JITTERLY Propose Change

According to VirLabs, JITTERLY is a statically linked Linux implant attributed to the Red Heron activity, which communicates with its C2 over encrypted reverse TCP, expecting a configured server banner before exchanging MessagePack-serialized messages encrypted with AES-128-GCM. On registration it sends a newly generated session key under an embedded bootstrap key, identifies the host by a SHA-1-based fingerprint over machine identifiers, username and MAC address, and beacons according to an authenticated configuration with configurable sleep delay and jitter. When running as root it installs itself together with an LD_PRELOAD rootkit component, SIXZUT, and its tasking interface includes checking, installing and uninstalling the rootkit as well as enumerating, updating and removing its hiding-rule groups. It also provides persistent access and TCP forwarding, and its protocol shows similarities with the Gopher agent of the Adaptix C2 framework.

References

There is no Yara-Signature yet.