Skidmap is a recent sample of the Linux malware that loads malicious kernel modules to hide it’s Cryptocurrency mining activities by faking network traffic and CPU usage.
The malware not only generates Cryptocurrency, but it also set’s up a secret master password on the infected system, which gives attackers complete system access.
Security researchers from Trend Micro observed the Linux Malware, Skidmap. According to their analysis of the malware, “it loads kernel-mode rootkits are not only more difficult to detect compared to its user-mode counterparts — but attackers can also use them to gain unfettered access to the affected system.”
Linux Malware Skidmap Infection Chain
The malware install’s through crontab, a utility used in Unix-like machines to schedule the job to run at regular time intervals. Upon installation, it downloads multiple binaries to the infected machine which affects the machine’s security settings.
Skidmap also set’s up backdoor access to the machine, besides backdoor, it creates another way also to gain unrestricted access to the system by setting a master password, which let attackers log in the system as any user.
If the binary checks determine the infected system using Debian or RHEL/CentOS, then it drops cryptocurrency miner and additional components depend upon the operating system.
Notable Malicious Components
The Linux malware includes malicious components to evade its malicious activities and ensure they continue to run them in the infected machine.
A fake “rm” binary – Set’s malicious corn job task to download and execute a file.
kaudited – Drops Kernel modules and watchdog component to monitor the cryptocurrency miner file and process.
iproute – Used to hide files and fake network traffic.
netlink – Fakes network-related statistics and CPU-related statistics.
When compared with other malware, Skidmap employes advanced method to remain undetected and creates multiple ways for attacks to connect with the infected machine.
EvilGnome is yet another Linux malware observed recently with the capabilities of creating a backdoor and spying the Linux desktop users.
To read the original article:https://gbhackers.com/linux-malware-skidmap/