Full Report
This piece of malware has an insatiable appetite. Group-IB's Threat Intelligence unit offers their insights on the new RAT used in attacks against Thai companies.
Analysis Summary
# Tool/Technique: Krasue
## Overview
Krasue is a sophisticated Linux-based Remote Access Trojan (RAT) recently identified in attacks targeting Thai companies. It is primarily designed to maintain stealthy, long-term persistence on infected Linux systems. The malware is notable for its use of embedded kernel-mode rootkits to hide its presence and its ability to communicate via the RTSP (Real Time Streaming Protocol).
## Technical Details
- **Type:** Malware family (RAT) with Rootkit capabilities.
- **Platform:** Linux (Specifically targeting various kernel versions including 2.6.x and 3.10.x).
- **Capabilities:** Persistence, process/file hiding, privilege escalation, and remote command execution.
- **First Seen:** Identified by Group-IB in 2023 (though components suggest potential activity dating back to 2021).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1059.004 - Command and Scripting Interpreter: Unix Shell
- **TA0003 - Persistence**
- T1014 - Rootkit
- **TA0005 - Defense Evasion**
- T1014 - Rootkit
- T1027.002 - Obfuscated Files or Information: Software Packing
- T1564.001 - Hide Artifacts: Hidden Files and Directories
- **TA0011 - Command and Control**
- T1071.001 - Web Protocols (RTSP used for signaling)
- T1573 - Encrypted Channel
## Functionality
### Core Capabilities
- **Remote Access:** Provides attackers with a shell to execute commands on the infected host.
- **Rootkit Integration:** Utilizes Linux Kernel Modules (LKM) to hook syscalls, effectively hiding files, directories, and network connections.
- **Persistence:** Deploys as a background service or through rootkit-level hooks to ensure survival after reboots.
- **Multi-Kernel Support:** Contains multiple versions of its rootkit, each tailored to a specific Linux kernel version to ensure compatibility across different distributions.
### Advanced Features
- **RTSP Exploitation:** Uses the Real Time Streaming Protocol (RTSP) for C2 communication, a technique rarely seen in Linux malware, which may bypass traditional network filters looking for HTTP/HTTPS or DNS traffic.
- **XorDDoS Overlap:** Shares code characteristics and functional similarities with the rootkits used by XorDDoS, suggesting a shared development origin or source code reuse.
## Indicators of Compromise
- **File Hashes (SHA256):**
- `902013bc59be545fb70407e8883717453fb423a7a7209e119f112ff6771e44cc` (auwd.bin - Unpacked)
- `ed38a61a6b7af436120465d352baa4cdf4ed8f01a7db7245b6254353e52f818f` (auwd.bin - Packed)
- `3e37c7b65c1e46b2eb132f98f65c711b4169c6caeeaecc799abbda122c0c4a59` (Rootkit v3.10.0-514)
- **File Names:**
- `auwd.bin`
- **Network Indicators:**
- `128.199.226[.]11` (C2 IP)
- **Behavioral Indicators:**
- Presence of unexpected Linux Kernel Modules (LKM).
- Use of specific control strings like "god die" or "unhide_allz" within binary memory.
## Associated Threat Actors
- While specific attribution is not finalized, the malware's focus on Thai companies and technical overlaps with older Chinese-speaking botnet code (XorDDoS) provide initial leads for attribution.
## Detection Methods
- **Signature-based detection:** Use of the provided YARA rules (`linux_trojan_unpacked_krasue` and `linux_rootkit_krasue`) to scan file systems and memory.
- **Behavioral detection:** Monitoring for unauthorized `insmod` or `modprobe` activity and unusual RTSP traffic originating from servers that do not typically stream media.
## Mitigation Strategies
- **Prevention:** Implement strict access controls (RBAC) and disable the loading of unsigned kernel modules (Kernel Lockdown mode).
- **Hardening:** Regularly update Linux kernels to patched versions and use security modules like SELinux or AppArmor to restrict process capabilities.
- **Monitoring:** Deploy EDR (Endpoint Detection and Response) tools capable of monitoring system call integrity and LKM loading.
## Related Tools/Techniques
- **XorDDoS:** Shared rootkit code and logic.
- **LKM Rootkits:** General technique for kernel-level stealth.