SymbioteMalware
A malware capable of capturing credentials and enabling backdoor access, implemented as a userland rootkit. It uses three methods for hiding its network activity, by hooking and hijacking 1) fopen/fopen64, 2) eBPF, 3) a set of libpcap functions.From MISP Galaxy
Last reported 20 months ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 13 · each with the sentence it comes from- T1014Rootkit
“T1014 - Rootkit”
- T1036Masquerading
“| | Masquerading Space After Filename |”
- T1036.006Space after Filename
“| | Masquerading Space After Filename |”
- T1053Scheduled Task/Job
“…able hunts for each persistence mechanism; however, more details regarding the basics of threat hunting are outlined in the “Hunting for T1053 - scheduled task/job” section of “Linux Detection Engineering - A primer on persistence mechanisms”.”
- T1098Account Manipulation
“T1098.004 - Account Manipulation: SSH Authorized Keys”
- T1098.004SSH Authorized Keys
“T1098.004 - Account Manipulation: SSH Authorized Keys”
What the reports say
1 report, newest first · the exact sentence from each-
Linux Detection Engineering - A Continuation on Persistence Mechanisms“Malware such as HiddenWasp, Symbiote, and open-source rootkits such as Medusa and Azazel leverage this technique to establish persistence.”
Indicators in its reports
named in the reports above- hxxp://192.168.1[.]100:8080/cmd.php?cmd=whoamiin 1 report
- hxxp://192.168.1[.]100:8080/cgi-bin/reverse.pyin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.