SIXZUT Propose Change

According to VirLabs, SIXZUT is a Linux userland rootkit implemented as a shared object that is loaded via LD_PRELOAD and acts as the companion of the JITTERLY implant. It carries an AES-128-CTR-encrypted configuration table, validated by CRC32, whose records name the agents to protect together with their C2 endpoints, and a single rootkit can serve multiple agents. Its hooks hide matching directory entries, process listings and network connections, refuse signals sent to protected processes, and conceal the rootkit's own library, state file and preload configuration. When loaded into a root process, it checks whether the configured agents are running and relaunches any missing agent as a daemon.

References

There is no Yara-Signature yet.