6 minhigh
Reverse Engineering the Auto-Color Linux Backdoor
The Auto-Color Linux backdoor provides remote access while employing a user-space rootkit to hide its presence. It achieves persistence by dropping a shared library and registering it via /etc/ld.so.preload, which loads the library into other dynamically linked processes. The rootkit component hooks libc functions to hide files, filter network connections in /proc/net/tcp, and disable SELinux enforcement.
Sens:▲ 24hConf:high
Showing defanged values
- filename/etc/ld.so.preloadFile used to load the rootkit library globally into dynamically linked binaries. The malware writes the path to libcext.so.2 here.
- filename/etc/ld.so.preload.realAlternate name used by the rootkit for redirection and concealment.
- filename/etc/ld.so.preload.xxxAlternate name used by the rootkit for redirection and concealment.
- filename/lib/x86_64-linux-gnu/libcext.so.2Path where the rootkit library is dropped by the malware.
- filename/tmp/crossWorking directory used by the malware when running without root privileges.
- filename/tmp/cross/config-err-20FF3326State file containing an 8-byte binary value read periodically.
- filename/tmp/cross/config-err-A7F5EF0DLock file used for single-instance enforcement.
- filename/var/log/crossWorking directory used by the malware when running with root privileges.
- filename/var/log/cross/auto-colorInstallation path of the main payload when executed with root privileges.
- ip146[.]70[.]41[.]178Primary C2 server. The sample repeatedly attempts to connect to this IP over TCP port 443.
- sha256270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43SHA-256 hash of the main Auto-Color ELF backdoor executable.
- sha256bf503b5eb456f74187a17bb8c08bccc9b3d91a7f0f6fd50110540b051510d1caSHA-256 hash of the dropped user-space rootkit library libcext.so.2.
Detection / Hunteropenrouter
What Happened
A newly discovered Linux malware program called Auto-Color gives attackers remote control over infected computers while actively hiding its own activity. When it runs with administrative privileges, it installs a hidden component that tricks other programs into not showing the malware's files or network connections. It does this by intercepting normal system functions. Organizations using Linux systems, particularly universities and government offices, may be affected. It matters because the malware can operate stealthily, making detection difficult without specialized monitoring. Administrators should look for specific files and network connections associated with this malware and block the known malicious IP address.
Key Takeaways
- Auto-Color is a Linux backdoor that drops a user-space rootkit to hide its files and network connections.
- It uses an LD_PRELOAD mechanism by writing to /etc/ld.so.preload to load the rootkit library into other dynamically linked processes.
- The rootkit attempts to disable SELinux enforcement and filters /proc/net/tcp to hide C2 connections.
- It distinguishes between root and non-root execution paths, installing itself in /var/log/cross or /tmp/cross respectively.
Affected Systems
- Linux x86-64
- Linux systems with dynamically linked binaries
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Execution method is currently unknown, but payload is run on the target Linux system.
- Execution: The malware checks effective UID. If root, it uses /var/log/cross; otherwise, it uses /tmp/cross. It double-forks to run in the background.
- Persistence & Defense Evasion: If running as root, it drops a shared library to /lib/x86_64-linux-gnu/libcext.so.2 and writes its path to /etc/ld.so.preload to load it into other processes.
- Rootkit Activation: The loaded library hooks libc functions to hide its files, filters /proc/net/tcp, and attempts to disable SELinux enforcement.
- C2: The backdoor attempts to connect to 146.70.41.178 over port 443 to await commands.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: Yes
- Platforms: IDA Python script (payload extraction)
The article contains an IDA Pro Python script to extract the embedded payload from the main sample, but no detection rules for SIEM or EDR.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can observe file creation in /var/log/cross, modifications to /etc/ld.so.preload, and network connections to the C2. However, if the rootkit is active, it may filter these from tools that rely on libc, though kernel-level telemetry should still be visible. |
| Network Visibility | High | The backdoor attempts to connect to 146.70.41.178:443, which is easily observable at the network level if the traffic is not blocked. |
| Detection Difficulty | Moderate | Detecting the initial file drops and network connections is straightforward. However, the rootkit component requires understanding of LD_PRELOAD mechanisms and may evade user-space monitoring tools if not caught early. |
Required Log Sources
- File integrity monitoring (FIM) for /etc/ld.so.preload
- Process execution logs (auditd, EDR)
- Network connection logs (firewall, IDS, EDR)
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Look for modifications to /etc/ld.so.preload, which is a common persistence and evasion mechanism. | File integrity monitoring (FIM), auditd, EDR file write events | Persistence | Low to Medium. Some legitimate software (e.g., certain antivirus, monitoring tools) uses LD_PRELOAD, but the specific file path written by this malware is distinct. |
| Hunt for processes creating files in /var/log/cross or /tmp/cross directories. | EDR process and file events, auditd | Execution | Low. These are non-standard paths for log files. |
| Monitor for network connections to 146.70.41.178 on port 443. | Network firewall logs, IDS, EDR network events | C2 | Low. This is a specific, known malicious IP. |
Control Gaps
- User-space monitoring tools may not see the hidden files or network connections if the rootkit is active, as it hooks libc functions.
Key Behavioral Indicators
- Modification of /etc/ld.so.preload
- Creation of /lib/x86_64-linux-gnu/libcext.so.2
- Process creating /var/log/cross/
False Positive Assessment
Low
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Block network traffic to 146.70.41.178.
- Search endpoint file systems for the presence of /var/log/cross, /tmp/cross, /lib/x86_64-linux-gnu/libcext.so.2, and modifications to /etc/ld.so.preload.
- If an infection is found, isolate the host and perform memory capture to analyze the rootkit behavior before it unloads.
Infrastructure Hardening
- Implement file integrity monitoring (FIM) specifically for /etc/ld.so.preload and /lib/ directories.
- Consider deploying auditd rules to monitor for execution of processes from /var/log/cross or /tmp/cross.
User Protection
- Ensure endpoints run with least privilege. The rootkit installation only occurs if the initial payload is executed with root privileges.
- Deploy EDR agents capable of monitoring file modifications in system library paths.
Security Awareness
- Train users on the risks of executing unknown binaries on Linux systems, as the initial delivery method is currently unknown but likely involves user interaction.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping5 techniques
Additional IOCs
- File Paths:
/tmp/cross- Working directory used by the malware when running without root privileges./var/log/cross- Working directory used by the malware when running with root privileges./tmp/cross/config-err-A7F5EF0D- Lock file used for single-instance enforcement./tmp/cross/config-err-20FF3326- State file containing an 8-byte binary value read periodically./etc/ld.so.preload.xxx- Alternate name used by the rootkit for redirection and concealment./etc/ld.so.preload.real- Alternate name used by the rootkit for redirection and concealment.
- Command Lines:
- Purpose: Payload execution | Tools:
execl| Stage: Execution |execl(..., "-color", "-flush")
- Purpose: Payload execution | Tools:
- Other:
0x36D94F19- System V shared-memory key used by the rootkit to share state between hooks.9002- Local port the malware attempts to connect to.9003- Local port the malware attempts to connect to.