Description of Campaign
Symbiote targets Linux devices and appears to be focused on the financial sector in Latin America. The domains used by the malware mimic some major Brazilian banks to appear legitimate to victims. Symbiote tries to stay under the radar by hiding files, processes, and network artifacts used during the infection process. The malware exfiltrates credentials, creates a backdoor for persistence, and provides rootkit functionality.

Our ATR team gathers and analyzes information from multiple open and closed sources before disseminating intelligence reports. This campaign was researched by BlackBerry and shared publicly.

How to use this article:

1. If a Threat Hunting table has been created, use the rules contained to search for malware related to this campaign. 
2. Review the product detection table and confirm that your environment is at least on the specified content version.
   To download the latest content versions, go to the Security Updates page.
3. Scroll down and review the "Product Countermeasures" section of this article. Consider implementing them if they are not already in place.
4. Review KB91836 - Countermeasures for entry vector threats.
5. Review KB87843 - Dynamic Application Containment rules and best practices.
6. Review KB82925 - Identify what rule corresponds to an Adaptive Threat Protection and Threat Intelligence Exchange event.

This Knowledge Base article discusses a specific threat that's being tracked. The list of IOCs will change over time; check Trellix Insights for the latest IOCs.
 
Campaign IOC

Type	Value
SHA256	F55AF21F69A183FB8550AC60F392B05DF14AA01D7FFE9F28BC48A118DC110B4C
SHA256	45EACBA032367DB7F3B031E5D9DF10B30D01664F24DA6847322F6AF1FD8E7F01
SHA256	A0CD554C35DEE3FED3D1607DC18DEBD1296FAAEE29B5BD77FF83AB6956A6F9D6
SHA256	121157E0FCB728EB8A23B55457E89D45D76AA3B7D01D3D49105890A00662C924
SHA256	EC67BBDF55D3679FCA72D3C814186FF4646DD779A862999C82C6FAA8E6615180

Minimum Content Versions

Content Type	Version
V2 DAT (VirusScan Enterprise)	10379
V3 DAT (Endpoint Security)	4840

  
Detection Summary                               

IOC	Scanner	Detection
F55AF21F69A183FB8550AC60F392B05DF14AA01D7FFE9F28BC48A118DC110B4C	AVEngine V2	LINUX/Symbiote.b
	AVEngine V3	LINUX/Symbiote.b
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
45EACBA032367DB7F3B031E5D9DF10B30D01664F24DA6847322F6AF1FD8E7F01	AVEngine V2	LINUX/Hacktool.e
	AVEngine V3	LINUX/Hacktool.e
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
A0CD554C35DEE3FED3D1607DC18DEBD1296FAAEE29B5BD77FF83AB6956A6F9D6	AVEngine V2	LINUX/Symbiote.d
	AVEngine V3	LINUX/Symbiote.d
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
121157E0FCB728EB8A23B55457E89D45D76AA3B7D01D3D49105890A00662C924	AVEngine V2	Linux/Symbiote!0C278F60CC4D
	AVEngine V3	Linux/Symbiote!0C278F60CC4D
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
EC67BBDF55D3679FCA72D3C814186FF4646DD779A862999C82C6FAA8E6615180	AVEngine V2	LINUX/Symbiote.b
	AVEngine V3	LINUX/Symbiote.b
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

Minimum set of Manual Rules to improve protection to block this campaign:

IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Host Intrusion Prevention:
Aggressive set of Manual Rules to improve protection to block this campaign:

IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Host Intrusion Prevention: