Stealthy 'sedexp' #Linux #malware evaded #detection for two years
Regarding its operational capabilities, the malware uses either forkpty or pipes and a forked new process to set up a reverse shell for the attacker to remotely access the infected device.#Sedexp also employs memory #manipulation techniques to hide any file containing the string "sedexp" from standard commands like 'ls' or 'find,' concealing its presence on the system.
#software #news #security #cybersecurity #research #problem #cybercrime
like this
Birne Helene
in reply to anonymiss • • •Birne Helene
in reply to anonymiss • • •Meaning, this:
ps aux | grep kdevtmpfs | awk '{print $2}' | xargs kill -9
would be bad advice.
lann
in reply to anonymiss • • •Birne Helene
in reply to anonymiss • • •Birne Helene
in reply to anonymiss • • •lann
in reply to anonymiss • • •Birne Helene
in reply to anonymiss • • •utopiArte
in reply to anonymiss • • •Birne Helene
in reply to anonymiss • • •Removing the udev rule and regular scans for
kdevtmpfs
might help, I'd say.There will be no output on a system not infected.
Since the system process has been started early, its pid will be small, so any other process by the same name will be identifiable.
This will yield one process id on a clean system, and more than one on an infected one. You can then either kill the process manually or add
| xargs kill -9
to the above line.utopiArte likes this.
utopiArte
in reply to Birne Helene • • •David
in reply to anonymiss • • •because
/etc/udev/rules.d/
is emptyutopiArte likes this.
Birne Helene
in reply to anonymiss • • •utopiArte likes this.