Redtail Malware Payload: Technical Analysis and Behavior

Summary

RedTail is a multi-architecture Linux malware family with capabilities for extensive host profiling and process masquerading. It establishes persistence through crontabs, modifies host firewall rules, and attempts to interfere with monitoring tools by terminating processes such as inotify and strace. The malware also generates network traffic over DNS-over-TLS on TCP port 853 to potentially reach remote infrastructure.

Investigation

An analyst conducted dynamic analysis of an x86-64 RedTail sample inside an isolated Ubuntu 24.04 environment. The investigation compared root-privileged and unprivileged execution, used Proxmox/QEMU for memory forensics, and monitored syscalls with strace and auditd. Observed behavior included consistent host profiling, process renaming to php-fpm, and creation of @reboot cron entries.

Mitigation

Organizations should enforce the principle of least privilege to reduce the malware’s ability to modify system-level crontabs or firewall rules. Security teams should monitor for suspicious process masquerading, including legitimate service names such as php-fpm executing from unexpected paths. EDR solutions should also detect SIGKILL signals targeting security monitoring processes.

Response

If RedTail activity is detected, affected Linux hosts should be isolated immediately to prevent lateral movement or additional command-and-control communication. Responders should perform memory forensics to identify masqueraded processes and inspect crontabs for unauthorized @reboot entries. Network logs should also be reviewed for anomalous outbound connections on TCP port 853 and iptables configurations checked for unauthorized rule changes.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has deployed a specialized malware sample named redtail.x86_64 inside a specific directory structure /analysis/run-002/sample/. To prevent security analysts from debugging its execution or using strace to observe its network communications and file modifications, the malware proactively scans for the existence of the strace utility. Upon finding a strace process, the malware issues a SIGKILL (Signal 9) to the strace PID, effectively terminating the analysis tool instantly and silently.

• Regression Test Script:

  #!/bin/bash
  # Setup simulation directory structure
  mkdir -p /analysis/run-002/sample/
  
  # Create a fake malware binary to match the detection logic path
  echo -e '#!/bin/bashnstrace sleep 100 & nsleep 1nkill -9 $!' > /analysis/run-002/sample/redtail.x86_64
  chmod +x /analysis/run-002/sample/redtail.x86_64
  
  # Start strace on a benign process in the background
  strace sleep 100 &
  STRACE_PID=$!
  echo "[+] Started strace with PID: $STRACE_PID"
  
  # Wait for strace to initialize
  sleep 2
  
  # Execute the "malware" which will kill the strace process
  echo "[+] Executing simulated RedTail malware..."
  /analysis/run-002/sample/redtail.x86_64
  
  # Verify if strace is dead
  if ! kill -0 $STRACE_PID 2>/dev/null; then
      echo "[+] Success: strace process was terminated."
  else
      echo "[-] Failure: strace process is still running."
  fi

• Cleanup Commands:

  # Remove the simulated malware and directory structure
  rm -rf /analysis/run-002/
  # Kill any remaining sleep processes
  pkill -f "sleep 100"