How to detect and remove Perfctl Malware on Docker

What is Perfctl Malware

Perfctl Malware is a type of malicious software that specifically targets containers running on Docker, a platform for automating the deployment and management of applications within lightweight, portable containers. This malware can infiltrate Docker environments due to misconfigurations, exposed APIs, or vulnerabilities within the Docker containers themselves. Once it gains access, Perfctl can execute unauthorized processes, extract sensitive data, or even deploy cryptojacking scripts that utilize the host’s resources for cryptocurrency mining. Its presence can severely affect system performance, lead to data breaches, and consume network bandwidth, thereby increasing operational costs. The malware is particularly stealthy, often disguising itself as a legitimate performance monitoring tool, hence going undetected by conventional security measures. Beyond immediate resource consumption, it may create backdoors for additional malicious actors to exploit the compromised environment. Systems infected with Perfctl may exhibit symptoms like unexplained Docker container activity, unexpected network traffic spikes, and slower application performance. Addressing Perfctl involves identifying its source, understanding how it’s compromising the environment, and employing strategies to eliminate it effectively. Docker users should prioritize security measures, regularly update their environments, and monitor both container-level and network-level activities. Recognizing the signs of Perfctl is crucial in mitigating its effects promptly and preventing future infections.

Detection Methods for Perfctl Malware

Analyze Unusual Activity

1. Monitor your Docker environment for unexpected network spikes and CPU utilization.
2. Check for unknown running containers using the command: docker ps.
3. Inspect active processes within containers: docker exec -it [container_id] /bin/bash, followed by top or ps aux.

File Integrity Check

1. Run file integrity tools to check for unauthorized modifications.
2. Compare container images to a trusted baseline and look for unexpected changes.

Log Analysis

1. Employ logging solutions to analyze and aggregate logs from your Docker environment.
2. Look for unfamiliar IP addresses or commands that indicate unauthorized access attempts.

Removing Perfctl Malware

To remove the Perfctl malware, follow these steps, keeping in mind that there might still be traces left in the system, and a clean install is recommended for complete removal:

Remove Paths Added by the Virus in Environment Variables

• Open the profile file using vim /etc/profile.
• Delete the $PATH /bin/.local/bin entry added by the virus program.

Remove the Daemon Startup Script Added by the Virus

• Delete the script from /root/.bash_profile. This script triggers the execution of /usr/bin/perfcc when the root account logs in through SSH.

Remove the Virus Program:

• Execute the following commands to remove the virus files:
• rm -rf /bin/.local
• rm -rf /tmp/.perf.c
• Remove all mining files starting with “private” in /tmp/private.
• rm -rf /usr/bin/perfcc

Kill All Virus Processes:

• Use lsof -i to check for processes with strange foreign network connections, typically associated with httpd.
• Kill the identified process and log in through SSH again.
• Use systemctl status pid to trace the process tree. The parent process is the SSH tty that has just logged in.
• To accurately locate the virus process, use ll /proc/pid. You will see that the startup path of the process is /tmp/.perf.c/path.
• Note: After the process is started, the file is automatically deleted.

Remove the System Service kmodaudit.service

• Delete the system service kmodaudit.service registered by the systemctl virus perfcc.
• The service will actually be failing after deleting the perfcc process.

These steps should help in removing the Perfctl malware, but for complete assurance, consider performing a clean system install.

Stop and Remove Infected Containers

1. Identify malicious containers using: docker ps -a.
2. Stop suspicious containers: docker stop [container_id].
3. Delete them completely: docker rm [container_id].

Scan and Clean Images

1. Use security scanning tools like Clair to identify vulnerabilities in Docker images.
2. Remove infected images: docker rmi [image_id] and replace them with clean versions.

Rebuild from Trusted Sources

1. Pull fresh copies of necessary images from reliable repositories.
2. Ensure Dockerfiles and build scripts are secure and free from unauthorized changes.

Preventive Measures

Secure Docker Environment

1. Ensure correct configurations and limit exposed ports and APIs.
2. Implement strong authentication and network policies.

Regular Monitoring

1. Utilize monitoring tools specific to Docker to detect anomalies in real time.
2. Set alerts for unusual container behaviors or resource usage.

Keep Software Updated

1. Regularly update Docker and container images to patch vulnerabilities.
2. Enforce a schedule for updating dependencies within containers.

Conclusion

Detecting and removing Perfctl Malware from a Docker environment is essential for maintaining operational integrity and security. By combining proactive monitoring, thorough log analyses, and using reputable scanning tools, you can not only eliminate the malware but also fortify your systems against future attacks. Maintaining updated software and employing robust security configurations are critical steps in safeguarding Docker deployments from such threats.