RedTail Linux Malware Masquerades, Kills Monitors
SANS.edu analysis of a RedTail Linux malware sample shows process masquerading, cron persistence, firewall manipulation, and active killing of monitoring/tracing tools.
A SANS.edu ISC guest diary details dynamic analysis of a RedTail Linux malware sample (multi-architecture: ARM, ARM64, i686, RISC-V, x86-64) captured via a Cowrie/DShield honeypot. The x86-64 UPX-packed ELF binary was detonated in an isolated Proxmox/INetSim analysis environment across three runs (non-root and root). Key behaviors observed include process masquerading (renaming itself via prctl to appear as 'php-fpm: pool www' or a PostgreSQL-like process while /proc/<PID>/exe still resolved to the RedTail binary), establishment of a dynamically-selected high-numbered TCP listener (observed on ports 39539, 40219, and 39983 across runs), attempted iptables manipulation to flush rules and open the listener port, and persistence via cron @reboot entries installed under whichever user context executed the malware (root or unprivileged victor58 account).
The malware also performed extensive host/hardware profiling via /proc and /sys (CPU topology, cache geometry, NUMA, huge pages, GPU, kernel cmdline, DMI identifiers) and obtained clear virtualization indicators (hypervisor CPU flag, QEMU/SeaBIOS/Q35 identifiers) but did not alter behavior based on detecting a VM — suggesting profiling may relate to resource suitability (e.g., for cryptomining or other computational tasks) rather than sandbox evasion. Notably, RedTail actively disrupted analysis tooling: it successfully killed inotifywait, strace, timeout, and sudo processes when running as root, and attempted (with EPERM failures) to kill root-owned monitors when unprivileged, demonstrating deliberate anti-analysis/anti-forensic behavior. The sample also attempted repeated outbound connections to public DNS-over-TLS resolvers (1.1.1.1, 8.8.8.8, 9.9.9.9, etc.) on TCP/853, plus two less-common IPs (80.152.203.134, 109.91.184.21) whose role could not be confirmed since the isolated test network blocked all external routes.
Defenders should look for processes named 'php-fpm: pool www' or PostgreSQL-like names whose /proc/<PID>/exe does not match expected binary paths, unexpected @reboot cron entries, unexplained iptables INPUT ACCEPT rules for high ephemeral ports, and outbound connection attempts to TCP/853 alongside SIGKILL activity against monitoring tools like auditd, inotify, or strace. A companion clean.sh script (not executed in testing) reportedly targets cron entries, shell startup files, temp directories, and miner-related processes, suggesting a possible connection to cryptomining operations, though this was not confirmed dynamically.
Mentioned in this report
Detection guidance
Malware Killing Analysis and Monitoring Tools
Detects malware killing monitoring/analysis processes (inotifywait, strace, timeout, auditd, sudo) via SIGKILL. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Malware Killing Analysis and Monitoring Tools
description: Detects processes sending SIGKILL (signal 9) to known monitoring and
analysis tools such as inotifywait, strace, timeout, auditd, and sudo. This is a
strong anti-forensics indicator typical of malware attempting to disable visibility.
tags:
- attack.defense-evasion
- attack.t1562.001
logsource:
category: process_creation
product: linux
detection:
selection:
CommandLine|contains:
- kill -9
- killall -9
- kill -KILL
CommandLine|re: (inotifywait|strace|timeout|auditd|sudo)
condition: selection
falsepositives:
- System administrators manually terminating strace sessions during troubleshooting
- Legitimate cleanup scripts removing timed-out processes
level: high
id: 79e7c8a8-5fb8-5455-a931-d2b600876fc8
status: experimental
author: Vorant
Cron Persistence Registration at Boot
Detects crontab modifications creating @reboot entries, typical malware persistence mechanism. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cron Persistence Registration at Boot
description: Detects suspicious modifications to user or system crontab files that
add @reboot entries. This is a common malware persistence technique observed in
RedTail and similar Linux malware.
tags:
- attack.persistence
- attack.t1053.003
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|endswith:
- /var/spool/cron/crontabs/*
- /etc/cron.d/*
Action: write
filter_content:
Content|contains: '@reboot'
condition: selection and filter_content
falsepositives:
- Legitimate system administration tools adding boot-time services
- Configuration management systems (Ansible, Puppet) deploying cron tasks
level: medium
id: 09c3f1da-1c71-5bff-a61d-b2b07eaec139
status: experimental
author: Vorant
2 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33326
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free