EpiRootkit core functionality and capabilities
Command Execution
Execute system commands with output capture
DNS Resolution
Kernel-space DNS client for domain-based C2 communication
Encryption
XOR-based communication encryption for C2 traffic
Sysfs Interface
Linux permissions-based feature control
Module Hiding
Hide the rootkit module from lsmod and /proc/modules
File Hiding
Hide files and directories from directory listings using syscall interception
Persistence
Automatic rootkit loading across reboots
Line Hiding
Hide rootkit lines from file contents using syscall interception
File Transfer
Upload and download files between C2 server and infected systems