Deep Dive Into a Linux Rootkit Malware

Jan. 14, 2025, 8:46 a.m.

Description

This analysis examines a Linux rootkit malware deployed by remote attackers on a compromised CentOS system. The malware consists of a kernel module (sysinitd.ko) and a user-space binary (sysinitd). The kernel module hijacks inbound network traffic using a Netfilter hook, creates procfs entries for communication, and starts the user-space process. The user-space component disguises itself as 'bash' and enables remote command execution with root privileges. The attackers use a special 'attack-init' packet to initiate communication and can send encrypted commands to control the system. The analysis details the malware's initialization, network interception, data exchange mechanisms, and command execution process.

Date

  • Created: Jan. 14, 2025, 7:16 a.m.
  • Published: Jan. 14, 2025, 7:16 a.m.
  • Modified: Jan. 14, 2025, 8:46 a.m.

Indicators

  • d57a2cac394a778e19ce9b926f2e0a71936510798f30d20f207f2a49b49ce7b1
  • 8d016d02f8fbe25dce76481a90dd0b48630ce9e74e8c31ba007cf133e48b8526
  • 6edd7b3123de985846a805931ca8ee5f6f7ed7b160144aa0e066967bc7c0423a

Attack Patterns