RekoobeMalware
A Trojan for Linux intended to infect machines with the SPARC architecture and Intel x86, x86-64 computers. The Trojan’s configuration data is stored in a file encrypted with XOR algorithm. Some versions have there configuration stored within the[.]data section using RC4 to encrypt the details.From MISP Galaxy
Last reported 18 days ago, by The Hacker News3 reports
ATT&CK techniques
6 of 34 · each with the sentence it comes from- T1005Data from Local System
“T1005 Data from Local System”
- T1008Fallback Channels
“T1008 Fallback Channels”
- T1016System Network Configuration Discovery
“T1016 System Network Configuration Discovery”
- T1027Obfuscated Files or Information
“T1027 Obfuscated Files or Information”
- T1027.013Encrypted/Encoded File
“T1027.013 Encrypted/Encoded File”
- T1030Data Transfer Size Limits
“T1030 Data Transfer Size Limits”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan“The malicious artifacts include a new BPFDoor variant and a BPF Rekoobe build used against South Korean targets, and a previously unreported Linux implant dubbed AVERAT that's delivered via a dropper and deployed against Taiwanese appliances.”
-
New Stealthy Linux Backdoors Target Telecoms, Masquerade as Email Traffic“In research published October 2, Rapid7 said it tracked a newly observed BPFDoor variant and a BPF Rekoobe build used against South Korean targets, along with a dropper and six builds of an implant it calls AVERAT deployed against Taiwanese appliances.”
-
SMTP is the key: BPFDoor and AVERAT hitting the network edge“…into the software and device conventions of the telecom environments they target. The set spans a newly observed BPFDoor variant, a BPF Rekoobe build seen against South Korean targets, a dropper, and six builds of a Linux implant we track as AVERAT, deployed against Taiwanese app…”
Indicators in its reports
named in the reports above- mx.zxopfds[.]comin 2 reports
- spamsniper[.]pidin 1 report
- a37ea9897221d449…ee58931adbf3in 1 report
- 7e667ba5f9df912e…18ebd925b1b5in 1 report
- a6f3b7f932761fb1…65da195bfa7ain 1 report
- 4435fcd686292109…13ee8e226ef9in 1 report
- 652508a9cf40bee8…c21f73b4963fin 1 report
- 2bedc26d4b29b435…4fb1656d7b15in 1 report
- 59.125.211[.]65in 1 report
- 122.116.138[.]33in 1 report
- 1.34.200[.]85in 1 report
- bf8135f46ecedfe5…8e6597f49e47in 1 report
- 4925bcca085ec504…336c697b4de8in 1 report
- a4379e115d3c4420…d47de68e6a6ain 1 report
- 925c041807d4fb9d…44478ffc2cf2in 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.