Melofee Linux Implant Resurfaces: APT41 Toolset Evolution with Reptile Kernel Rootkit — OTX Detection & Hunting Pack

---
title: Melofee Implant C2 Communication - Masquerading Domains
id: 8f4a2c1e-7b3d-4e5f-9a1c-melofee00001
status: experimental
description: Detects DNS or network connections to known Melofee / APT41 Linux implant C2 infrastructure, including Microsoft-masquerading domains identified in OTX pulse.
author: Security Arsenal Threat Intel
references:
    - https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/
date: 2026/10/11
tags:
    - attack.command_and_control
    - attack.t1071
    - attack.t1071.001
logsource:
    category: dns
detection:
    selection:
        query|contains:
            - 'windefender.net'
            - 'microsoftupdates.top'
            - 'blog.exatrack.com'
            - 'blog-en.itochuci.co.jp'
    condition: selection
falsepositives:
    - Security research or threat hunting activity
level: high
---
title: Reptile Kernel Rootkit Loading - LKM Insertion Activity
id: 8f4a2c1e-7b3d-4e5f-9a1c-melofee00002
status: experimental
description: Detects kernel module loading activity consistent with Reptile-based rootkit deployment used by Melofee variants. Monitors insmod/modprobe execution and suspicious module paths.
author: Security Arsenal Threat Intel
references:
    - https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/
date: 2026/10/11
tags:
    - attack.defense_evasion
    - attack.persistence
    - attack.t1014
    - attack.t1547.006
logsource:
    product: linux
    category: process_creation
detection:
    selection_tools:
        Image|endswith:
            - '/insmod'
            - '/modprobe'
    selection_suspicious_args:
        CommandLine|contains:
            - '/tmp/'
            - '/dev/shm/'
            - '/var/tmp/'
            - '.ko'
    selection_reptile_artifacts:
        CommandLine|contains:
            - 'reptile'
            - 'reptile_cmd'
            - 's5pVH78wnzHGuwkd'  # Reptile default magic/hide token patterns
    condition: selection_reptile_artifacts or (selection_tools and selection_suspicious_args)
falsepositives:
    - Legitimate kernel module installation by system administrators (filter by known module paths)
level: high
---
title: Melofee Implant Execution - Shell and Module Loader Behavior
id: 8f4a2c1e-7b3d-4e5f-9a1c-melofee00003
status: experimental
description: Detects suspicious Linux process behavior associated with Melofee backdoor operation - shells spawned by services/daemons, execution from memory-backed or hidden paths, and file manager module activity.
author: Security Arsenal Threat Intel
references:
    - https://www.stormshield.com/news/cti-melofee-linux-implant-and-new-variants/
date: 2026/10/11
tags:
    - attack.execution
    - attack.t1059
    - attack.t1059.004
    - attack.defense_evasion
    - attack.t1036
logsource:
    product: linux
    category: process_creation
detection:
    selection_shell:
        Image|endswith:
            - '/bash'
            - '/sh'
            - '/dash'
            - '/python'
            - '/perl'
    selection_parents:
        ParentImage|endswith:
            - '/sshd'
            - '/nginx'
            - '/apache2'
            - '/httpd'
            - '/java'
            - '/cron'
    selection_suspicious_path:
        Image|startswith:
            - '/dev/shm/'
            - '/tmp/.'
            - '/var/tmp/.'
    condition: selection_suspicious_path or (selection_shell and selection_parents)
falsepositives:
    - Administrative maintenance scripts executed via cron
    - Web application legitimately invoking shell commands (rare, investigate all hits on servers)
level: medium

// Melofee / APT41 Linux Implant Hunt - C2, Rootkit, and Module Loading
// Microsoft Sentinel / MDE - covers Linux endpoints via DeviceNetworkEvents + DeviceProcessEvents
let MelofeeC2 = dynamic(["windefender.net", "microsoftupdates.top", "blog.exatrack.com", "blog-en.itochuci.co.jp"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any (MelofeeC2)
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessFolderPath
| extend HuntSignal = "C2_Domain_Match";
let RootkitLoad = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName in~ ("insmod", "modprobe", "depmod")
    or ProcessCommandLine has_any ("reptile", ".ko", "/dev/shm/", "/tmp/.")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend HuntSignal = "LKM_Rootkit_Load";
let DaemonShell = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName in~ ("bash", "sh", "dash", "python", "python3", "perl")
| where InitiatingProcessFileName in~ ("sshd", "nginx", "apache2", "httpd", "java", "cron", "systemd")
| where ProcessCommandLine !has_any ("apt", "dpkg", "logrotate")  // tune for your environment
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| extend HuntSignal = "Daemon_Spawned_Shell";
union NetworkHits, RootkitLoad, DaemonShell
| sort by TimeGenerated desc

