Procedure examples

Skidmap is a kernel-mode rootkit that has the ability to hook system calls to hide specific files and fake network and CPU-related statistics to make the CPU load of the infected machine always appear low.

Skidmap has encrypted it's main payload using 3DES.

Skidmap has created a fake rm binary to replace the legitimate Linux binary.

Skidmap has installed itself via crontab.

Skidmap has monitored critical processes to ensure resiliency.

Skidmap has used pm.sh to download and install its main payload.

Skidmap has the ability to check whether the infected system’s OS is Debian or RHEL/CentOS to determine which cryptocurrency miner it should use.

Skidmap has checked for the existence of specific files including /usr/sbin/setenforce and /etc/selinux/config. It also has the ability to monitor the cryptocurrency miner file and process.

Skidmap has the ability to add the public key of its handlers to the authorized_keys file to maintain persistence on an infected host.

Skidmap has the ability to download files on an infected host.

Skidmap has the ability to download, unpack, and decrypt tar.gz files .

Skidmap is a kernel-mode rootkit used for cryptocurrency mining.

Skidmap has the ability to check if /usr/sbin/setenforce exists. This file controls what mode SELinux is in.

Skidmap has the ability to install several loadable kernel modules (LKMs) on infected machines.

Skidmap has the ability to replace the pam_unix.so file on an infected machine with its own malicious version that accepts a specific backdoor password for all users.

Skidmap has the ability to set SELinux to permissive mode.