REPTILE

Adversaries may buy, steal, or download malware that can be used during targeting.

Researchers observed the group deploying Linux rootkits, including REPTILE and MEDUSA, after exploiting vCenter and ESXi vulnerabilities.

Unlike other rootkit malware that typically only provide concealment capabilities, Reptile goes a step further by offering a reverse shell, allowing threat actors to easily take control of systems.

By using the macro, the code bypasses standard C library functions and directly interfaces with the system call: #define init_module(module_image, len, param_values) syscall(__NR_init_module, module_image, len, param_values)

The Reptile rootkit demonstrates this technique by installing a malicious udev rule under /etc/udev/rules.d/: ACTION=="add", ENV{MAJOR}=="1", ENV{MINOR}=="8", RUN+="/lib/udev/reptile"

upon examining the rc.local autorun script, it is evident that a command to ensure persistence exists between the tags “#<intel_audio>” and “#</intel_audio>” | It also supports persistence through Udev. The following rules file is created in the /lib/udev/rules.d/ directory... to ensure that it will be executed even after a reboot.

“Once threat actors are able to insert a malicious LKM, they have complete control over the kernel space” and “kernel module rootkits require access to the system kernel on the host machine.”

Aside from the concealment and Port Knocking features, Reptile provides a feature where the “root” command can be used to give the current user root privileges.

The Reptile rootkit demonstrates this technique by installing a malicious udev rule under /etc/udev/rules.d/: ACTION=="add", ENV{MAJOR}=="1", ENV{MINOR}=="8", RUN+="/lib/udev/reptile"

upon examining the rc.local autorun script, it is evident that a command to ensure persistence exists between the tags “#<intel_audio>” and “#</intel_audio>” | It also supports persistence through Udev. The following rules file is created in the /lib/udev/rules.d/ directory... to ensure that it will be executed even after a reboot.

“Once threat actors are able to insert a malicious LKM, they have complete control over the kernel space” and “kernel module rootkits require access to the system kernel on the host machine.”

“LKM rootkits leverage different kernel features to hook kernel functions” and are used “to hide malicious activity by hooking execution flow.” | “Attackers can hook any system call by saving the old handler value and adding their own handler to the table.” The article also describes Kprobes, Ftrace, and VFS function-pointer manipulation.

Within the Makefile, a random 32-bit hexadecimal value is generated... This value serves as the encryption key for the Reptile Kernel object, making it difficult to identify the module through simple hash searches or hex value hunts on the filesystem. The encrypted Kernel module is stored in reptile.ko.inc.

The report also described a Linux host running BridgeAgent, a backdoor masquerading as a monitoring process... REPTILE-like binary renamed to resemble a security agent.

BridgeAgent ... маскировал свой процесс под /usr/bin/gnome-shell. Некоторые бинарники злоумышленники переименовывали ... чтобы выдать файлы за легитимные агенты SentinelOne и Cybereason.

This direct syscall approach allows the custom loader to insert the Kernel module without relying on higher-level functions, which can help avoid detection mechanisms that monitor typical command-line usage patterns.

Некоторые бинарники злоумышленники ... меняли их временные метки ... Также хакеры меняли временные метки файлов, чтобы затруднить расследование и восстановление хронологии атаки.

The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'

Reptile provides a concealment feature for files, directories, processes, and network communications. | Reptile provides a file tampering feature, which allows the contents of a file to be hidden... the strings between these tags are concealed. | When a PID is given along with the “hide” or “show” command, the process of the PID is concealed... hooking next_tgid() makes it so that the concealment target’s process is skipped, making it invisible in the /proc/ list.

The content repeatedly describes malware and threat actors creating hidden folders, adding dot prefixes to filenames, and setting file attributes such as hidden/system to conceal files and directories from users and defenders.

Based on this, a reverse shell connects to the C&C server.

TABLEFLIP passively listens on all active interfaces for specialized command packets that contain an XOR encoded IP address and port to redirect traffic to using iptables commands.

Port Knocking is a method where the malware opens a specific port on an infected system and goes on standby. When the threat actor sends a Magic Packet to the system, the received packet is used as a basis to establish a connection with the C&C server.

The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.