#!/bin/bash
# Melofee / Reptile Rootkit Hunt Script - Linux Endpoints
# Run on suspect hosts. Checks C2 artifacts, hidden module indicators,
# hash matches, and cross-view discrepancies for rootkit detection.

RED='\033[0;31m'; GREEN='\033[0;32m'; NC='\033[0m'

MD5_IOC="40637c70fd5cd899ca41d1252c267ccf"
SHA1_IOCS=("71d3832587a1d009ca3c0947005b187f23e52008" "b6df18f66cf4364be2946d6b981e69763aafde68")
C2_DOMAINS=("windefender.net" "microsoftupdates.top" "blog.exatrack.com" "blog-en.itochuci.co.jp")

echo "=== [1] Loaded kernel modules (check for unexpected/unnamed LKMs) ==="
lsmod | awk 'NR>1 {print $1}' | while read mod; do
    if ! modinfo "$mod" &>/dev/null; then
        echo -e "${RED}[!] Module '$mod' has no modinfo - possible hidden/Reptile-style LKM${NC}"
    fi
done

echo "=== [2] Reptile artifacts ==="
# Reptile hides itself from lsmod; check for known hooks and control device
ls /dev/ 2>/dev/null | grep -iE "reptile|/dev/.{1}\.ko" && echo -e "${RED}[!] Suspicious device node${NC}"
find /lib/modules /tmp /var/tmp /dev/shm -name "*.ko" 2>/dev/null | while read f; do
    echo "[i] Kernel module in non-standard path: $f"
done
grep -riE "reptile" /etc/rc.local /etc/systemd/system/ /etc/init.d/ 2>/dev/null

echo "=== [3] Cross-view rootkit check (proc vs ps) ==="
ps aux | awk '{print $2}' | sort -n > /tmp/ps_pids.txt
ls /proc | grep -E '^[0-9]+$' | sort -n > /tmp/proc_pids.txt
comm -13 /tmp/ps_pids.txt /tmp/proc_pids.txt | while read pid; do
    echo -e "${RED}[!] Hidden PID detected: $pid (in /proc but not ps output)${NC}"
    cat /proc/$pid/cmdline 2>/dev/null | tr '\0' ' '; echo ""
done

echo "=== [4] Hash hunt in common implant locations ==="
for dir in /tmp /var/tmp /dev/shm /usr/lib /opt; do
    find "$dir" -type f -executable 2>/dev/null | while read f; do
        h_md5=$(md5sum "$f" 2>/dev/null | awk '{print $1}')
        h_sha1=$(sha1sum "$f" 2>/dev/null | awk '{print $1}')
        [ "$h_md5" == "$MD5_IOC" ] && echo -e "${RED}[!] MD5 IOC MATCH: $f${NC}"
        for s in "${SHA1_IOCS[@]}"; do
            [ "$h_sha1" == "$s" ] && echo -e "${RED}[!] SHA1 IOC MATCH: $f${NC}"
        done
    done
done

echo "=== [5] C2 connection & DNS history check ==="
for d in "${C2_DOMAINS[@]}"; do
    grep -r "$d" /var/log/syslog /var/log/messages 2>/dev/null | head -3
    ss -tunap 2>/dev/null | grep -i "$d"
done
# Flag established connections from unexpected processes
ss -tunap state established 2>/dev/null | grep -vE "sshd|systemd|chrony|ss :" | head -20

echo "=== [6] Persistence check ==="
ls -la /etc/systemd/system/ | grep -vE "^d|\.wants" | tail -15
crontab -l 2>/dev/null; ls /etc/cron.d/ 2>/dev/null

echo -e "${GREEN}[+] Hunt complete. Investigate all RED flags via IR channel.${NC}"