Rewterz Threat Alert – A New Multiplatform Backdoor Targeting Linux

Severity

Medium

Analysis Summary

A New Multiplatform Backdoor targeting Linux which does not have any known connections to other threat groups.

Technical Analysis

The Linux binary is a statically linked ELF file, while the Windows binary is a dynamically linked PE file.

Both instances of this malware are practically identical in terms of overall functionality, with minor implementation differences. However, if we pay close attention to each instance we can draw some conclusions regarding the nature of the authors.

Both malware instances share the same protocol to communicate with the same CNC server. However, these instances have different delivery vectors:

Backdoor Analysis

The Windows variant of this malware does not represent a complex threat in terms of Windows malware. Conversely, the Linux variant shows more sophistication in regards to the implementation details used to replicate the same functionality.

This indicates information regarding the malware authors’ development environment preference.

The main function is not obfuscated and appears to be straightforward in logic. In the Windows variant we can see how some strings are decoded in the beginning of the function.

Impact

• Arbitrary execution of shell commands
• Arbitrary binary execution

Indicators of Compromise

IP

• 185[.]198[.]56[.]53
• 193[.]29[.]15[.]147

SHA-256

• 5d51dbf649d34cd6927efdb6ef082f27a6ccb25a92e892800c583a881bbf9415
• 907e1dfde652b17338d307b6a13a5af7a8f6ced93a7a71f7f65d40123b93f2b8

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders.