Skip to content
MalwareWiki

Malware

Rekoobe

A Trojan for Linux intended to infect machines with the SPARC architecture and Intel x86, x86-64 computers.

Rekoobe is a Linux malware family.

Background

A Linux Trojan designed to compromise SPARC-architecture systems as well as Intel x86 and x86-64 machines. It keeps its configuration data in a file that is encrypted using XOR.

In some builds the configuration instead lives in the .data section and is encrypted with RC4.

The configuration holds settings such as the C2 IP and Port, along with defense-evasion parameters used to alter the process name.

Source: Malpedia (Fraunhofer FKIE).