minaki scan
Menu

Threat wiki / P2PInfect

P2PInfect

P2PInfect is a botnet program written in Rust that takes over Redis servers. Infected machines connect to each other directly (peer to peer) rather than to one central server. txt".

Back up and rebuild. This threat hides itself inside the system or changes its core programs, so a machine that has it can't be trusted after a cleanup. The honest fix is to save your data and reinstall (for a router or similar device: reset it and install fresh firmware from the maker).

What it is
Crypto miner, Botnet, Rootkit, Ransomware
Goes after
Redis servers on Linux (and Windows) hosts
Verdict
Back up and rebuild
Testing
Not removed in place
Minaki Scan
Reports it and tells you to rebuild
Caught by our sensors
Not yet
Last reviewed
15 Oct 2026

What it is

P2PInfect is a botnet program written in Rust that takes over Redis servers. Infected machines connect to each other directly (peer to peer) rather than to one central server. Reports describe it delivering a cryptocurrency miner and a ransomware payload, which locks files and leaves a note named "Your data has been locked!.txt". The 2024 version adds a rootkit, a tool that hides an attacker's presence, as a library loaded through a line in .bashrc files; it hides its programs, processes and network ports from normal tools, so a server with P2PInfect can't be trusted to check itself.

How it gets in

Through Redis servers reachable from untrusted networks or not updated with security fixes.

Close the door: Keep Redis off untrusted networks and update it to a patched package; Unit 42 names Debian-packaged versions redis/5:6.0.16-1+deb11u2, 5:5.0.14-1+deb10u2, 5:6.0.16-2 and 5:7.0~rc2-2 or newer. Monitor Redis hosts for random file names in /tmp.

How to tell if you have it

Signs published for this threat. One sign alone proves little: names get reused, and newer versions change them. Look for several together.

KindSign
File location/tmp/bash
File location/tmp/rsagen
File location/home/<user>/.lib/libs.so.1
File namebash
File namelibs.so.1
File namersagen
File nameYour data has been locked!.txt
Process name[kworker/1:0H]
Network port60100-60150

These commands only look. They change nothing.

Look for the known file locations

sudo ls -la /tmp/bash /tmp/rsagen 2>/dev/null

Search for the known file names (slow on big disks)

sudo find / -xdev \( -name 'bash' -o -name 'libs.so.1' -o -name 'rsagen' \) 2>/dev/null

List running programs that live in a temporary folder (real software almost never does)

sudo ls -l /proc/[0-9]*/exe 2>/dev/null | grep -E '/(tmp|var/tmp|dev/shm)/'

Fingerprint a suspect file and compare it with the list below

sudo sha256sum /path/to/suspect-file

Known file fingerprints (SHA-256). A match identifies that exact file; newer builds differ.

88601359222a47671ea6f010a670a35347214d8592bceaf9d2e8d1b303fe26d7 b1fab9d92a29ca7e8c0b0c4c45f759adf69b7387da9aebb1d1e90ea9ab7de76c 4f949750575d7970c20e009da115171d28f1c96b8b6a6e2623580fa8be1753d9 2c8a37285804151fb727ee0ddc63e4aec54d9460b8b23505557467284f953e4b 8a29238ef597df9c34411e3524109546894b3cca67c2690f63c4fb53a433f4e3 9b74bfec39e2fcd8dd6dda6c02e1f1f8e64c10da2e06b6e09ccbe6234a828acb

How sure these signs are: The 2024 version hides its programs, processes and the network ports 60100 to 60150, so a check run on the infected server can miss it, and finding nothing does not prove the server is clean. The hiding only works for the account whose .bashrc was changed, usually the one Redis runs as, but you still can't rely on the server's own report. bash is the real shell's name, so only /tmp/bash is a sign. [kworker/1:0H] copies a kernel task name; a real one has no program file, so one backed by /tmp/bash is the sign. libs.so.1 has no fixed fingerprint, so match it by name, its .lib folder in a home directory and an LD_PRELOAD line in .bashrc. The main program was rewritten between 2023 and 2024, so older fingerprints may not match. These signs come from 2023 and 2024 reports.

How to deal with it

Removing it in place isn't safe. Here is what to do instead, in order:

  1. Don't try to clean it in place. Plan to rebuild the server from a fresh install.
  2. Cut the server off from the internet, but keep a way to log in, such as your hosting provider's web console. Save evidence: every .bashrc file in home folders, any .lib/libs.so.1, /tmp/bash and /tmp/rsagen, your authorized_keys files and SSH settings, and the SHA-256 fingerprint of each suspect file. If you can, collect them from a rescue disk.
  3. Copy off your data: databases and documents. Don't copy programs, shell startup files such as .bashrc, SSH settings or authorized_keys files; any of those could bring it back.
  4. Reinstall from a fresh image, install all updates, then restore only the data you copied and checked.
  5. From a clean computer, change every password, SSH key and token that was on the server, including other local users' passwords, and cancel the old ones. Reports say it changes SSH settings, adds its own SSH key and changes other users' passwords, so check those on any server that stays in service.
  6. Before you reconnect, keep Redis off untrusted networks and update it to a patched version. Keep checking for the signs above, and for random file names in /tmp.

These steps are provided as-is, without warranty. Run them at your own risk, and back up first. If you're unsure, rebuild from a known-good install.

What Minaki Scan does about it

Minaki Scan looks for this threat and reports it only when at least two signs agree. It never tries to remove it: it tells you to back up your data and rebuild.

Minaki Scan checks your server for this and every other threat in this wiki, explains each finding in plain English, and never changes anything without your OK. $1 per server a month. Downloads open soon.

Sources

This page is written by MinakiLabs in our own words. The facts above come from this published research; credit and thanks to its authors.