Analysis Details How Syslogk Rootkit Hides Processes, Network Connections, Files, and Its Kernel Module
Summary
AhnLab analyzes how the Syslogk Linux rootkit uses kernel hooks to hide processes, TCP sockets, files, and its module, and reports that V3 Net for Linux Server detected and remediated it.
Key points
- Syslogk uses inline hooks on `proc_root_readdir` and `tcp4_seq_show` to conceal selected processes and TCP socket entries.
- It hooks the VFS `readdir` function to hide file or directory names containing “was-patch.”
- The rootkit removes its module node from the kernel module list and its kobject from `/sys/module`, hiding it from `lsmod` and module listings.
- AhnLab says V3 Net for Linux Server detected the hidden kernel module, restored visibility, and enabled previously hidden files to be seen again.
- The article lists the sample’s MD5 as `8433c3f870729889f4b9712e26fe2fc8`.
Article Details
- Attack Vectors
- Syslogk modifies Linux kernel API function prologues using inline hooking to conceal processes and TCP socket entries.
- Syslogk hooks the VFS table's readdir function to hide files and directories whose names contain "was-patch."
- Syslogk conceals its loadable kernel module by removing its module-list node and its kobject node from /sys/module.
- Defensive Notes
- ASEC reports that V3 Net for Linux Server detected the hidden kernel module, restored its visibility, and enabled previously concealed files to be viewed after remediation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 8433c3f870729889f4b9712e26fe2fc8 | MD5 hash listed in the article's IOC section for Syslogk. |