This article has been created in order to help you by explaining how to detect and remove the Prowli malware from your computer system and how to protect it against Prowli in the future.
A new malware, going by the name Prowli has been detected by security researchers. The malware aims to attack websites and inject cryptocurrency mining script which results in using a vast amount of resources from the victim’s computer to mine for cryptocurrencies. The bad news here is that Prowly spreads from computer to computer and this botnet has now infected over 40 000 devices, which include servers, modems and even IoT devices to turn them into cryptocurrency miner slaves.
|Type||A botnet which is also a Trojan and a CryptoCurrency Miner virus.|
|Short Description||Infects via servers that are corrupted as a result of exploiting different vulnerabilties.|
|Symptoms||Your computer performs slow and may freeze at times.|
|Distribution Method||Bundled downloads. Web pages which may advertise it.|
|Detection Tool|| See If Your System Has Been Affected by Prowli Malware |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss Prowli Malware.|
Prowli Malware – Distribution
The main methods via which this botnet is spread on users computers are believed to be via several exploits that are attacking WordPres and other sites on ready platforms, such as:
- CVE-2018-7482 (Joomla! With K2 extension).
- CVE-2014-2623 (HP Data Protector servers).
- Well-known exploits used in brute-force attacks.
- Drupal and PhpMyAdmin installations.
- NFS boxes.
- Servers with unsecured SMB ports (brute-forcing).
The Prowli hackers also use an SHH type of module which scans the SSH connection and aims to try and guess the username and password of devices which expose their SSH ports on the web. From there, the attackers may attack of the devices connected to those servers to also infect them, which is likely what follows.
Prowli Botnet Malware – Activity
As soon as the servers have been compromised, the Prowli malware gathers system information from the devices that are compromised, icluding IoT devices. Such information can be:
- Processing power.
- Internet connection and network details.
- Video Card power.
- Drive space.
These details about the devices are sent to the hackers who are also known as the Prowli Group. They start to filter out the devices they believe cannot be used for cryptocurrency mining operations. After the targeted devices are designated for infection, the hackers send a cryptocurrency miner which performs SSH-based attack and expands the botnet automatically to those devices.
The mining operation is done by connecting the victim device to a Monero mining pool that is linked to a cryptocurrency wallet (of the cyber-criminals). A cryptocurrency mining pool (displayed on the image below) is the type of network that connects different devices or group of devices in this case to a common mining operation.
The mining operation includes using the processing power of the devices to calculate complex calculations in order to complete sets of data, called blocks. These blocks are rewared to all of the wallets used in the mining process including to the one that is linked to the compromised devices, which results in more money for the cyber-criminals as more systems become compromised. This is a newer tendency within the cryptojacking world of cyber-crime and it feeds on the logic “the more computers and devices get infected, the more money are made”. This means that the botnet and its worm method of infecting devices much faster than how it would manually be results in the malware spreading at an immense rate and generating a lot of Monero tokens to the crooks. So far, the Prowli operation has resulted in over 40 thousand devices to be compromised, most of which are in South America, North America and Asia.
Remove Prowli Malware from Your Devices
In general Prowli, attacks Windows-based systems, meaning that the botnet is not different than any other malware. For the infection, it uses an r2r2 worm and to be effectively removed from servers takes some skills and time. So if you have an IoT device or a Server that is compromised by this worm, it is strongly reccomended that you backup all the data and call IT support so that they can make sure the whole network is safe, because if a Server is compromised, the r2r2 worm may automatically propagate to other devices.
If your personal computer or any other Windows device that is not a server has been infected with this worm, we do recommend to remove it by isolating the threat and then deleting it’s malicious files. Since this takes some skill to do, security researchers recommend doing it automatically by using an advanced anti-malware software. It is guaranteed to help you delete all of the malicious files of this virus and ensure future protection in the same time.