Researchers from Gen Threat Labs have identified a new sophisticated rootkit called Snapekit, targeting Arch Linux system version 6.10.2-arch1-1 on x86_64 architecture. Snapekit allows attackers to gain unauthorized access to the system and control it while remaining undetected.
The rootkit integrates into the operating system by intercepting and modifying 21 system calls — the communication mechanism between applications and the operating system kernel. Snapekit uses a specialized dropper for deployment. The rootkit can identify and evade popular analysis and debugging tools such as Cuckoo Sandbox, JoeSandbox, Hybrid-Analysis, Frida, Ghidra, and IDA Pro. When one of these tools is detected, Snapekit alters its behavior to avoid detection.
The main objective of Snapekit is to conceal malicious code while remaining in user space rather than in the more controlled kernel space. This approach significantly complicates the detection and analysis of the threat. Furthermore, the rootkit employs PTrace protective mechanisms to detect debugging attempts, adding further challenges for analysts and security professionals.
Snapekit possesses multi-layer evasion techniques that allow it to avoid not only automated analysis tools (sandboxes and of virtual machines), but also complicate manual analysis. The creator of the rootkit, known by the nickname Humzak711, plans to soon publish the Snapekit project as open source on GitHub.
Source: linux.org.ru
