Researchers at LevelBlue have uncovered a new variant of the SysUpdate malware targeting Linux systems during a digital forensics and incident response (DFIR) engagement.
The sample masquerades as a legitimate system service and uses sophisticated encryption for its command-and-control (C2) communications.
By reverse-engineering the malware, the team developed emulation tools to decrypt its traffic, aiding faster incident response.
Malware Analysis Insights
The malware is a packed ELF64 binary written in C++, dynamically linked without section headers, and protected by an unknown obfuscated packer.
It impersonates a system service by running the Linux ‘id’ command and outputting user details if launched without specific arguments.
Network activity involves encrypted C2 over multiple protocols, confirmed through dynamic analysis and endpoint detection metrics linking it to SysUpdate, previously associated with APT27 (Iron Tiger).
LevelBlue researchers used Binary Ninja for decompilation (viewing the High-Level Intermediate Language, or HLIL), GDB for debugging, and the Unicorn Engine with Rust bindings for emulation.
Static analysis spotted cryptographic constants and dense bitwise operations, while syscall tracing targeted network I/O routines.
Key functions included a high-level wrapper, ‘generate_key’ (calling ‘generate_key_internal’ with 64 iterations), ‘xor_and_UNK_1’ (handling encrypt/decrypt flags, 8-byte aligned buffers, XOR with keys), and ‘i_am_clearly_encryption_UNK’ featuring S-box-like data and constants like 0xf0f0f0f.
Defeating C2 Encryption
To bypass the unknown algorithm, researchers emulated malware routines using Unicorn Engine, preserving original memory mappings for accuracy.
For key generation, they mapped stack (0x7ffffffde000), unknown data (0x4fd000), heap (0x1393000), and code segments; populated with dumped GDB memory, plaintext key “!2#4Wx62”, and extracted machine code bytes.
Registers like RDI (generated key pointer) and RSI (encryption key) were set precisely before executing from 0x40cc10 to 0x40cc58, yielding a 132-byte key saved as ‘gend_key.bin’.
The decryption emulator extended this by adding buffers for encrypted input (from intercepted traffic), output, and the generated key.
It emulated ‘xor_and_UNK_1’ and the inner routine from 0x40cfe2 to 0x40d02a, with decrypt flag (RSI=0), data length in RDX (e.g., 168 bytes), and pointers in R8/R9.
Execution decrypted C2 payloads successfully, proving the approach; tooling is reusable for variants by swapping keys.
According to Level Blue, this method allows rapid decryption during live incidents without full RE, turning adversary code against itself.
SysUpdate’s Linux evolution highlights cross-platform threats from groups like Iron Tiger. Organizations should monitor for anomalous ELF binaries that mimic services and for encrypted network flows.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 engagement.){kind=link}