# Crypto Miner in hotio/qbittorrent

**Published:** 2025-09-23

**Author:** Alessandro Pogliaghi
**URL:** https://apogliaghi.com/2025/09/crypto-miner-in-hotio/qbittorrent/


<div style="background: linear-gradient(135deg, #ff6b35, #f7931e); padding: 20px; border-radius: 10px; margin: 30px 0; text-align: center; box-shadow: 0 4px 15px rgba(0,0,0,0.1);">
  <h3 style="margin: 0 0 15px 0; color: white; font-size: 1.3em;">🗣️ Join the Discussion 🗣️</h3>
  <div style="display: flex; justify-content: center; gap: 20px; flex-wrap: wrap; margin-bottom: 15px;">
    <a href="https://news.ycombinator.com/item?id=45345233" style="display: inline-flex; align-items: center; padding: 10px 20px; background: rgba(255,255,255,0.2); border-radius: 25px; text-decoration: none; color: white; font-weight: bold; transition: all 0.3s ease; backdrop-filter: blur(10px);" onmouseover="this.style.background='rgba(255,255,255,0.3)'; this.style.transform='translateY(-2px)'" onmouseout="this.style.background='rgba(255,255,255,0.2)'; this.style.transform='translateY(0)'">
      <img src="https://news.ycombinator.com/favicon.ico" alt="HN" style="width: 16px; height: 16px; margin-right: 8px;">
      Hacker News
    </a>
    <a href="https://lobste.rs/s/6wzpji/crypto_miner_hotio_qbittorrent" style="display: inline-flex; align-items: center; padding: 10px 20px; background: rgba(255,255,255,0.2); border-radius: 25px; text-decoration: none; color: white; font-weight: bold; transition: all 0.3s ease; backdrop-filter: blur(10px);" onmouseover="this.style.background='rgba(255,255,255,0.3)'; this.style.transform='translateY(-2px)'" onmouseout="this.style.background='rgba(255,255,255,0.2)'; this.style.transform='translateY(0)'">
      <span style="font-size: 1.2em; margin-right: 8px;">🦞</span>
      Lobste.rs
    </a>
  </div>
</div>

---
### Infected Container Image

* **Registry:** `ghcr.io/hotio/qbittorrent`
* **Tag:** `release`
* **Digest:** `sha256:3779f89712dbaa8b25fc22897d0b471ee`
  `29049b2b0f8d3c192df83b098c84fc5`

---

Recently, while migrating to a new server, I discovered a suspicious process running inside a [hotio/qbittorrent](https://hotio.dev/containers/qbittorrent/) Docker container.

I mainly use this to download Linux ISOs, as anybody else, right?

I just want to get that sweet sweet [Omarchy](https://omarchy.org/) ISO.

## The Problem

While monitoring system resources, I noticed a process consuming unusually high CPU:

```bash
$ ps -ef | grep netservlet
1000  758679  756435  99 09:39 ?  00:13:43 ./netservlet
````

{{< figure src="/img/_qbittorrent-cryptominer/cpu_spike.png" position="center" >}}

The binary `netservlet` was unfamiliar, and attempts to inspect it via `/proc` failed:

```bash
$ docker exec qbittorrent cat /proc/758679/exe > /tmp/netservlet
# Output: No such file or directory
```

This indicates the binary was likely **unlinked from the filesystem**, pretty much as expected.

## Investigation

Since direct access to the executable was blocked, I generated a core dump:

```bash
$ gcore -o /tmp/netservlet_core 758679
```

I could now simply use `strings` to further have a look:
```bash
$ strings /tmp/netservlet.elf | egrep -i 'stratum|pool|wallet|http|crypto|mining|eth|btc|pool'
```

Highlights included:

* References to cryptocurrency mining: `cryptonight`, `ethash_calculate_dag_item`, `mining.submit`, `mining.authorize`.
* Mining pool addresses: `auto.c3pool.org:19999`.
* Miner configuration options: `--cpu-memory-pool`, `--opencl`, `--cuda`, `--rig-id`, `http-access-token`.

This confirmed that `netservlet` was **a stealth crypto miner**, likely XMRig or a variant.
I thought we were over crypto bros and all over to AI-bros, I was mistaken 😂.

{{< figure src="/img/_qbittorrent-cryptominer/wat.png" position="center" >}}

Just for fun, I also ran `binwalk` against the dump, which ended up with a `1.3GB` `gzip` archive.
We couldn't just unzip it, though, due to obfuscation.

I will analyze it via `ghidra` later, today I should be OOO lol.


## Conclusion

Remember:

* Never trust random Docker images—your containers aren’t magic elves.
* Keep an eye on system resources—they have feelings too.
* Audit your host and containers often—because surprises are only fun at parties.