RedTail Linux Malware Masquerades, Kills Monitors
SANS.edu analysis of a RedTail Linux malware sample shows process masquerading, cron persistence, firewall manipulation, and active killing of monitoring/tracing tools.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
A SANS.edu ISC guest diary details dynamic analysis of a RedTail Linux malware sample (multi-architecture: ARM, ARM64, i686, RISC-V, x86-64) captured via a Cowrie/DShield honeypot. The x86-64 UPX-packed ELF binary was detonated in an isolated Proxmox/INetSim analysis environment across three runs (non-root and root). Key behaviors observed include process masquerading (renaming itself via prctl to appear as 'php-fpm: pool www' or a PostgreSQL-like process while /proc/<PID>/exe still resolved to the RedTail binary), establishment of a dynamically-selected high-numbered TCP listener (observed on ports 39539, 40219, and 39983 across runs), attempted iptables manipulation to flush rules and open the listener port, and persistence via cron @reboot entries installed under whichever user context executed the malware (root or unprivileged victor58 account).
The malware also performed extensive host/hardware profiling via /proc and /sys (CPU topology, cache geometry, NUMA, huge pages, GPU, kernel cmdline, DMI identifiers) and obtained clear virtualization indicators (hypervisor CPU flag, QEMU/SeaBIOS/Q35 identifiers) but did not alter behavior based on detecting a VM — suggesting profiling may relate to resource suitability (e.g., for cryptomining or other computational tasks) rather than sandbox evasion. Notably, RedTail actively disrupted analysis tooling: it successfully killed inotifywait, strace, timeout, and sudo processes when running as root, and attempted (with EPERM failures) to kill root-owned monitors when unprivileged, demonstrating deliberate anti-analysis/anti-forensic behavior. The sample also attempted repeated outbound connections to public DNS-over-TLS resolvers (1.1.1.1, 8.8.8.8, 9.9.9.9, etc.) on TCP/853, plus two less-common IPs (80.152.203.134, 109.91.184.21) whose role could not be confirmed since the isolated test network blocked all external routes.
Defenders should look for processes named 'php-fpm: pool www' or PostgreSQL-like names whose /proc/<PID>/exe does not match expected binary paths, unexpected @reboot cron entries, unexplained iptables INPUT ACCEPT rules for high ephemeral ports, and outbound connection attempts to TCP/853 alongside SIGKILL activity against monitoring tools like auditd, inotify, or strace. A companion clean.sh script (not executed in testing) reportedly targets cron entries, shell startup files, temp directories, and miner-related processes, suggesting a possible connection to cryptomining operations, though this was not confirmed dynamically.
Mentioned in this report
Detection guidance
Malware Killing Analysis and Monitoring Tools
A behavioural hunt for the technique in general.
Detects malware killing monitoring/analysis processes (inotifywait, strace, timeout, auditd, sudo) via SIGKILL. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Malware Killing Analysis and Monitoring Tools
description: Detects processes sending SIGKILL (signal 9) to known monitoring and
analysis tools such as inotifywait, strace, timeout, auditd, and sudo. This is a
strong anti-forensics indicator typical of malware attempting to disable visibility.
tags:
- attack.defense-impairment
- attack.t1685
logsource:
category: process_creation
product: linux
detection:
selection:
CommandLine|contains:
- kill -9
- killall -9
- kill -KILL
CommandLine|re: (inotifywait|strace|timeout|auditd|sudo)
condition: selection
falsepositives:
- System administrators manually terminating strace sessions during troubleshooting
- Legitimate cleanup scripts removing timed-out processes
level: high
id: 79e7c8a8-5fb8-5455-a931-d2b600876fc8
status: experimental
author: Vorant
2 more detections for this report are in the app — indicator rules, each with Sigma, Splunk SPL, and Elastic, some with Microsoft Defender XDR KQL, YARA, or Suricata as well. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33326
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs