Sustes

Sustes is the name given to a pirate-mining piece of malware capable of exposing the wallet balances of people who trade with the Monero cryptocurrency. Sustes is not a worm per se, but the crooks in charge use it to lay their hands on brute-forced Linux servers and IoT devices.

Sustes lands on its targets through the GNU Wget software used to retrieve web server data, as well as via a plain-text bash script. The latter contains a set of commands, which are set up so as to sneak additional malware into the targeted devices and/or servers. Before paving the way for new payloads, however, Sustes makes sure to remove any AV software that may be running on the targeted server or device. Then comes the sift through configuration data aimed at disabling any software bearing the Sustes name before the crooks execute a crontab command to run the newly dropped malware.

The dropped payload, which is, in fact, a mere XMRig, is called sustes and that’s what this malware is named after. XMRig is a cross-platform Monero cryptocurrency miner. In this case, the hackers behind Sustes use it to mine Monero at someone else’s hardware expense.

Infected PC users are very likely to experience serious slowdown issues when it comes to system performance, as cryptocurrency mining usually takes a huge chunk of both graphic and processing power.