ELF Binary Masquerading as MP5 via chmod

Ethan Andrews@eandrews

•updated Feb 27, 2026•2•0•48

Detects a file with a .mp5 extension in the /tmp directory being made executable via chmod. This technique was used by a stager to deliver the Rekoobe backdoor by masquerading ELF binaries as media files to evade detection.