Discovered an unusual application on your friend's Raspberry Pi.
Discovered an unusual application on your friend's Raspberry Pi.
He mentioned his Pi couldn<|pad|> a password was updated. I linked it to a monitor and saw a script in /opt/etc/rc.local running. The file attached was the one that got executed. I have some programming skills and can explain what it does. Here’s the link: https://pastebin.com/bmzhZAS3
You're noticing CPUminer and SSH password details in the script. It seems like scripts might be downloading or using credentials from the internet without your explicit knowledge. The SSH password mentioned could relate to accessing a device like a Raspberry Pi.
I’d destroy this Pi and any others in the network. I’m not sure exactly what it’s aiming for, but here are three odd behaviors: it adds an SSH key to the authorized keys file, it runs what looks like an IRC bot, and it tries to connect to other Raspberry Pis using the default login. A reminder: update the default password on Raspberry Pis, particularly if they’re exposed online.
It only uses the SD card it comes with. Works for all RPi devices on the network.
From what I understand, no installation or download was necessary for the infection. The malware spread via SSH to various hosts, relying on default user account configurations.