REPTILE

Adversaries may buy, steal, or download malware that can be used during targeting.

Unlike other rootkit malware that typically only provide concealment capabilities, Reptile goes a step further by offering a reverse shell, allowing threat actors to easily take control of systems.

The Reptile rootkit demonstrates this technique by installing a malicious udev rule under /etc/udev/rules.d/... RUN+="/lib/udev/reptile".

upon examining the rc.local autorun script, it is evident that a command to ensure persistence exists between the tags “#<intel_audio>” and “#</intel_audio>” | It also supports persistence through Udev. The following rules file is created in the /lib/udev/rules.d/ directory... to ensure that it will be executed even after a reboot.

Reptile’s loader directly invokes the init_module syscall with an in-memory decrypted kernel blob... Effective detection should therefore focus on tracing these syscalls directly.

Aside from the concealment and Port Knocking features, Reptile provides a feature where the “root” command can be used to give the current user root privileges.

The Reptile rootkit demonstrates this technique by installing a malicious udev rule under /etc/udev/rules.d/... RUN+="/lib/udev/reptile".

upon examining the rc.local autorun script, it is evident that a command to ensure persistence exists between the tags “#<intel_audio>” and “#</intel_audio>” | It also supports persistence through Udev. The following rules file is created in the /lib/udev/rules.d/ directory... to ensure that it will be executed even after a reboot.

Reptile’s loader directly invokes the init_module syscall with an in-memory decrypted kernel blob... Effective detection should therefore focus on tracing these syscalls directly.

“The rootkit writes a jump instruction at the start (prologue) of a kernel function, which diverts execution to the rootkit’s own code.” | “Rootkits are stealthy malware designed to conceal malicious activity, such as files, processes, network connections, kernel modules, or accounts.”

Stripping binaries and appending a single null byte significantly degraded static detections; limited XOR string/configuration encoding and lightweight packing were also used.

Rootkits often rename their processes and threads to match benign system components... kworker, migration, rcu_sched, sshd, systemd, dbus-daemon, or bash.

BridgeAgent ... маскировал свой процесс под /usr/bin/gnome-shell. Некоторые бинарники злоумышленники переименовывали ... чтобы выдать файлы за легитимные агенты SentinelOne и Cybereason.

Некоторые бинарники злоумышленники ... меняли их временные метки ... Также хакеры меняли временные метки файлов, чтобы затруднить расследование и восстановление хронологии атаки.

Reptile provides a concealment feature for files, directories, processes, and network communications. | Reptile provides a file tampering feature, which allows the contents of a file to be hidden... the strings between these tags are concealed. | When a PID is given along with the “hide” or “show” command, the process of the PID is concealed... hooking next_tgid() makes it so that the concealment target’s process is skipped, making it invisible in the /proc/ list.

The content repeatedly describes malware and threat actors creating hidden folders, adding dot prefixes to filenames, and setting file attributes such as hidden/system to conceal files and directories from users and defenders.

Based on this, a reverse shell connects to the C&C server.

TABLEFLIP passively listens on all active interfaces for specialized command packets that contain an XOR encoded IP address and port to redirect traffic to using iptables commands.

Port Knocking is a method where the malware opens a specific port on an infected system and goes on standby. When the threat actor sends a Magic Packet to the system, the received packet is used as a basis to establish a connection with the C&C server.