https://aegrah.github.io/tags/malware-analysis.htmlRecent content in Malware Analysis on RGROSECHugo -- gohugo.ioenCopyright © Ruben GroenewoudThu, 02 Apr 2026 12:00:00 +0200https://aegrah.github.io/post/2026-04-02-linux-rootkits-2-caught-in-the-act.htmlThu, 02 Apr 2026 12:00:00 +0200https://aegrah.github.io/post/2026-04-02-linux-rootkits-2-caught-in-the-act.html In the second part of our two-part Linux rootkit series at Elastic Security Labs, Remco Sprooten and I turn from theory to detection engineering. We begin by demonstrating why static detection is often unreliable against Linux rootkits—even trivial modifications like stripping binaries or appending a single null byte can significantly degrade VirusTotal detection rates. From there, we cover practical behavioral detection across userland rootkit loading (LD_PRELOAD, /etc/ld.so.preload, dynamic linker configuration), kernel-space LKM loading via init_module/finit_module syscalls, out-of-tree and unsigned module taint signals, kill-signal abuse, eBPF rootkits, io_uring-based evasion, persistence mechanisms, and defense evasion techniques such as masquerading as kernel threads and log cleansing.https://aegrah.github.io/post/2026-03-26-illuminating-voidlink.htmlThu, 26 Mar 2026 12:00:00 +0200https://aegrah.github.io/post/2026-03-26-illuminating-voidlink.html At Elastic Security Labs, Remco Sprooten and I analyzed a data dump containing source code, compiled binaries, and deployment scripts for the kernel rootkit components of VoidLink—a cloud-native Linux malware framework first documented by Check Point Research. The dump revealed a multigenerational rootkit framework actively developed and tested across real targets, spanning CentOS 7 through Ubuntu 22.04. VoidLink's architecture immediately stood out: rather than relying on a single technique, it combines a traditional Loadable Kernel Module with eBPF programs in a hybrid design rarely encountered in the wild.https://aegrah.github.io/post/2026-03-05-linux-rootkits-1-hooked-on-linux.htmlThu, 05 Mar 2026 12:00:00 +0200https://aegrah.github.io/post/2026-03-05-linux-rootkits-1-hooked-on-linux.html In the first part of our two-part Linux rootkit series at Elastic Security Labs, Remco Sprooten and I explore the theory behind how rootkits work: their taxonomy, evolution, and the hooking techniques they use to subvert the kernel. We trace the progression from early userland shared object rootkits through LKM-based implants, eBPF rootkits, and emerging io_uring-based evasion. The publication covers rootkit loader and payload components, kernel hooking techniques including IDT hooking, syscall table patching, inline hooking, VFS hooking, ftrace and kprobes abuse, the KHOOK framework, userspace LD_PRELOAD interposition, and eBPF program attachment.https://aegrah.github.io/post/2025-04-01-outlaw-linux-malware.htmlTue, 01 Apr 2025 12:00:00 +0200https://aegrah.github.io/post/2025-04-01-outlaw-linux-malware.html At Elastic Security Labs, Remco Sprooten and I analyzed OUTLAW, a persistent yet unsophisticated auto-propagating coinminer package that remains active across multiple versions despite lacking advanced evasion techniques. It leverages simple but impactful tactics such as SSH brute-forcing, SSH key and cron-based persistence, and manually modified commodity miners and IRC channels. We deployed a honeypot to observe the attackers in action, revealing both automated propagation and manual post-compromise activity—including real-time command entry and even typos from the operator.https://aegrah.github.io/post/2024-12-12-declawing-pumakit.htmlThu, 12 Dec 2024 12:00:00 +0200https://aegrah.github.io/post/2024-12-12-declawing-pumakit.html At Elastic Security Labs, we uncovered PUMAKIT, a sophisticated multi-stage Linux malware with advanced rootkit capabilities. Initially identified through routine threat hunting on VirusTotal, PUMAKIT consists of a dropper (cron), two memory-resident executables, an LKM rootkit module, and a userland shared object (SO) rootkit. The rootkit, internally named PUMA by its authors, employs ftrace to hook 18 syscalls and multiple kernel functions, enabling stealthy privilege escalation, file and process hiding, and anti-debugging measures.https://aegrah.github.io/post/2024-09-27-betting-on-bots-ref6138.htmlFri, 27 Sep 2024 12:00:00 +0200https://aegrah.github.io/post/2024-09-27-betting-on-bots-ref6138.html At Elastic Security Labs, we uncovered a sophisticated Linux malware campaign exploiting Apache2 servers since March 2024. Attackers used multiple malware families, including KAIJI (DDoS) and RUDEDEVIL (crypto miner), along with custom tools for persistence and control. They leveraged C2 channels disguised as kernel processes, Telegram bots, and cron jobs. The investigation suggests a potential Bitcoin/XMR mining scheme tied to gambling APIs, hinting at money laundering. Continuous malware development was observed through a file share hosting fresh KAIJI samples.https://aegrah.github.io/post/2023-07-31-an-elastic-approach-to-large-scale-dynamic-malware-analysis.htmlMon, 31 Jul 2023 12:00:00 +0200https://aegrah.github.io/post/2023-07-31-an-elastic-approach-to-large-scale-dynamic-malware-analysis.html This research delves into large-scale malware analysis conducted by Elastic Security Labs, highlighting how Elastic ingest pipelines were used to filter out benign and duplicate data during dynamic malware analysis. By leveraging these pipelines, we efficiently managed vast datasets, enabling us to focus on identifying malicious behaviors. The study also explores different types of ingest pipelines, their applications, and provides a step-by-step workflow for implementing them, including automation scripts. Finally, we present our findings and discuss how others can replicate this workflow to achieve similar results.