the signs above.
These steps are provided as-is, without warranty. Run them at your own risk, and back up first. If you're unsure, rebuild from a known-good install.

What Minaki Scan does about it

Minaki Scan looks for this threat and reports it only when at least two signs agree. It never tries to remove it: it tells you to back up your data and rebuild.

Minaki Scan checks your server every day for this and the other threats in this wiki. $1 per server a month. Downloads open soon.

Sources

This page is written by MinakiLabs in our own words. The facts above come from this published research; credit and thanks to its authors.