wqrld / hostflow-malware-reverse-engineering

information about the hostflow malware

hostflow-malware-reverse-engineering

information about the hostflow malware

This malware infects spigot plugins and spreads to other jar files in the plugins folder and then launching itself from the onEnable method (run on server startup).

This opens up a websocket connection to client.hostflow.eu / 51.68.52.203 where it sends some information about the server and the full server log every couple of seconds. The service owner is also able to send arbitrary commands to all collected servers.

This malware has existed for a while and is extremely persistent. Here is a list of infected servers as of 05/2021: https://pastebin.com/y54UBQZw

Hosting companies are recommended to block all traffic to and from 51.68.52.203. I have attempted to send abuse reports to the hosting provider OVH but to no avail.

Update 16/11

New information on hostflow

A takedown has been successful in bringing the infected servers from over 5,000 to only 872

More information is available over at https://discord.gg/nqf7eHsqRY this includes the developer who reverse engineered this malware to stop all the infected servers and inform the owners.