{"id":120109,"date":"2024-10-08T19:09:47","date_gmt":"2024-10-08T17:09:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/snapekit-novyj-rutkit-naczelennyj-na-sistemy-arch-linux"},"modified":"2024-10-08T19:09:47","modified_gmt":"2024-10-08T17:09:47","slug":"snapekit-novyj-rutkit-naczelennyj-na-sistemy-arch-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/es\/blog\/news\/snapekit-novyj-rutkit-naczelennyj-na-sistemy-arch-linux","title":{"rendered":"Snapekit: nuevo rootkit dirigido a sistemas Arch Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Snapekit: <\/p>\n

Investigadores de Gen Threat Labs han descubierto un nuevo y complejo rootkit llamado Snapekit, que est\u00e1 dirigido a la versi\u00f3n 6.10.2-arch1-1 del sistema Arch Linux en la arquitectura x86_64. Snapekit permite a los atacantes obtener acceso no autorizado al sistema y controlarlo, mientras permanece indetectado.<\/p>\n

El rootkit se integra en el funcionamiento del sistema operativo interceptando y modificando 21 llamadas al sistema, el mecanismo de comunicaci\u00f3n entre las aplicaciones y el n\u00facleo del sistema operativo. Snapekit utiliza un dropper espec\u00edfico para su despliegue. El rootkit puede reconocer y evitar herramientas populares de an\u00e1lisis y depuraci\u00f3n, como Cuckoo Sandbox, JoeSandbox, Hybrid-Analysis, Frida, Ghidra e IDA Pro. Al detectar una de estas herramientas, Snapekit cambia su comportamiento para evitar ser descubierto.<\/p>\n

La tarea principal de Snapekit es ocultar el c\u00f3digo malicioso, permaneciendo en el espacio del usuario en lugar de en el espacio del n\u00facleo m\u00e1s controlado. Este enfoque dificulta significativamente la detecci\u00f3n y el an\u00e1lisis de la amenaza. Adem\u00e1s, el rootkit aplica mecanismos de protecci\u00f3n PTrace para detectar intentos de depuraci\u00f3n, lo que a\u00f1ade complejidad para los analistas y especialistas en ciberseguridad.<\/p>\n

Snapekit cuenta con m\u00faltiples capas de m\u00e9todos de evasi\u00f3n que permiten evitar no solo herramientas automatizadas de an\u00e1lisis (sandboxers y m\u00e1quinas virtuales<\/a>), sino que tambi\u00e9n dificultan el an\u00e1lisis manual. El creador del rootkit, conocido con el seud\u00f3nimo Humzak711, planea publicar pronto el proyecto Snapekit con c\u00f3digo abierto en GitHub.<\/p>\n

Fuente: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 Gen Threat Labs \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0441\u043b\u043e\u0436\u043d\u044b\u0439 \u0440\u0443\u0442\u043a\u0438\u0442 Snapekit, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 Arch Linux \u0432\u0435\u0440\u0441\u0438\u0438 6.10.2-arch1-1 \u043d\u0430 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435 x86_64. Snapekit \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0435\u044e, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043e\u0441\u0442\u0430\u0432\u0430\u044f\u0441\u044c \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u043e\u0439. \u0420\u0443\u0442\u043a\u0438\u0442 \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442\u0441\u044f \u0432 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044f \u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u044f 21 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0432\u044b\u0437\u043e\u0432 \u2014 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u0435\u0436\u0434\u0443 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438 \u0438 \u044f\u0434\u0440\u043e\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":120110,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120109","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Snapekit: nuevo rootkit dirigido a sistemas Arch Linux | ProHoster","description":"Investigadores de Gen Threat Labs.","canonical_url":"https:\/\/prohoster.info\/es\/blog\/news\/snapekit-novyj-rutkit-naczelennyj-na-sistemy-arch-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Snapekit: \u043d\u043e\u0432\u044b\u0439 \u0440\u0443\u0442\u043a\u0438\u0442, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Arch Linux | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 Gen Threat Labs.","og:url":"https:\/\/prohoster.info\/es\/blog\/news\/snapekit-novyj-rutkit-naczelennyj-na-sistemy-arch-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-10-08T17:09:47+00:00","article:modified_time":"2024-10-08T17:09:47+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120109","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:33:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 07:10:22","updated":"2026-02-09 17:33:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/120109","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=120109"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/120109\/revisions"}],"predecessor-version":[{"id":159420,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/120109\/revisions\/159420"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media\/120110"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=120109"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=120109"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=120109"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}