reptileMalware
REPTILE is an open-source Linux rootkit with multiple components that provides backdoor access and functionality.From MITRE ATT&CK
Last reported 6 months ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1014Rootkit
“Hooked on Linux: Rootkit Detection Engineering”
- T1036Masquerading
“Masquerading as legitimate processes”
- T1070.006Timestomp
“Once a rootkit is finished clearing its traces, it may timestomp the files it altered to ensure no file modification trace is left behind:”
- T1204.005Malicious Library
“A similar method involves altering the dynamic linker’s configuration to prioritize malicious library paths.”
- T1205.001Port Knocking
“The example below shows Reptile’s port knocking functionality, where the kernel thread forks, changes its session ID to 0, and sets up the network connection:”
- T1543.002Systemd Service
“Systemd Service Created”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Hooked on Linux: Rootkit Detection Engineering“ACTION=="add", ENV{MAJOR}=="1", ENV{MINOR}=="8", RUN+="/lib/udev/reptile"”
Indicators in its reports
named in the reports above- auditd[.]datain 1 report
- config[.]fishin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.