What it is
Skidmap takes over Linux servers to mine cryptocurrency, using your server's processor for the attacker's profit. It loads kernel modules (add-ons that run inside the core of the operating system) that work as a rootkit, a tool that hides an attacker's presence: they hide its files and processes and fake the system load figures, so the server looks idle while the miner runs. It also swaps pam_unix.so, the part of Linux that checks passwords when you log in, for its own copy. With both the core of the system and the login check changed, a server with Skidmap can't be trusted to check itself.
How it gets in
In the 2023 campaign, through Redis databases left open to the internet with no password. The 2019 report doesn't say how it first got in.
Close the door: Never leave Redis reachable from the internet without a password; set a strong password and limit access to trusted clients on a restricted network. Keep systems patched, avoid unverified third-party repositories, and enforce least privilege.
How to tell if you have it
Signs published for this threat. One sign alone proves little: names get reused, and newer versions change them. Look for several together.
| Kind | Sign |
|---|---|
| File location | /usr/bin/kaudited |
| File location | /var/lib/pc |
| File location | /var/lib/gif |
| File location | /tmp/.miner |
| File location | /tmp/miner2 |
| File location | /etc/cron.hourly/prelink |
| File name | kaudited |
| File name | mcpuinfo.ko |
| File name | kmeminfo.ko |
| File name | pam_unix.so |
| Process name | pamdicks |
| Process name | kaudited |
These commands only look. They change nothing.
Look for the known file locations:
sudo ls -la /etc/cron.hourly/prelink /tmp/.miner /tmp/miner2 /usr/bin/kaudited /var/lib/gif /var/lib/pc 2>/dev/nullSearch for the known file names (slow on big disks):
sudo find / -xdev \( -name 'kaudited' -o -name 'mcpuinfo.ko' -o -name 'kmeminfo.ko' -o -name 'pam_unix.so' \) 2>/dev/nullLook for the known process names, and where each one runs from:
for p in $(pgrep -f 'pamdicks|kaudited'); do echo "$p $(sudo readlink /proc/$p/exe)"; doneList running programs that live in a temporary folder (real software almost never does):
sudo ls -l /proc/[0-9]*/exe 2>/dev/null | grep -E '/(tmp|var/tmp|dev/shm)/'Fingerprint a suspect file and compare it with the list below:
sudo sha256sum /path/to/suspect-fileKnown file fingerprints (SHA-256). A match identifies that exact file; newer builds differ.
How sure these signs are: Skidmap hides its files and processes, so a check run on the infected server can miss it, and finding nothing does not prove the server is clean. In 2023, researchers reported that common scanners such as ClamAV and Rkhunter found nothing on an infected server. The kernel modules mcpuinfo.ko and kmeminfo.ko and the process pamdicks stay hidden while they are loaded, so look for them from a rescue disk. Several names copy real software: kaudited looks like a kernel audit task, pam_unix.so is a real Linux file (the sign is a copy that doesn't match your distribution's package), and /etc/cron.hourly/prelink is a normal script on some systems (the sign is a line inside it that opens a connection to a remote address). These signs come from 2019 and 2023 reports; newer builds may differ.
How to deal with it
Removing it in place isn't safe. Here is what to do instead, in order:
- Don't try to clean it in place. Plan to rebuild the server from a fresh install.
- Cut the server off from the internet, but keep a way to log in, such as your hosting provider's web console. Save evidence: the kernel module files on disk, /usr/bin/kaudited, pam_unix.so, /root/.ssh/authorized_keys, your scheduled tasks including /etc/cron.hourly, and the SHA-256 fingerprint of each suspect file. If you can, collect them from a rescue disk, because the infected system hides things from you.
- Copy off your data: databases, website files and documents. Don't copy programs, kernel modules, pam_unix.so, authorized_keys files, scheduled tasks or SELinux settings; any of those could bring it back.
- Reinstall from a fresh image and install all updates. Check that SELinux is switched back on (enforcing mode), then restore only the data you copied and checked.
- From a clean computer, change every password, key and token that was on the server, and cancel the old ones. Assume the swapped login check exposed every account's password, and remove any SSH keys you didn't add.
- Before you reconnect, make sure Redis can't be reached from the internet and has a strong password. Keep checking for the signs above, and watch for gaps in the times in your logs.
What Minaki Scan does about it
Minaki Scan looks for this threat and reports it only when at least two signs agree. It never tries to remove it: it tells you to back up your data and rebuild.
Minaki Scan checks your server every day for this and the other threats in this wiki. $1 per server a month. Downloads open soon.
Sources
This page is written by MinakiLabs in our own words. The facts above come from this published research; credit and thanks to its authors.
- Honeypot Recon: New Variant of SkidMap Targeting Redis, LevelBlue SpiderLabs (formerly Trustwave SpiderLabs) (2023-07-30)
- SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops, NIST (2013-07)
- Skidmap Malware Uses Rootkit to Hide Mining Payload, Trend Micro (2019-09-16)