Prowli Miner Virus – How to Remove It from Your Computer and Devices

Prowli Miner Virus – How to Remove It from Your Computer and Devices

This article has been created in order to help you by explaining how to detect and remove the Prowli malware from your computer system and how to protect it against Prowli in the future.

A new malware, going by the name Prowli has been detected by security researchers. The malware aims to attack websites and inject cryptocurrency mining script which results in using a vast amount of resources from the victim’s computer to mine for cryptocurrencies. The bad news here is that Prowly spreads from computer to computer and this botnet has now infected over 40 000 devices, which include servers, modems and even IoT devices to turn them into cryptocurrency miner slaves.

Threat Summary

NameProwli Malware
TypeA botnet which is also a Trojan and a CryptoCurrency Miner virus.
Short DescriptionInfects via servers that are corrupted as a result of exploiting different vulnerabilties.
SymptomsYour computer performs slow and may freeze at times.
Distribution MethodBundled downloads. Web pages which may advertise it.
Detection Tool See If Your System Has Been Affected by Prowli Malware


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss Prowli Malware.

Prowli Malware – Distribution

The main methods via which this botnet is spread on users computers are believed to be via several exploits that are attacking WordPres and other sites on ready platforms, such as:

  • CVE-2018-7482 (Joomla! With K2 extension).
  • CVE-2014-2623 (HP Data Protector servers).
  • Well-known exploits used in brute-force attacks.
  • Drupal and PhpMyAdmin installations.
  • NFS boxes.
  • Servers with unsecured SMB ports (brute-forcing).

The Prowli hackers also use an SHH type of module which scans the SSH connection and aims to try and guess the username and password of devices which expose their SSH ports on the web. From there, the attackers may attack of the devices connected to those servers to also infect them, which is likely what follows.

Prowli Botnet Malware – Activity

As soon as the servers have been compromised, the Prowli malware gathers system information from the devices that are compromised, icluding IoT devices. Such information can be:

  • Processing power.
  • Internet connection and network details.
  • Video Card power.
  • RAM.
  • Drive space.

These details about the devices are sent to the hackers who are also known as the Prowli Group. They start to filter out the devices they believe cannot be used for cryptocurrency mining operations. After the targeted devices are designated for infection, the hackers send a cryptocurrency miner which performs SSH-based attack and expands the botnet automatically to those devices.

The mining operation is done by connecting the victim device to a Monero mining pool that is linked to a cryptocurrency wallet (of the cyber-criminals). A cryptocurrency mining pool (displayed on the image below) is the type of network that connects different devices or group of devices in this case to a common mining operation.

The mining operation includes using the processing power of the devices to calculate complex calculations in order to complete sets of data, called blocks. These blocks are rewared to all of the wallets used in the mining process including to the one that is linked to the compromised devices, which results in more money for the cyber-criminals as more systems become compromised. This is a newer tendency within the cryptojacking world of cyber-crime and it feeds on the logic “the more computers and devices get infected, the more money are made”. This means that the botnet and its worm method of infecting devices much faster than how it would manually be results in the malware spreading at an immense rate and generating a lot of Monero tokens to the crooks. So far, the Prowli operation has resulted in over 40 thousand devices to be compromised, most of which are in South America, North America and Asia.

Remove Prowli Malware from Your Devices

In general Prowli, attacks Windows-based systems, meaning that the botnet is not different than any other malware. For the infection, it uses an r2r2 worm and to be effectively removed from servers takes some skills and time. So if you have an IoT device or a Server that is compromised by this worm, it is strongly reccomended that you backup all the data and call IT support so that they can make sure the whole network is safe, because if a Server is compromised, the r2r2 worm may automatically propagate to other devices.

If your personal computer or any other Windows device that is not a server has been infected with this worm, we do recommend to remove it by isolating the threat and then deleting it’s malicious files. Since this takes some skill to do, security researchers recommend doing it automatically by using an advanced anti-malware software. It is guaranteed to help you delete all of the malicious files of this virus and ensure future protection in the same time.

Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share