REPTILE

Adversaries may buy, steal, or download malware that can be used during targeting.

Researchers observed the group deploying Linux rootkits, including REPTILE and MEDUSA, after exploiting vCenter and ESXi vulnerabilities.

Unlike other rootkit malware that typically only provide concealment capabilities, Reptile goes a step further by offering a reverse shell, allowing threat actors to easily take control of systems.

By using the macro, the code bypasses standard C library functions and directly interfaces with the system call: #define init_module(module_image, len, param_values) syscall(__NR_init_module, module_image, len, param_values)

The Reptile rootkit demonstrates this technique by installing a malicious udev rule under /etc/udev/rules.d/: ACTION=="add", ENV{MAJOR}=="1", ENV{MINOR}=="8", RUN+="/lib/udev/reptile"

The Reptile rootkit demonstrates this technique by installing a malicious udev rule under /etc/udev/rules.d/... RUN+="/lib/udev/reptile".

upon examining the rc.local autorun script, it is evident that a command to ensure persistence exists between the tags “#<intel_audio>” and “#</intel_audio>” | It also supports persistence through Udev. The following rules file is created in the /lib/udev/rules.d/ directory... to ensure that it will be executed even after a reboot.

Reptile’s loader directly invokes the init_module syscall with an in-memory decrypted kernel blob... Effective detection should therefore focus on tracing these syscalls directly.

Aside from the concealment and Port Knocking features, Reptile provides a feature where the “root” command can be used to give the current user root privileges.

The Reptile rootkit demonstrates this technique by installing a malicious udev rule under /etc/udev/rules.d/: ACTION=="add", ENV{MAJOR}=="1", ENV{MINOR}=="8", RUN+="/lib/udev/reptile"

The Reptile rootkit demonstrates this technique by installing a malicious udev rule under /etc/udev/rules.d/... RUN+="/lib/udev/reptile".

upon examining the rc.local autorun script, it is evident that a command to ensure persistence exists between the tags “#<intel_audio>” and “#</intel_audio>” | It also supports persistence through Udev. The following rules file is created in the /lib/udev/rules.d/ directory... to ensure that it will be executed even after a reboot.

Reptile’s loader directly invokes the init_module syscall with an in-memory decrypted kernel blob... Effective detection should therefore focus on tracing these syscalls directly.

“The rootkit writes a jump instruction at the start (prologue) of a kernel function, which diverts execution to the rootkit’s own code.” | “Rootkits are stealthy malware designed to conceal malicious activity, such as files, processes, network connections, kernel modules, or accounts.”

Stripping binaries and appending a single null byte significantly degraded static detections; limited XOR string/configuration encoding and lightweight packing were also used.

Rootkits often rename their processes and threads to match benign system components... kworker, migration, rcu_sched, sshd, systemd, dbus-daemon, or bash.

BridgeAgent ... маскировал свой процесс под /usr/bin/gnome-shell. Некоторые бинарники злоумышленники переименовывали ... чтобы выдать файлы за легитимные агенты SentinelOne и Cybereason.

This direct syscall approach allows the custom loader to insert the Kernel module without relying on higher-level functions, which can help avoid detection mechanisms that monitor typical command-line usage patterns.

Некоторые бинарники злоумышленники ... меняли их временные метки ... Также хакеры меняли временные метки файлов, чтобы затруднить расследование и восстановление хронологии атаки.

The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'

Reptile provides a concealment feature for files, directories, processes, and network communications. | Reptile provides a file tampering feature, which allows the contents of a file to be hidden... the strings between these tags are concealed. | When a PID is given along with the “hide” or “show” command, the process of the PID is concealed... hooking next_tgid() makes it so that the concealment target’s process is skipped, making it invisible in the /proc/ list.

The content repeatedly describes malware and threat actors creating hidden folders, adding dot prefixes to filenames, and setting file attributes such as hidden/system to conceal files and directories from users and defenders.

Based on this, a reverse shell connects to the C&C server.

TABLEFLIP passively listens on all active interfaces for specialized command packets that contain an XOR encoded IP address and port to redirect traffic to using iptables commands.

Port Knocking is a method where the malware opens a specific port on an infected system and goes on standby. When the threat actor sends a Magic Packet to the system, the received packet is used as a basis to establish a connection with the C&C server.

The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.