Using Syscall() for Obfuscation/Fileless Activity, (Mon, Oct 20th)
Source SANS ISC Handlers Diary
Description
I found another piece of malware this weekend. This one looks more like a proof-of-concept because the second-stage payload is really "simple", but it attracted my attention because it uses a nice technique to obfuscate the code.
Impact
For European organizations, especially those relying on Linux-based infrastructure such as servers, cloud environments, and IoT devices, this malware represents a potential stealthy threat vector. The fileless nature and syscall-based obfuscation make detection challenging for traditional antivirus and endpoint detection and response (EDR) solutions that focus on file system activity and standard API monitoring. If adapted with more destructive payloads, this technique could lead to data encryption (ransomware), data exfiltration, or system compromise without leaving typical forensic artifacts. The current payload is simplistic and unlikely to cause significant damage, but the demonstrated technique lowers the barrier for attackers to deploy more complex malware that evades detection. This could impact confidentiality and availability of critical systems. Organizations with Linux-heavy environments, including cloud service providers, financial institutions, research centers, and critical infrastructure operators, could be at risk if this technique is weaponized. The lack of known exploits in the wild currently limits immediate risk, but the proof-of-concept nature suggests a need for vigilance and proactive defense.
Defensive guidance
European organizations should enhance monitoring for anomalous syscall usage, particularly the memfd_create syscall (319), which is less commonly used in benign applications. Deploying Linux-specific behavioral detection tools that monitor direct syscall invocations can help identify suspicious fileless execution attempts. Endpoint detection solutions should be configured to detect in-memory execution and unusual process behaviors, including processes spawning from Python scripts with embedded payloads. Network monitoring for unusual outbound connections or data exfiltration attempts from Linux hosts is recommended. Implement strict application whitelisting and restrict execution of unauthorized scripts or binaries, especially those that decode and execute embedded payloads. Regularly update and patch Linux systems and security tools to ensure detection capabilities include emerging fileless malware techniques. Conduct threat hunting exercises focusing on syscall-based obfuscation and memory-resident payloads. Finally, educate security teams about this novel technique to improve incident response readiness.
Summary
This malware sample is a proof-of-concept targeting Linux systems, utilizing a novel obfuscation and fileless execution technique. The initial dropper is a Python script containing a Base64-encoded ELF binary. Instead of invoking standard library functions, the script uses the libc syscall interface directly, specifically syscall number 319 (memfd_create), to create an anonymous in-memory file descriptor. This approach avoids writing to disk, thereby evading traditional file-based detection mechanisms. After creating the in-memory file descriptor, the script writes the decoded ELF payload into it and executes it. The ELF payload itself is simplistic, performing file encryption using a single-byte XOR key, indicating limited immediate threat but showcasing the technique's potential. The use of direct syscalls for obfuscation and fileless activity is notable because it bypasses common API hooks and monitoring tools that rely on intercepting standard function calls. The malware has a low VirusTotal detection rate (4/62), suggesting it is not yet widely recognized by antivirus solutions. No known active exploitation or widespread attacks have been reported. The technique leverages Linux-specific syscalls, making it relevant primarily to Linux environments. The malware's stealthy execution and obfuscation methods could be adapted by threat actors to deploy more sophisticated payloads in the future.