MALWARE FAMILY

Rekoobe

Internal ID: elf.rekoobe

aliases

Last seen:Mar 17, 2026

Intelligence Profile

A Trojan for Linux intended to infect machines with the SPARC architecture and Intel x86, x86-64 computers. The Trojan’s configuration data is stored in a file encrypted with XOR algorithm.

Some versions have there configuration stored within the .data section using RC4 to encrypt the details.

Configuration options include C2 IP and Port, as well as defence evasion details for changing the process name.

Threat Analysis

Rekoobe is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://asec.ahnlab.com/en/55229/

→https://blog.techevo.uk/analysis/linux/2024/11/30/rekoobe-apt31-linux-backdoor.html

→https://decoded.avast.io/davidalvarez/linux-threat-hunting-syslogk-a-kernel-rootkit-found-under-development-in-the-wild/

→https://documents.trendmicro.com/assets/txt/earth-berberoka-linux-iocs-2.txt

→https://hunt.io/blog/rekoobe-backdoor-discovered-in-open-directory-possibly-targeting-tradingview-users

→https://intezer.com/blog-linux-rekoobe-operating-with-new-undetected-malware-samples/

→https://sansec.io/research/rekoobe-fishpig-magento

→https://twitter.com/billyleonard/status/1458531997576572929

→https://vms.drweb.com/virus/?i=7754026&lng=en

→https://www.intezer.com/blog/malware-analysis/elf-malware-analysis-101-part-3-advanced-analysis/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

elf.rekoobe

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Rekoobe