tori209/linux-malware-lab

Linux 타겟 악성코드 실습

Hypers

• LKM-based Rootkit
• 2024 Hypers Learing Project. (about malicious code - rootkit, specifically.)
• base source code: Reptile
  • Most codes are based on the Reptile, except kernel part.
  • Since mutants of Reptile is used to Korea companies in 2023, we choose this for analysis.
• this project is on working

Test Env.

• Ubuntu 20.04.6 LTS / x86-64 / Linux 5.15.0-101-generic

Improvement

• Now it works on kernel 5.0+.

Caution

• This repo is a project for learning purpose. Do not use for malicious purposes.

References

• kmatryoshka - milabs(Github Repo)
• Reptile - f0rb1dd3n(Github Repo)
• linux-kernel-hacking - xcellerator(Github Repo)
  • Used for alternative of KHOOK engine.

Reptile - Code analysis

• Notion Page (Korean)