Stealthy Linux Malware ‘Sedexp’ Evades Detection with New Persistence Technique

This rule triggers whenever a new device is added, specifically checking if its major and minor numbers match those of /dev/random, a critical system component loaded at boot time. /dev/random is used as a random number generator by various applications and processes, making it an ideal candidate for frequent triggering without raising suspicion.

The rule’s final component, RUN+="asedexpb run:+", executes the malware’s script whenever /dev/random is involved, ensuring the malware runs consistently and evades detection by leveraging a commonly trusted system component.

Establishing persistence on the system
Source: Aon

Advanced Operational Capabilities

Sedexp further disguises itself by naming its process ‘kdevtmpfs,’ mimicking a legitimate system process. This naming convention allows it to blend seamlessly with other system activities, making it difficult to identify through conventional monitoring tools.

Process naming to blend with system operations
Source: Aon

The malware is designed to set up a reverse shell on the infected device, using either forkpty or pipes combined with a forked process. This reverse shell provides attackers with remote access to the compromised system.

Sedexp employs advanced memory manipulation techniques to conceal its presence. It hides files containing the string “sedexp” from being displayed in standard commands like ls or find, preventing easy detection. Additionally, it can modify memory contents to inject malicious code or alter the behavior of existing applications and system processes.