Skip to content
MalwareWiki

Malware

PITHOOK

According to Mandiant, PITHOOK hooks the accept and accept4 functions within the web process by modifying the PLT.

PITHOOK is a Linux malware family.

Background

Mandiant reports that PITHOOK intercepts the accept and accept4 functions of the web process by altering the PLT. Should an incoming buffer contain the expected magic byte sequence, PITHOOK clones the socket and passes it along to PITSTOP through the Unix domain socket /data/runtime/cockpit/wd.fd.

Source: Malpedia (Fraunhofer FKIE).