Rekoobe
- First seen
- 2015-11-01 00:00:00
- Malware type
- trojan
- Family
- Malware family
- Last IoC activity
- 2026-07-21 17:58:06
- Profile updated
- 2026-07-07 13:01:46
Context
A Trojan for Linux intended to infect machines with the SPARC architecture and Intel x86, x86-64 computers. The Trojan’s configuration data is stored in a file encrypted with XOR algorithm. Some versions have there configuration stored within the .data section using RC4 to encrypt the details. Configuration options include C2 IP and Port, as well as defence evasion details for changing the process name.
Detection coverage
- 1 YARA rules
Detection rules
- ARKBIRD_SOLG_MAL_ELF_Rekoobe_Nov_2021_1 (yara-rule)
Reports & references
- Trend Micro — Earth Berberoka Linux Iocs 2.Txt (report)
- malpedia.caad.fkie.fraunhofer.de — Elf.Rekoobe (report)
- sekoia.io — Walking On Apt31 Infrastructure Footprints (report)
- blog.techevo.uk — Rekoobe Apt31 Linux Backdoor (report)
- twitter.com — 1458531997576572929 (report)
- intezer.com — Elf Malware Analysis 101 Part 3 Advanced Analysis (report)
- intezer.com — Blog Linux Rekoobe Operating With New Undetected Malware Samples (report)
- asec.ahnlab.com — 55229 (report)
- sansec.io — Rekoobe Fishpig Magento (report)
- vms.drweb.com — Virus (report)
- yoroi.company — Shadows From The Past Threaten Italian Enterprises (report)
- hunt.io — Rekoobe Backdoor Discovered In Open Directory Possibly Targeting Tradingview Users (report)
- decoded.avast.io — Linux Threat Hunting Syslogk A Kernel Rootkit Found Under Development In The Wild (report)