DreamBus

What it is

DreamBus is a botnet built from shell scripts and Linux programs that mines the cryptocurrency Monero with the XMRig miner. It goes after servers running business software such as Redis, PostgreSQL, Hadoop YARN, Apache Spark, HashiCorp Consul and SaltStack. It keeps itself running with scheduled task files in /etc/cron.d and a script called systemd-service.sh, and leaves files in /tmp/.X11-unix and /tmp/.salted. Several of its names copy real system names to blend in.

How it gets in

Through server software left open with no password or a weak one, such as Redis, or databases with weak passwords.

Close the door: Require authentication with strong, unique passwords on Redis, PostgreSQL and other server software, and do not expose these services to untrusted networks. Aqua's example incident involved a database with a trivially weak password.

How to tell if you have it

Signs published for this threat. One sign alone proves little: names get reused, and newer versions change them. Look for several together.

These commands only look. They change nothing.

Look for the known file locations

sudo ls -la /opt/systemd-service.sh /tmp/.X11-unix/01 /tmp/.X11-unix/22 /tmp/.X11-unix/sshd /tmp/.salted/ /tmp/.systemd-salt 2>/dev/null

Search for the known file names (slow on big disks)

sudo find / -xdev \( -name '.systemd-service.sh' -o -name 'systemd-service.sh' -o -name '0systemd-service' \) 2>/dev/null

Look for the known process names, and where each one runs from

for p in $(pgrep -f 'tracepath'); do echo "$p $(sudo readlink /proc/$p/exe)"; done

List running programs that live in a temporary folder (real software almost never does)

sudo ls -l /proc/[0-9]*/exe 2>/dev/null | grep -E '/(tmp|var/tmp|dev/shm)/'

Check every scheduled task for the known lines

sudo grep -rnF -e '/etc/cron.d/0systemd-service' -e '/etc/cron.d/systemdd' -e '/etc/cron.d/tmp00' /etc/crontab /etc/cron.d /var/spool/cron 2>/dev/null

Fingerprint a suspect file and compare it with the list below

sudo sha256sum /path/to/suspect-file

Known file fingerprints (SHA-256). A match identifies that exact file; newer builds differ.

How sure these signs are: Every sign here comes from one analysis published in January 2021; a 2025 article added nothing new, so newer builds may differ. systemd-service.sh is named to look like part of systemd, and tracepath is a real network tool: only a tracepath running from somewhere like /tmp, or with a fingerprint that doesn't match the real one, is a sign. /tmp/.X11-unix is a normal system folder; only unexpected files inside it, such as sshd, 01 or 22, are a sign. The fingerprints identify the 2021 parts only.

How to remove it by hand

Work through these in order. Don't skip the first two.

1. Cut the server off from the internet, but keep a way to log in, such as your hosting provider's web console. Save evidence first: the process list with where each process runs from and when it started, the matched files and their SHA-256 fingerprints, every crontab and the files in /etc/cron.d, and the settings of the server software it got into (for Redis, its dir and dbfilename settings).
2. Find its processes by where they run from, not by name: for each suspect process number, run sudo readlink /proc/NUMBER/exe. A program in /tmp/.X11-unix or /tmp/.salted, or a file that matches a fingerprint above, is confirmed. Stop it with sudo kill NUMBER, and use kill -9 only if that doesn't work. Never stop a process only because it is called tracepath.
3. Open /etc/cron.d/0systemd-service, /etc/cron.d/systemdd and /etc/cron.d/tmp00. Delete each one only if every line in it runs one of the files named on this page; otherwise remove just those lines. In other crontabs, remove only lines that point at those files.
4. Move the confirmed files into a folder only root can read: /opt/systemd-service.sh, .systemd-service.sh in each home folder, /tmp/.X11-unix/sshd, /tmp/.X11-unix/01, /tmp/.X11-unix/22, /tmp/.systemd-salt and the matched files inside /tmp/.salted. Keep their fingerprints, then delete the originals. Never delete the /tmp/.X11-unix folder itself.
5. Run the checks above again. Then restart the server and check once more. Nothing should come back.
6. If the server software it got into ran as root, or you can't confirm what changed, rebuild from a fresh install and restore only data you've checked.
7. From a clean computer, change the password of the server software it got into (for example Redis or the database), plus any SSH keys and tokens on the server, and cancel the old ones. Before you reconnect, require a strong, unique password on Redis, PostgreSQL and similar software, and keep them off untrusted networks.

What Minaki Scan does about it

Related threats

Sources

This page is written by MinakiLabs in our own words. The facts above come from this published research; credit and thanks to its authors.

• SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops, NIST (2013-07)
• Secure Your Containers from DreamBus Botnet with Aqua Runtime Protection, Aqua Security (2025-02-05)
• Malware Analysis of the DreamBus Botnet, Zscaler ThreatLabz (2021-01-22)