SuterusuMalware
- hcrootkit
Last reported 7 months ago, by Elastic Security Labs2 reports
ATT&CK techniques
6 of 14 · each with the sentence it comes from- T1014Rootkit
“T1014: Rootkit”
- T1027Obfuscated Files or Information
“T1027.002: Obfuscated Files or Information: Software Packing”
- T1027.002Software Packing
“T1027.002: Obfuscated Files or Information: Software Packing”
- T1036Masquerading
“a file masquerading as a product update) from an untrustworthy third-party source.”
- T1059Command and Scripting Interpreter
“T1059.004: Command and Scripting Interpreter: Unix Shell”
- T1059.004Unix Shell
“T1059.004: Command and Scripting Interpreter: Unix Shell”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft“Another example is Suterusu, which also applied inline patching for some of its hooks.”
-
Curse of the Krasue: New Linux Remote Access Trojan targets Thailand“Given that various threat actors have used code snippets from the three different open-source projects (Diamorphine, Suterusu, Rooty) to create Krasue’s rootkit, it is difficult to accurately attribute the source code to a specific threat group.”
Indicators in its reports
named in the reports above- 128.199.226[.]11in 1 report
- c8f761d3ef7cd16e…22c6e31332eain 1 report
- 902013bc59be545f…2ff6771e44ccin 1 report
- b6db6702ca85bc80…689e54b8205din 1 report
- ed38a61a6b7af436…4353e52f818fin 1 report
- afbc79dfc4c7c4fd…1f3d829967a4in 1 report
- 97f08424b14594a5…afe0a032b772in 1 report
- 38ba7790697da0a7…56dde644e353in 1 report
- e0748b32d0569dfa…68fea86e6632in 1 report
- 4428d7bd7ae613ff…6946cc46b5e1in 1 report
- c9552ba602d20457…b79f2bf371e5in 1 report
- 3e37c7b65c1e46b2…da122c0c4a59in 1 report
- 8a58dce7b5741144…e9dd4dc94831in 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.